From d4bcc2b3bbcd9d7dafe9d46c126c9d0e1ddfcdd8 Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Sat, 20 Apr 2024 07:53:40 +0000 Subject: [PATCH] Bug 66425: Avoid exceptions found via poi-fuzz Prevent a NullPointerException Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65448 git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1917175 13f79535-47bb-0310-9956-ffa450edef68 --- .../poi/xwpf/usermodel/XWPFFootnotes.java | 7 +++++-- ...inimized-POIXWPFFuzzer-5166796835258368.docx | Bin 0 -> 12890 bytes 2 files changed, 5 insertions(+), 2 deletions(-) create mode 100644 test-data/document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-5166796835258368.docx diff --git a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFFootnotes.java b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFFootnotes.java index f9bdfb7ad8..177a570882 100644 --- a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFFootnotes.java +++ b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFFootnotes.java @@ -127,8 +127,11 @@ public class XWPFFootnotes extends XWPFAbstractFootnotesEndnotes { XmlOptions xmlOptions = new XmlOptions(DEFAULT_XML_OPTIONS); xmlOptions.setSaveSyntheticDocumentElement(new QName(CTFootnotes.type.getName().getNamespaceURI(), "footnotes")); PackagePart part = getPackagePart(); - try (OutputStream out = part.getOutputStream()) { - ctFootnotes.save(out, xmlOptions); + + if (ctFootnotes != null) { + try (OutputStream out = part.getOutputStream()) { + ctFootnotes.save(out, xmlOptions); + } } } diff --git a/test-data/document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-5166796835258368.docx b/test-data/document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-5166796835258368.docx new file mode 100644 index 0000000000000000000000000000000000000000..08e62e49e23a2a163a5ccd923cd5bbba2ed716f0 GIT binary patch literal 12890 zcmeHtWmH|;mgd2ogS!TIcMtCFPH=aJ-~@M<;1Jvi4j}=8LvSa!AKanOy;aqHtMBX4 z^{2<^?)TP@J+`c|WbW^qwx)_a6f_n97614}lU7j=$*K@{oPJH7W0%D{4C^siELd-pqhG(P%AJ zpS<@w@_oTV=k|;>bR0Pjo;{~O1q8DunnKusb`mDg7{A=x4B0kxlOp6p{|8NNl_3S4 zoKiJ1gnjv%z@!LjSv7=_VM!