You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@poi.apache.org by ce...@apache.org on 2026/02/14 20:28:12 UTC
(poi) branch trunk updated (8d53613bcf -> bc02ef0703)
This is an automated email from the ASF dual-hosted git repository.
centic pushed a change to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
from 8d53613bcf Bug 69935: Add short-based column setters to ClientAnchor (#1006)
new c92c533d7a Prevent large allocations when writing PPDrawing items
new 5338b17a8f Avoid NPE with malformed Visio diagram
new 55c1608a2d Avoid NPE with malformed anchors in slideshow files
new e96c9e17c0 Avoid NPE with malformed EscherAggregate
new 692caf0f36 Avoid NPE with malformed master-style
new bc02ef0703 Avoid NPE with malformed wmf headers
The 6 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../xdgf/usermodel/section/geometry/RelLineTo.java | 4 ++++
.../java/org/apache/poi/hslf/record/PPDrawing.java | 7 +++++--
.../apache/poi/hslf/usermodel/HSLFGroupShape.java | 18 +++++++++++-------
.../apache/poi/hslf/usermodel/HSLFSlideMaster.java | 4 ++++
.../java/org/apache/poi/hwmf/record/HwmfMisc.java | 14 ++++++++++++--
.../apache/poi/hslf/dev/TestSlideIdListing.java | 1 +
.../poi/hslf/dev/TestSlideShowRecordDumper.java | 4 +++-
.../hslf/dev/TestUserEditAndPersistListing.java | 4 +++-
.../apache/poi/hssf/record/EscherAggregate.java | 3 +++
.../org/apache/poi/hssf/dev/TestBiffViewer.java | 1 +
.../org/apache/poi/hssf/dev/TestRecordLister.java | 1 +
.../poi/hssf/model/TestDrawingAggregate.java | 3 ++-
...minimized-POIVisioFuzzer-6312416206454784.vsdx} | Bin 35605 -> 33849 bytes
...> 62d2ecd89aeb715b07072d4f8a8734f4dbeb5c10.ppt} | Bin 224256 -> 224256 bytes
...> cf5f6fde99a8b3ea5a4946c258b7abad6f30b0c5.ppt} | Bin 9728 -> 9684 bytes
...terfuzz-testcase-minimized-6701721724125184.wmf | Bin 0 -> 87 bytes
...e-minimized-POIHSLFFuzzer-6028723156746240.ppt} | Bin 547840 -> 547740 bytes
...> cf9f845e73447b092477d0472402a5baea4b8c9f.xls} | Bin 47616 -> 47616 bytes
test-data/spreadsheet/stress.xls | Bin 77824 -> 79872 bytes
19 files changed, 50 insertions(+), 14 deletions(-)
copy test-data/diagram/{clusterfuzz-testcase-minimized-POIVisioFuzzer-5842659694215168.vsdx => clusterfuzz-testcase-minimized-POIVisioFuzzer-6312416206454784.vsdx} (82%)
copy test-data/slideshow/{bug58733_671884.ppt => 62d2ecd89aeb715b07072d4f8a8734f4dbeb5c10.ppt} (99%)
copy test-data/slideshow/{Single_Coloured_Page.ppt => cf5f6fde99a8b3ea5a4946c258b7abad6f30b0c5.ppt} (95%)
create mode 100644 test-data/slideshow/clusterfuzz-testcase-minimized-6701721724125184.wmf
copy test-data/slideshow/{bug58718_008558.ppt => clusterfuzz-testcase-minimized-POIHSLFFuzzer-6028723156746240.ppt} (89%)
copy test-data/spreadsheet/{45129.xls => cf9f845e73447b092477d0472402a5baea4b8c9f.xls} (89%)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org
(poi) 03/06: Avoid NPE with malformed anchors in slideshow files
Posted by ce...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
centic pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
commit 55c1608a2d0e236c270bf8f833f4719f6996dc7e
Author: Dominik Stadler <do...@gmx.at>
AuthorDate: Sat Feb 14 17:15:14 2026 +0100
Avoid NPE with malformed anchors in slideshow files
---
.../apache/poi/hslf/usermodel/HSLFGroupShape.java | 18 +++++++++++-------
.../62d2ecd89aeb715b07072d4f8a8734f4dbeb5c10.ppt | Bin 0 -> 224256 bytes
test-data/spreadsheet/stress.xls | Bin 78848 -> 78848 bytes
3 files changed, 11 insertions(+), 7 deletions(-)
diff --git a/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFGroupShape.java b/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFGroupShape.java
