You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@poi.apache.org by ce...@apache.org on 2026/10/22 11:22:29 UTC
(poi) 02/02: Fuzzing: Expect ArithmeticException and NPE in commons-compress in more places
This is an automated email from the ASF dual-hosted git repository.
centic9 pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
commit 5d14e09d7d074ea0e0a633c59414dc6314fc19c1
Author: Dominik Stadler <do...@gmx.at>
AuthorDate: Thu Oct 22 13:06:46 2026 +0200
Fuzzing: Expect ArithmeticException and NPE in commons-compress in more places
Also fixes https://issues.oss-fuzz.com/issues/520018227
---
poi-fuzz/src/main/java/org/apache/poi/fuzz/POIFuzzer.java | 10 ++++++++--
poi-fuzz/src/main/java/org/apache/poi/fuzz/POIHSLFFuzzer.java | 3 ++-
2 files changed, 10 insertions(+), 3 deletions(-)
diff --git a/poi-fuzz/src/main/java/org/apache/poi/fuzz/POIFuzzer.java b/poi-fuzz/src/main/java/org/apache/poi/fuzz/POIFuzzer.java
index 6bb3773a4e..3318458eff 100644
--- a/poi-fuzz/src/main/java/org/apache/poi/fuzz/POIFuzzer.java
+++ b/poi-fuzz/src/main/java/org/apache/poi/fuzz/POIFuzzer.java
@@ -23,6 +23,7 @@ import java.nio.BufferUnderflowException;
import java.util.NoSuchElementException;
import org.apache.commons.io.output.NullOutputStream;
+import org.apache.commons.lang3.exception.ExceptionUtils;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.core.config.AbstractConfiguration;
import org.apache.poi.ddf.EscherRecord;
@@ -113,6 +114,11 @@ public class POIFuzzer {
UnsupportedOperationException | NoSuchElementException | NegativeArraySizeException |
ArithmeticException e) {
// expected here
+ } catch (NullPointerException e) {
+ // can be removed when commons-compress is > 1.28.0 and changes from COMPRESS-598 are applied
+ if (!ExceptionUtils.getStackTrace(e).contains("org.apache.commons.compress.archivers.zip.ZipArchiveInputStream.read")) {
+ throw e;
+ }
}
ExtractorFactory.setThreadPrefersEventExtractors(true);
@@ -150,7 +156,7 @@ public class POIFuzzer {
}
if (extractor instanceof POIOLE2TextExtractor ole2Extractor) {
- ole2Extractor.getRoot();
+ ole2Extractor.getRoot();
ole2Extractor.getSummaryInformation();
ole2Extractor.getDocSummaryInformation();
@@ -164,7 +170,7 @@ public class POIFuzzer {
metaData.getText();
}
} else if (extractor instanceof POIXMLTextExtractor xmlExtractor) {
- xmlExtractor.getCoreProperties();
+ xmlExtractor.getCoreProperties();
xmlExtractor.getCustomProperties();
xmlExtractor.getExtendedProperties();
POIXMLPropertiesTextExtractor metaData = xmlExtractor.getMetadataTextExtractor();
diff --git a/poi-fuzz/src/main/java/org/apache/poi/fuzz/POIHSLFFuzzer.java b/poi-fuzz/src/main/java/org/apache/poi/fuzz/POIHSLFFuzzer.java
index a70c36faf9..4cca095fc4 100644
--- a/poi-fuzz/src/main/java/org/apache/poi/fuzz/POIHSLFFuzzer.java
+++ b/poi-fuzz/src/main/java/org/apache/poi/fuzz/POIHSLFFuzzer.java
@@ -66,7 +66,8 @@ public class POIHSLFFuzzer {
}
} catch (IOException | IllegalArgumentException | RecordFormatException |
IllegalStateException | HSLFException | IndexOutOfBoundsException |
- BufferUnderflowException | POIXMLException | NoSuchElementException e) {
+ BufferUnderflowException | POIXMLException | NoSuchElementException |
+ ArithmeticException e) {
// expected here
}
}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org