From 9fda604fb83a781ae581db06133583ae50394f3c Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Wed, 6 Dec 2023 19:49:34 +0000 Subject: Bug 66425: Avoid exceptions found via poi-fuzz Capture and report integer overflow as normal parsing/format exceptions Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=63628 git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1914401 13f79535-47bb-0310-9956-ffa450edef68 --- .../poi/examples/xssf/eventusermodel/XLSX2CSV.java | 9 +++++++-- .../extractor/XSSFEventBasedExcelExtractor.java | 2 +- .../org/apache/poi/xssf/usermodel/XSSFSheet.java | 2 +- ...se-minimized-POIXSSFFuzzer-5937385319563264.xlsx | Bin 0 -> 54387 bytes test-data/spreadsheet/stress.xls | Bin 60416 -> 60928 bytes 5 files changed, 9 insertions(+), 4 deletions(-) create mode 100644 test-data/spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5937385319563264.xlsx diff --git a/poi-examples/src/main/java/org/apache/poi/examples/xssf/eventusermodel/XLSX2CSV.java b/poi-examples/src/main/java/org/apache/poi/examples/xssf/eventusermodel/XLSX2CSV.java index fdbcc89901..d9fffabe48 100644 --- a/poi-examples/src/main/java/org/apache/poi/examples/xssf/eventusermodel/XLSX2CSV.java +++ b/poi-examples/src/main/java/org/apache/poi/examples/xssf/eventusermodel/XLSX2CSV.java @@ -212,7 +212,7 @@ public class XLSX2CSV { styles, null, strings, sheetHandler, formatter, false); sheetParser.setContentHandler(handler); sheetParser.parse(sheetSource); - } catch(ParserConfigurationException e) { + } catch (ParserConfigurationException e) { throw new RuntimeException("SAX parser appears to be broken - " + e.getMessage()); } } @@ -234,7 +234,12 @@ public class XLSX2CSV { String sheetName = iter.getSheetName(); this.output.println(); this.output.println(sheetName + " [index=" + index + "]:"); - processSheet(styles, strings, new SheetToCSV(), stream); + + try { + processSheet(styles, strings, new SheetToCSV(), stream); + } catch (NumberFormatException e) { + throw new IOException("Failed to parse sheet " + sheetName, e); + } } ++index; } diff --git a/poi-ooxml/src/main/java/org/apache/poi/xssf/extractor/XSSFEventBasedExcelExtractor.java b/poi-ooxml/src/main/java/org/apache/poi/xssf/extractor/XSSFEventBasedExcelExtractor.java index fd008f3a3d..c79024e3b4 100644 --- a/poi-ooxml/src/main/java/org/apache/poi/xssf/extractor/XSSFEventBasedExcelExtractor.java +++ b/poi-ooxml/src/main/java/org/apache/poi/xssf/extractor/XSSFEventBasedExcelExtractor.java @@ -289,7 +289,7 @@ public class XSSFEventBasedExcelExtractor } return text.toString(); - } catch (IOException | OpenXML4JException | SAXException e) { + } catch (IOException | OpenXML4JException | SAXException | NumberFormatException e) { LOGGER.atWarn().withThrowable(e).log("Failed to load text"); return ""; } diff --git a/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFSheet.java b/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFSheet.java index 9fe2ea71f0..f931b2d58d 100644 --- a/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFSheet.java +++ b/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFSheet.java @@ -146,7 +146,7 @@ public class XSSFSheet extends POIXMLDocumentPart implements Sheet, OoxmlSheetEx protected void onDocumentRead() { try (InputStream stream = getPackagePart().getInputStream()) { read(stream); - } catch (IOException e){ + } catch (IOException | ArithmeticException e){ throw new POIXMLException(e); } } diff --git a/test-data/spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5937385319563264.xlsx b/test-data/spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5937385319563264.xlsx new file mode 100644 index 0000000000..16515d7052 Binary files /dev/null and b/test-data/spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5937385319563264.xlsx differ diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls index 9ad1991a26..9a4e488e7b 100644 Binary files a/test-data/spreadsheet/stress.xls and b/test-data/spreadsheet/stress.xls differ -- cgit v1.2.3