$oRS2uRq)nlgbSqVq0Cmx;X%GTN!!WD2QA+CwDqPkZ z>2d4$Cwh5{z(7o%)$kQLpq>X-GO=q4 zbffL>*qdBPA5Vos_|K5oYFbRZ3WZ9OrgsoY>}&n;_e`$pPdE7?gt=?4>r60Sly9fu z4^Oz;()?b*8IxC%sjM~WlVTN0QbrJ@KR5b^6Lypjn6slNkvs4naXRM0u>E_yT3<|$6T?Z82->c|uvG#R z7zxa9V^<4%Hx}kUuK!~8KQW#Evh~>H6*(v|a4b$NOo)yG*GfV3-gr8d$3Knxrq&Mum9ok~xRCI^+vqP*< zq$lca9G&J_1d~z=1!LK&ihegmh*1i^v*f5RHV7Z?(dbAdl0{HYNE#!&iLL7B8M@Yn z%FZfV)XUj2t>3zUmT6X9)>e@T4FY%x0fAsjkBe@VI;6;outZ3 zGOI@9-n1#2yODS^j)@OvL?}dvn!NJ&$c54~0=h31`3%(wkdo^%;sp3TiHA0^SPO$~ z-QPL#qp~qa6Z}O84geqmz(aUBxtg>58&TXW+}&*)t=#^wg#SSr2(UQ>_x|T@)taM@ zpO*u&S0x=yOeS%>A6Tnd}} z^a8cdU00aGJu5`(t8V*Cwq!=5E8`)jI%r6>dCyWfwA6|t)G&#)i2+`O(D(i8$5!T1 z>PYFlUataYh>#3D3cPGuMVQR`hIH~IbANo}YJUt-3|OW6$Yj!dB@81z|8K7_Xg^K; z%-HQZX20IhNue}mcCyVkAQ^ubMo85&rM^2IOZu{Fwv`t4vi+lByNJyH$i&6krmnmN z&kpx_ndbRY$eB3| z#ejbGiJDEhicA%?;#HuOMi#u!pa-=2owMyjRXLogM0i5OLM0W9u8m+?GHdU zYmLUQaAU3E9*CeVn{#Y0DD0ER5>s-x=#kOI`uGEw40XS&l!&Tnl@>J=DI zKcx7}0wsUmxMM8X81^MnCExYCO$HbUe$y5*9 z{8g@fHhOS6+Wy-A@{|YHBloC;UWN}Adt^}lWN#wPrPnDX7tztLgED+vAtyw@KU=bQ zbFYUUh-sL*8r7cot>&?~f0NR7?!ZL@AG?hn6)6eN!DFvWrn*Uia`x2&!xFbs?6T6M zy#q`6H>MWC?>LA16^Th7%!S!5o5~tCaqNAHBeqgSJ0baYA7FH?cUQI*% z7dVB`qp`W{G=H(%pt*0mj5PW0pzw4i*lUQ_{cr>7=0r>Zlb2CmH9!Gh=`sAIRk+Xz zff)Bo)XrQ1Y9je&*PvhQRY+!Da%2cmdo zG^^O_tWO%gz7!>G&+Os`G_Eo}|NP3{ww$*#xD`>*L`^(G*mk*^kYNyCd@klRWrYXf zKe^*fy`zYkB_7n#UP9FlcZHeLf=0C@b6qZw1_7k}-|5lM#VVUs`Cg0-9 z3?-(+8V{4-+?|%C2t&lTp4OORtv0F2VW9p9_R9WF{9gmHrNv+iV+#!cVEhO1EuEa) z9i7}Q{xn73)fJsqSdqJd2OnA8mCef~_3&JxnZzc=mR|sx>4c`qv@)(;&rhmaI|0q` zAx552h0>Q7Ldm*9ud|iBi2GET5gJ#?Sl^tjOMUEy?=s4lpy>Qf$}A9Lt%qg3FTeIY zG!h)4lHtLB!yPvD5BLruht^j=dJwbT+cydCH-S@X3R1q4;&K!571%CdLb}wX$5(P! zO_z5q3y!#+n6-+|N?#3*Wd5E^(4pk&^16fQrMRKd4zq4&`fV|Zzfc7V?