Bug 66425: Avoid exceptions found via poi-fuzz

Prevent NullPointerException

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64495

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1915005 13f79535-47bb-0310-9956-ffa450edef68

3 files changed, 22 insertions, 2 deletions

diff --git a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFNumbering.java b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFNumbering.java
index b752f98ba1..f3d6cf0f04 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFNumbering.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFNumbering.java
@@ -97,8 +97,10 @@ public class XWPFNumbering extends POIXMLDocumentPart {
         XmlOptions xmlOptions = new XmlOptions(DEFAULT_XML_OPTIONS);
         xmlOptions.setSaveSyntheticDocumentElement(new QName(CTNumbering.type.getName().getNamespaceURI(), "numbering"));
         PackagePart part = getPackagePart();
-        try (OutputStream out = part.getOutputStream()) {
-            ctNumbering.save(out, xmlOptions);
+        if (ctNumbering != null) {
+            try (OutputStream out = part.getOutputStream()) {
+                ctNumbering.save(out, xmlOptions);
+            }
         }
     }
 
diff --git a/poi-ooxml/src/test/java/org/apache/poi/xwpf/usermodel/TestXWPFNumbering.java b/poi-ooxml/src/test/java/org/apache/poi/xwpf/usermodel/TestXWPFNumbering.java
index 09d31dbf13..252ab95b8f 100644
--- a/poi-ooxml/src/test/java/org/apache/poi/xwpf/usermodel/TestXWPFNumbering.java
+++ b/poi-ooxml/src/test/java/org/apache/poi/xwpf/usermodel/TestXWPFNumbering.java
@@ -18,12 +18,16 @@
 package org.apache.poi.xwpf.usermodel;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import java.io.IOException;
+import java.io.OutputStream;
 import java.math.BigInteger;
 
+import org.apache.commons.io.output.NullOutputStream;
 import org.apache.poi.xwpf.XWPFTestDataSamples;
 import org.junit.jupiter.api.Test;
 import org.openxmlformats.schemas.wordprocessingml.x2006.main.CTAbstractNum;
@@ -165,4 +169,18 @@ class TestXWPFNumbering {
             assertEquals(doc.getNumbering().getAbstractNums().size(), count);
         }
     }
+
+    @Test
+    void testNPE() throws IOException {
+        try (XWPFDocument doc = XWPFTestDataSamples.openSampleDocument("clusterfuzz-testcase-minimized-POIXWPFFuzzer-6120975439364096.docx");
+            OutputStream out = NullOutputStream.INSTANCE) {
+
+            // settings and numbering are null for this malformed document
+            assertNull(doc.getNumbering());
+            assertNull(doc.getSettings());
+
+            assertThrows(IllegalStateException.class, () ->
+                doc.write(out), "Fails because settings are not populated in this malformed document");
+        }
+    }
 }
diff --git a/test-data/document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-6120975439364096.docx b/test-data/document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-6120975439364096.docx
new file mode 100644
index 0000000000..33f01afa4d
--- /dev/null
+++ b/test-data/document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-6120975439364096.docx