Bug 66425: Avoid a ClassCastException found via oss-fuzz

We try to avoid throwing ClassCastException, but it was possible
to trigger one here with a specially crafted input-file

Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62170

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1912252 13f79535-47bb-0310-9956-ffa450edef68

2 files changed, 8 insertions, 4 deletions

diff --git a/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFSheet.java b/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFSheet.java
index 4fc072ef95..128fcbd41e 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFSheet.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFSheet.java
@@ -395,7 +395,11 @@ implements XSLFShapeContainer, Sheet<XSLFShape,XSLFTextParagraph> {
             if(sp.length == 0) {
                 throw new IllegalStateException("CTGroupShape was not found");
             }
-            _spTree = (CTGroupShape)sp[0];
+            XmlObject xmlObject = sp[0];
+            if (!(xmlObject instanceof CTGroupShape)) {
+                throw new IllegalArgumentException("Had unexpected type of entry: " + xmlObject.getClass());
+            }
+            _spTree = (CTGroupShape) xmlObject;
         }
         return _spTree;
     }
diff --git a/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFSlide.java b/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFSlide.java
index c48c8d162f..0b9e6a3212 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFSlide.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFSlide.java
@@ -271,9 +271,9 @@ implements Slide<XSLFShape,XSLFTextParagraph> {
      */
     @Override
     public XSLFBackground getBackground() {
-        CTBackground bg = _slide.getCSld().getBg();
-        if(bg != null) {
-            return new XSLFBackground(bg, this);
+        if(_slide.getCSld() != null &&
+                _slide.getCSld().getBg() != null) {
+            return new XSLFBackground(_slide.getCSld().getBg(), this);
         } else {
             return getMasterSheet().getBackground();
         }