_=V;759rS zceD2}<&ZpeyxwkCztOK65Bt7w>ojxVrrvQ7(mDEC+2(hhv<%IX4dPgj>YJI75>!ahDKXG4_CTR)ipT zFOLIS+T#!?nz4zGHN8ofBo9pgvzrVeKM9BjiyRa7UxD!dyN(T*FaPITbE=~9H&L{R zbL!Vf%epc{kV$Nzvx*>n6yD^hCn8}d>5^{GYxgf40!~p?&`il%z{cIu(!@0^gP{Zx zsG?d{m*=n^KDIfF{a0#t!sl&298)xE%y6#6MlLeK>$*DM?G~t583$I2CbU(keOjvm z80z`p!n9RiCdlqbIJ3Cr8oGK z)wy>3;;yTf!18f7s>10E#|eFePa1B9l;hDjBlZtK*Ua|(Ae!A>F@j?)c;sV9&?R)s zdDI0d{aAz#YVzyXTls0cj5Ot=Ps9#>1Yx2#!c;qcq~9HQ5(xLT!l)G1U*pV%y09tB zUx{L5A!sz7Gk#cC>ytyG5O2;k`Eg5IxG^R#yY1A76PUdMht`$8s1d7g2!O=IILdEt zd{ShfKqpsXd}bWOx8_&2C3n5xAN_aD`G04$`}ltzl>eIHzbb)$`e=7b;#VXi*whJw zwdMa5?fx~m_*b<17erO3^eYXpf>R_iUE*m1iUKC$)~C!t%?!vcO6uh`*2(m@LES>r zl{HKZLN^B+m*i z0WE>ydWkIG8f{rY%&?eR7+eXt#f)M|$PQ40R;eC(i9o}CLUIvF2!C`*`Ljn7Mq+Q+ z6+u(SoQ*~kFKhpOk@b$`i6TubxvF-}%4F$PzI^7x9!0Jdkm4Y- zRJYNPqC)GikS@$hiG?w=fB8W4*?$Nw(kr)+ZaPA48tHc)t*Ar^d$HLnQsA1uoja5{ zBM!c$TA~pv1vT%<$7g31$}9z%T=*E#a8}vE8KXq~s$^D98zo+Df!s1Z0=`CpFFS=q zan^F*-XAgAOS$Zvr>4`f!Jg!qvHhT~n7z<+P(z1kl~QxFACI5iPW%ucpo%h8TVE(DX=4vJX3g7mp;WnOVXe(m#@jN$rO>z3KBz1QTG6D*DM3f zj5;|3P`{@(`5G1ezK!nY+sXL8sjv_@ zw-B1n6x)6s5lI`V39zm7{`?{a8n8CoJb?xBqqTBX;ZYZJI^ zd1DFcL*W9&SJ(-BfZkJJJBAVI+XL7M&g<-o9mEEU>?(|uRp;Z5Zy1{2=$s7p{gCV9 z(?`?_>P4)wI&kX>NX#|{<2+kE-R2!PRv|DkVRAHd-hQ*@J;y3N=V3&VZn0oIwLv%nFIh31t=JUx)=YS!eGbfnT-zbk)1g<87iTBcGJo=9o+? zE|gEgYBX5a9sRy$$GaUM9S;>YYh6BBNl76&xrJ~*mh<|d=Ne-Fl#%NM@#gEi>A2Kt zutTL(W*^k?^}? zB#BK_`l3pa=!|Rt;qrD6#6X8>B=(|1q^W)|&SL2k=Muj?@l;*Cv|92H9iwFK#poJg zN{ol?r#BMPFI5X?L&(G!aZ7cuDAD&cGh66xg)G$(1!_tGO;CD zIKJuV_7$51)SrizX{ED|OMR?a|7nvhdh3$!**0IzW#Aw6I+8n9qg4LO-l9>b2-cjG z(Cxlu+4h6mQa@qh51xHc+=OLY=g}t0@NeyX&7)3+IeIUe}5^y zz|Lqp`8blS@svhOH&7iJpRM@r=;5v|Uqo^Um`^Nne|Wz&uni}o_kN<%AvbJSlco3N zWO9hKSR_C2>T())&Rciz?Qwvn_xag}3vI@VdLoA9^YiV=&zL&lmzPdyY>;BGw8eem zphQv54*cmA9u|j|3l$B8OAqz{{IARCamrNQ{%m=em;7j=>v1~EEH5HH{_icD#1Om1 zh~5FNljz=PQBg(Mxn4z!5NECv{016&rqWmRSw6h7-)#5H)CNyK`0M=WjKLi0?UqIK