Browse Source

Bug 66425: Avoid Exceptions found via oss-fuzz

We try to avoid throwing ClassCastExceptions,
but it was possible to trigger one here with a specially
crafted input-file

Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62795

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1912796 13f79535-47bb-0310-9956-ffa450edef68
tags/REL_5_2_5
Dominik Stadler 7 months ago
parent
commit
5cd4fa5488

+ 6
- 5
poi-scratchpad/src/test/java/org/apache/poi/hssf/converter/TestExcelConverterSuite.java View File

import org.junit.jupiter.params.provider.Arguments; import org.junit.jupiter.params.provider.Arguments;
import org.junit.jupiter.params.provider.MethodSource; import org.junit.jupiter.params.provider.MethodSource;


public class TestExcelConverterSuite
{
public class TestExcelConverterSuite {
/** /**
* YK: a quick hack to exclude failing documents from the suite. * YK: a quick hack to exclude failing documents from the suite.
*/ */
@SuppressWarnings("ArraysAsListWithZeroOrOneArgument")
private static final List<String> failingFiles = Arrays.asList( private static final List<String> failingFiles = Arrays.asList(
/* not failing, but requires more memory */
"ex45698-22488.xls" );
// not failing, but requires more memory
"ex45698-22488.xls",
// broken documents
"clusterfuzz-testcase-minimized-POIHSSFFuzzer-5436547081830400.xls"
);


public static Stream<Arguments> files() { public static Stream<Arguments> files() {
List<Arguments> files = new ArrayList<>(); List<Arguments> files = new ArrayList<>();

+ 5
- 1
poi/src/main/java/org/apache/poi/hssf/model/InternalWorkbook.java View File

"There are only " + numfonts + " font records, but you asked for index " + idx); "There are only " + numfonts + " font records, but you asked for index " + idx);
} }


return ( FontRecord ) records.get((records.getFontpos() - (numfonts - 1)) + index);
Record record = records.get((records.getFontpos() - (numfonts - 1)) + index);
if (!(record instanceof FontRecord)) {
throw new IllegalStateException("Did not have the expected record-type FontRecord: " + record.getClass());
}
return ( FontRecord ) record;
} }


/** /**

+ 5
- 1
poi/src/main/java/org/apache/poi/hssf/usermodel/HSSFShapeFactory.java View File

public static void createShapeTree(EscherContainerRecord container, EscherAggregate agg, HSSFShapeContainer out, DirectoryNode root) { public static void createShapeTree(EscherContainerRecord container, EscherAggregate agg, HSSFShapeContainer out, DirectoryNode root) {
if (container.getRecordId() == EscherContainerRecord.SPGR_CONTAINER) { if (container.getRecordId() == EscherContainerRecord.SPGR_CONTAINER) {
ObjRecord obj = null; ObjRecord obj = null;
EscherClientDataRecord clientData = ((EscherContainerRecord) container.getChild(0)).getChildById(EscherClientDataRecord.RECORD_ID);
EscherRecord child = container.getChild(0);
if (!(child instanceof EscherContainerRecord)) {
throw new IllegalArgumentException("Had unexpected type of child: " + child.getClass());
}
EscherClientDataRecord clientData = ((EscherContainerRecord) child).getChildById(EscherClientDataRecord.RECORD_ID);
if (null != clientData) { if (null != clientData) {
obj = (ObjRecord) agg.getShapeToObjMapping().get(clientData); obj = (ObjRecord) agg.getShapeToObjMapping().get(clientData);
} }

+ 1
- 1
poi/src/main/java/org/apache/poi/util/LittleEndianByteArrayInputStream.java View File



public void setReadIndex(int pos) { public void setReadIndex(int pos) {
if (pos < 0 || pos >= count) { if (pos < 0 || pos >= count) {
throw new IndexOutOfBoundsException();
throw new IndexOutOfBoundsException("Invalid position: " + pos + " with count " + count);
} }
this.pos = pos; this.pos = pos;
} }

+ 1
- 0
poi/src/test/java/org/apache/poi/hssf/dev/TestBiffDrawingToXml.java View File

excludes.put("44958_1.xls", RecordInputStream.LeftoverDataException.class); excludes.put("44958_1.xls", RecordInputStream.LeftoverDataException.class);
excludes.put("protected_66115.xls", EncryptedDocumentException.class); excludes.put("protected_66115.xls", EncryptedDocumentException.class);
excludes.put("clusterfuzz-testcase-minimized-POIHSSFFuzzer-5285517825277952.xls", IllegalArgumentException.class); excludes.put("clusterfuzz-testcase-minimized-POIHSSFFuzzer-5285517825277952.xls", IllegalArgumentException.class);
excludes.put("clusterfuzz-testcase-minimized-POIHSSFFuzzer-5436547081830400.xls", IllegalArgumentException.class);
return excludes; return excludes;
} }



+ 9
- 1
poi/src/test/java/org/apache/poi/hssf/model/TestDrawingAggregate.java View File

import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNotNull; import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertSame; import static org.junit.jupiter.api.Assertions.assertSame;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue; import static org.junit.jupiter.api.Assertions.assertTrue;


import java.io.ByteArrayInputStream; import java.io.ByteArrayInputStream;
DrawingAggregateInfo info = DrawingAggregateInfo.get(sheet); DrawingAggregateInfo info = DrawingAggregateInfo.get(sheet);
if(info != null) { if(info != null) {
aggs.put(i, info); aggs.put(i, info);
if (file.getName().equals("clusterfuzz-testcase-minimized-POIHSSFFuzzer-5436547081830400.xls")) {
assertThrows(IllegalArgumentException.class,
sheet::getDrawingPatriarch);
return;
}

HSSFPatriarch p = sheet.getDrawingPatriarch(); HSSFPatriarch p = sheet.getDrawingPatriarch();


// compare aggregate.serialize() with raw bytes from the record stream // compare aggregate.serialize() with raw bytes from the record stream
byte[] dgBytes2 = agg.serialize(); byte[] dgBytes2 = agg.serialize();


assertEquals(dgBytes1.length, dgBytes2.length, "different size of raw data ande aggregate.serialize()"); assertEquals(dgBytes1.length, dgBytes2.length, "different size of raw data ande aggregate.serialize()");
assertArrayEquals(dgBytes1, dgBytes2, "raw drawing data (" + dgBytes1.length + " bytes) and aggregate.serialize() are different.");
assertArrayEquals(dgBytes1, dgBytes2,
"raw drawing data (" + dgBytes1.length + " bytes) and aggregate.serialize() are different.");
} }
} }



BIN
test-data/spreadsheet/clusterfuzz-testcase-minimized-POIHSSFFuzzer-5436547081830400.xls View File


BIN
test-data/spreadsheet/stress.xls View File


Loading…
Cancel
Save