aboutsummaryrefslogtreecommitdiffstats
path: root/poi-scratchpad/src
diff options
context:
space:
mode:
authorDominik Stadler <centic@apache.org>2023-08-09 07:23:04 +0000
committerDominik Stadler <centic@apache.org>2023-08-09 07:23:04 +0000
commitfdeae16b0c617400d53266e36fc6123e59bbaed0 (patch)
tree5e9460353ba067edb7165b1c075fa5022c718907 /poi-scratchpad/src
parente25c467209a17891bcf1c8bb9a706c1c67d79544 (diff)
downloadpoi-fdeae16b0c617400d53266e36fc6123e59bbaed0.tar.gz
poi-fdeae16b0c617400d53266e36fc6123e59bbaed0.zip
Bug 66425: Avoid a ClassCastException found via oss-fuzz
We try to avoid throwing ClassCastException, but it was possible to trigger one here with a specially crafted input-file Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61317 git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1911565 13f79535-47bb-0310-9956-ffa450edef68
Diffstat (limited to 'poi-scratchpad/src')
-rw-r--r--poi-scratchpad/src/main/java/org/apache/poi/hwpf/HWPFDocumentCore.java7
-rw-r--r--poi-scratchpad/src/test/java/org/apache/poi/hwpf/converter/TestWordToConverterSuite.java3
-rw-r--r--poi-scratchpad/src/test/java/org/apache/poi/hwpf/converter/TestWordToTextConverter.java3
3 files changed, 9 insertions, 4 deletions
diff --git a/poi-scratchpad/src/main/java/org/apache/poi/hwpf/HWPFDocumentCore.java b/poi-scratchpad/src/main/java/org/apache/poi/hwpf/HWPFDocumentCore.java
index 325abc6df8..22bf28eab7 100644
--- a/poi-scratchpad/src/main/java/org/apache/poi/hwpf/HWPFDocumentCore.java
+++ b/poi-scratchpad/src/main/java/org/apache/poi/hwpf/HWPFDocumentCore.java
@@ -54,7 +54,6 @@ import org.apache.poi.util.IOUtils;
import org.apache.poi.util.Internal;
import org.apache.poi.util.LittleEndianByteArrayInputStream;
-
/**
* This class holds much of the core of a Word document, but
* without some of the table structure information.
@@ -187,7 +186,11 @@ public abstract class HWPFDocumentCore extends POIDocument {
DirectoryEntry objectPoolEntry = null;
if (directory.hasEntry(STREAM_OBJECT_POOL)) {
- objectPoolEntry = (DirectoryEntry) directory.getEntry(STREAM_OBJECT_POOL);
+ final Entry entry = directory.getEntry(STREAM_OBJECT_POOL);
+ if (!(entry instanceof DirectoryEntry)) {
+ throw new IllegalArgumentException("Had unexpected type of entry for name: " + STREAM_OBJECT_POOL + ": " + entry.getClass());
+ }
+ objectPoolEntry = (DirectoryEntry) entry;
}
_objectPool = new ObjectPoolImpl(objectPoolEntry);
}
diff --git a/poi-scratchpad/src/test/java/org/apache/poi/hwpf/converter/TestWordToConverterSuite.java b/poi-scratchpad/src/test/java/org/apache/poi/hwpf/converter/TestWordToConverterSuite.java
index cafc6c3dfa..71f4327133 100644
--- a/poi-scratchpad/src/test/java/org/apache/poi/hwpf/converter/TestWordToConverterSuite.java
+++ b/poi-scratchpad/src/test/java/org/apache/poi/hwpf/converter/TestWordToConverterSuite.java
@@ -59,7 +59,8 @@ public class TestWordToConverterSuite
"Fuzzed.doc",
"clusterfuzz-testcase-minimized-POIHWPFFuzzer-5418937293340672.doc",
"TestHPSFWritingFunctionality.doc",
- "clusterfuzz-testcase-minimized-POIHWPFFuzzer-4947285593948160.doc"
+ "clusterfuzz-testcase-minimized-POIHWPFFuzzer-4947285593948160.doc",
+ "clusterfuzz-testcase-minimized-POIHWPFFuzzer-5440721166139392.doc"
);
public static Stream<Arguments> files() {
diff --git a/poi-scratchpad/src/test/java/org/apache/poi/hwpf/converter/TestWordToTextConverter.java b/poi-scratchpad/src/test/java/org/apache/poi/hwpf/converter/TestWordToTextConverter.java
index 4bb810735f..30e46e5d9f 100644
--- a/poi-scratchpad/src/test/java/org/apache/poi/hwpf/converter/TestWordToTextConverter.java
+++ b/poi-scratchpad/src/test/java/org/apache/poi/hwpf/converter/TestWordToTextConverter.java
@@ -51,7 +51,8 @@ public class TestWordToTextConverter {
// Corrupt files
"clusterfuzz-testcase-minimized-POIHWPFFuzzer-5418937293340672.doc",
"TestHPSFWritingFunctionality.doc",
- "clusterfuzz-testcase-minimized-POIHWPFFuzzer-4947285593948160.doc"
+ "clusterfuzz-testcase-minimized-POIHWPFFuzzer-4947285593948160.doc",
+ "clusterfuzz-testcase-minimized-POIHWPFFuzzer-5440721166139392.doc"
);
/**