z-~h@?UpPt-vEAV*VWG;t$C`0_4oXBkJySbc^vHM&kr&oFV3s6SU{GW)p`gjOjA^w& z4$RUzM1J+OZ}Nll;H{eRjUnog8AcqV4&vrzO%(BKn<~h7t%>RUtRruW@f- zpiB>Pm%)?n4wBJr*-Hlm$SZC1t2EHB^^BG^#9&2}XiRqn^RZC0-HY*jbI}VYo}#4x zAd(1&R)lxzq6xFH>lkt11%gt->3Bk=itkjegKe`p_{52XCd7e`-P5J?6|*;#j_`w- z91504xz-TpL+7_~S`Ek1t>1_|sUx_?BDIN64opiq^?sVWW4BT7yWzbW1-;tg4_1ux z+CY>`6p3h8`m>$CpKE#j-X4B;(SBy>p`5H_#j;+DS(I97Uc2~K>!*NESV2d@Q)1Ia zbs{823VXxv_M7qt9b??4sueq{vvXmeB?^W?fP^OJCuc-OzqMZy@3WFnspQ(j28!@& zOKL8r?iu`M?T^Gi)evD+8Imk+VGHGc=0aqbs+=OSc9UYr?$gbxG5Gl@#IbImx;C7j zqpbsd97{4%zp#=Qy~ftZw$69S~g-E}`qmR)qgD-0EZ ztawH`8XEa2)fGFgj2x0nm*v|*XQhZCUYI)hHEA=PZx$(aVJJ`PDNE)LV>vYjY&-}@ z&Nrr~!sYeqaBAdpIO$0!C>&|w0C`RthBsHtF<(_g4UOU^*@i~geo&n(gr~cq{NRV* zRgF#Z6w98sTnwfDMW65_`q2p*q85iX1BojOltrlwyfUK;j5i&X^j8$xfAGn7T*hVg zFS(4(z+3HVm0Rck#BoGaBMl*BF8p44I)$k|Kpio zx>&Ia58tl88@+DB-7?XAxd3U-SV5|Oq@sArN-tW2HPEuN($Fb=-_J=GU5L%DiNHq- z&@`hpH8S(cCCR(5Wydg|J2*OSzzh1_HOQ*NDM7bNPW}RSD?;yY+3R_L;xT+z*!u3? zyD&;@QB=dYF%E79W(GCBz@;&iJCl>nZn@fHMr)Mk80pL%sfQ-EhDso&chcshh|g__ zuiZOoaDwqxvVYjRu{vl-&hD*zbcbOE@bn{Bt1XcJY?@r zIo1UWOFb+22=@g!X0`B=(V2B7JKw-_7z#r93Laq!9=+RR7Q~8B9wm!Q)4yPR4YwJh zTfc;b|IS7M;g8)|vwofmI|EOtDPp*TJ6utxH(FhX9EuYe=FT|U1%e%EEx|mC=WO`} zYlsSc)tiN~=cydj953b|6GLolw<{X6BYh)%TASn&1cw1Z@h0e=dNgbit0G}0sVV?+ zE2bNro`v{0e+>kV!-df|v`r0+MscnSZKj&qh0LANE)vAlJ!pG=If$I#kBMr8lH&)atA%ArF{jQiB;m!7R25;oj zp3m3_HTJ@>cz1mK@2x$X`ni#~ zpD$ZMVtO0+zQ7Q#Pw#wDzE$MVtohGw)y4+KsCs3)mlr!`x!-5s%#oa9!q=X;*icR% zx9P#JaXc!k)m~avdc%7vBM-Dcu0@v2YpNiRPFY4q3vH&GrwaI&pp+*I-k0*}KZ5%8 z6N}GQF^!$BCibGZi@&2I1B-nzh-hCw>pd$u^35~|k60SC&@?#r*HmTo*PL*gjGCgq zVkZv0q2O-(osI-o&E-v@T3t5YgiZzRpcH@Po{G3W1~UtW_34boXs>I<)V~De|6kpf zREy;(d`eS=35le?PKK_O!*)e%f@HZMPUFLhOX5b3Cn_x?=zG-T6ZtjP!fD%(Pk!1? ztyjG7m)H5d2B0f3Jxv??n4@;B@BsayxaC{sKbG+8!h&PGWtaqV<~Fz6te+Tw4U+)2@1%N*p7Uz^<~m#Y+2i>7cbfRIRuh zV&I);kgbk5tQJqL1)xFpF6Now*jUgd2BNW9z^>JCKWPX`B}B&RK*Y1sT0|Tulq)Ui z^Z8qyyet0HlvIA6v}DtR`4KV2;2I(+RE0i_IlzM<9GOfx@P1OTmU>3416LXrCnwzy zd!U(u<0@=?4E2*Xq;F+T*j0wr-J@HfE)N3j34rUE8X}xHPmjsXBPD1~e~r?