Browse Source

Bug 66425: Avoid a ClassCastException found via oss-fuzz

We try to avoid throwing ClassCastException, but it was possible
to trigger one here with a specially crafted input-file

Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61400

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1911618 13f79535-47bb-0310-9956-ffa450edef68
tags/REL_5_2_4
Dominik Stadler 8 months ago
parent
commit
9ae14ef6f0

+ 21
- 16
poi-scratchpad/src/main/java/org/apache/poi/hsmf/datatypes/RecipientChunks.java View File

@@ -187,7 +187,7 @@ public final class RecipientChunks implements ChunkGroupWithProperties {
}

/** Holds all the chunks that were found. */
private List<Chunk> allChunks = new ArrayList<>();
private final List<Chunk> allChunks = new ArrayList<>();

@Override
public Map<MAPIProperty, List<PropertyValue>> getProperties() {
@@ -212,21 +212,26 @@ public final class RecipientChunks implements ChunkGroupWithProperties {
*/
@Override
public void record(Chunk chunk) {
if (chunk.getChunkId() == RECIPIENT_SEARCH.id) {
// TODO - parse
recipientSearchChunk = (ByteChunk) chunk;
} else if (chunk.getChunkId() == RECIPIENT_NAME.id) {
recipientDisplayNameChunk = (StringChunk) chunk;
} else if (chunk.getChunkId() == RECIPIENT_DISPLAY_NAME.id) {
recipientNameChunk = (StringChunk) chunk;
} else if (chunk.getChunkId() == RECIPIENT_EMAIL_ADDRESS.id) {
recipientEmailChunk = (StringChunk) chunk;
} else if (chunk.getChunkId() == RECIPIENT_SMTP_ADDRESS.id) {
recipientSMTPChunk = (StringChunk) chunk;
} else if (chunk.getChunkId() == DELIVERY_TYPE.id) {
deliveryTypeChunk = (StringChunk) chunk;
} else if (chunk instanceof PropertiesChunk) {
recipientProperties = (PropertiesChunk) chunk;
try {
if (chunk.getChunkId() == RECIPIENT_SEARCH.id) {
// TODO - parse
recipientSearchChunk = (ByteChunk) chunk;
} else if (chunk.getChunkId() == RECIPIENT_NAME.id) {
recipientDisplayNameChunk = (StringChunk) chunk;
} else if (chunk.getChunkId() == RECIPIENT_DISPLAY_NAME.id) {
recipientNameChunk = (StringChunk) chunk;
} else if (chunk.getChunkId() == RECIPIENT_EMAIL_ADDRESS.id) {
recipientEmailChunk = (StringChunk) chunk;
} else if (chunk.getChunkId() == RECIPIENT_SMTP_ADDRESS.id) {
recipientSMTPChunk = (StringChunk) chunk;
} else if (chunk.getChunkId() == DELIVERY_TYPE.id) {
deliveryTypeChunk = (StringChunk) chunk;
} else if (chunk instanceof PropertiesChunk) {
recipientProperties = (PropertiesChunk) chunk;
}
} catch (ClassCastException e) {
throw new IllegalArgumentException("ChunkId and type of chunk did not match, had id " +
chunk.getChunkId() + " and type of chunk: " + chunk.getClass(), e);
}

// And add to the main list

BIN
test-data/hsmf/clusterfuzz-testcase-minimized-POIHSMFFuzzer-5336473854148608.msg View File


BIN
test-data/spreadsheet/stress.xls View File


Loading…
Cancel
Save