_r!qoB zN>gbU??-KpCYcuona(WG2Q%oA+zC=eWJeKjq_loY_L9T{5i^bwuU-Xy^NlXI?h&;@ zZXKG8n+LD8sh5NPm_&~6Ww#aXlDeQCYL?Oo5>bF(_>$UW3rmT5ww`DXz5aiU7ukg% z`jW^4Q9*i14e+2j_e^{p&I$Ul2Rrmd6a1#(updJ6XAU4top;qawaaDUqt{MHT;; zpje$kW5^Af@sFPr--V!)$&&ZyD)N!OH~g{GzYOkm=?Hh20PbV&=$xxZXh_KF2m}P;( zIVP(ASlEAA@?$>JDlV0=GO>4Zkndzc*PJLUk#C3uOfzg?5<`|4O^SUl@eF!>b7Js; zEU+@lDb*L=8n;tAADUeJM+~Kwcj*&?)1d|dx>O2g9&}spWQbQ8L|Fr>`VnXk#T}@* z5?(JP%Yz!6|Kk^qo@eXsxGNJ1L72O7h6BVm;pV$3H1ieTYqPa|D9na0BdFUO4ovi~ z$U;t|t`iRr&b&Q6_)D-fSW87=p)HoE^&1t4T~2`aUEx8kr5hf&YT``R?Y^`_@-9s+ z!?B@vr-ZviD+60?mfVC&>+6}jah`SIVP%4#!@g_3tRV*L^O12whhyy(Y)h*xb+=>( zoX)=9sKdws%Z4HO7KUq3WS#7n=XQ_AIi&xBw&RIZ6dmhrA`&4r-!tPNAY3@@ykRy< zr+9J{;?T0`xGGVEPQpTOUd$UdToK!1ZZUn65K0kpz^Mr2khSmp@v7puM{MvIPCm6! z>{Y0bq;wEl14qMS7^EJ%pN;swjkI#Mtgy2zvMEN=j2$-6`|}Yo@>)@5U<6(I2Dm!s z+=^XR7;&uby~B$-W;^}ZN)lF?7Lh-nx{ zo^XcHe1vE0+ceh2YyLzp^7@8wP~c56%d}bIYvMi^VtVbyL^da<2Miv&b-8xB8DKH{ zFsE1xL>z=tFJn$P7tFLLJ%Q`=6dYaTfiA^ z{pDglR?NO$^zj3hWuQsm)Z(|iUir!Wx;Jpf{vSB7a2V$N;4h`% zIsz=PP5d)A<7Hu{{+F_~R5e9qaPGRB;)1ktRd)ofUek_7@t0Dr$#W2+%Yuw75tZ)f z?eWDj#P)WdlFM^`o>lMIp3}TJQ&`1x+KFds6LPLZ=~}CK-SOObm<1a`d6*a+)rz?J z)zPEvJT|et5gC=)U~I=%ov>ssx`&V}TEhBw@l&A`)q^IIMRtp>)pks#QLa|~RKgQi za3p=7BoNJt1I)`E*FJW5;H3g-$)zyN#-}C`Pjw^-(j2!B$2#6K5L{dY@=wrsrPwGh z7A&)P$eS=A7siqvYK75M{F3H=8xuZuxRUmbd*$&8rYn3&q7g&Fj&~}lBap6=uttzv3ziHwfOf+`G1uL zf<+grrmFmn6)lkGLWD73qoV=ZWl1U|f`*OSjI(F%HfUs?+rboc?!be`_-HZ{xgM|) z;C0vXaIK=_YuUSi$IRw%UFSDaL*yR*mj= z{IcxJ@|AhDdJs}<8Y-dnur#V6ECxs&+#hk8hq0UXZYx%m%3bPO@K5{l16aFgxD_$E zYy={5MEXf%$`?H65|PfaVKnw)Ez?&JM~IAT&n!KSH$)vW&Y<8_P`=9<3cGcnSPCfe zIPCJBqHKI?NXo|77W`zu1trd`@tCyjRNz-=0sM9RZuloI0?NpnU z8sM5`P10IlAEcGyJid?A`me~LU81y!JlTWE7xwm1scpu1kr%a4Unk9s3gzt=eKukg z>`BNxk%4pF*MA7tcI}UQ8DQ0b2J@eah#cKDOwH{7#A|cPhEgai*5J9KKirI;wCTs( zm@!_D3?saNAPy}l%;n^K$Ac9=IhRrPjM#rex~a4CA3#@;hXLn<|0tBf1T=$B5sA6~ Gc=~UF<{#Ps literal 0 HcmV?d00001 -- 2.39.5