index 1754e67d2b..66edf97706 100644
--- a/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFGroupShape.java
+++ b/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFGroupShape.java
@@ -78,7 +78,7 @@ implements HSLFShapeContainer, GroupShape<HSLFShape,HSLFTextParagraph> {
public void setAnchor(Rectangle2D anchor) {
EscherClientAnchorRecord clientAnchor = getEscherChild(EscherClientAnchorRecord.RECORD_ID);
boolean isInitialized = !(clientAnchor.getDx1() == 0 && clientAnchor.getRow1() == 0);
-
+
if (isInitialized) {
moveAndScale(anchor);
} else {
@@ -113,7 +113,7 @@ implements HSLFShapeContainer, GroupShape<HSLFShape,HSLFTextParagraph> {
protected void setExteriorAnchor(Rectangle2D anchor) {
EscherClientAnchorRecord clientAnchor = getEscherChild(EscherClientAnchorRecord.RECORD_ID);
-
+
//hack. internal variable EscherClientAnchorRecord.shortRecord can be
//initialized only in fillFields(). We need to set shortRecord=false;
byte[] header = new byte[16];
@@ -131,7 +131,7 @@ implements HSLFShapeContainer, GroupShape<HSLFShape,HSLFTextParagraph> {
// TODO: does this make sense?
setInteriorAnchor(anchor);
}
-
+
/**
* Create a new ShapeGroup and create an instance of <code>EscherSpgrContainer</code> which represents a group of shapes
*/
@@ -186,7 +186,7 @@ implements HSLFShapeContainer, GroupShape<HSLFShape,HSLFTextParagraph> {
double scaleY = (anchorSrc.getHeight() == 0) ? 0 : anchorDest.getHeight() / anchorSrc.getHeight();
setExteriorAnchor(anchorDest);
-
+
for (HSLFShape shape : getShapes()) {
Rectangle2D chanchor = shape.getAnchor();
double x = anchorDest.getX()+(chanchor.getX()-anchorSrc.getX())*scaleX;
@@ -204,12 +204,16 @@ implements HSLFShapeContainer, GroupShape<HSLFShape,HSLFTextParagraph> {
* @return the anchor of this shape group
*/
@Override
- public Rectangle2D getAnchor(){
+ public Rectangle2D getAnchor() {
EscherClientAnchorRecord clientAnchor = getEscherChild(EscherClientAnchorRecord.RECORD_ID);
int x1,y1,x2,y2;
- if(clientAnchor == null){
+ if(clientAnchor == null) {
LOG.atInfo().log("EscherClientAnchorRecord was not found for shape group. Searching for EscherChildAnchorRecord.");
EscherChildAnchorRecord rec = getEscherChild(EscherChildAnchorRecord.RECORD_ID);
+ if (rec == null) {
+ throw new IllegalStateException("Cannot get anchor, neither had an EscherClientAnchorRecord nor an EscherChildAnchorRecord");
+ }
+
x1 = rec.getDx1();
y1 = rec.getDy1();
x2 = rec.getDx2();
@@ -293,7 +297,7 @@ implements HSLFShapeContainer, GroupShape<HSLFShape,HSLFTextParagraph> {
isFirst = false;
continue;
}
-
+
if(r instanceof EscherContainerRecord) {
// Create the Shape for it
EscherContainerRecord container = (EscherContainerRecord)r;
diff --git a/test-data/slideshow/62d2ecd89aeb715b07072d4f8a8734f4dbeb5c10.ppt b/test-data/slideshow/62d2ecd89aeb715b07072d4f8a8734f4dbeb5c10.ppt
new file mode 100644
index 0000000000..05256ad4a5
Binary files /dev/null and b/test-data/slideshow/62d2ecd89aeb715b07072d4f8a8734f4dbeb5c10.ppt differ
diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls
index 9b4388c582..a6db95bc78 100644
Binary files a/test-data/spreadsheet/stress.xls and b/test-data/spreadsheet/stress.xls differ
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org
(poi) 01/06: Prevent large allocations when writing PPDrawing items
Posted by ce...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
centic pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
commit c92c533d7a5e08cdbe2bcc9f09ecfaca7fd60bea
Author: Dominik Stadler <do...@gmx.at>
AuthorDate: Sat Feb 14 17:16:26 2026 +0100
Prevent large allocations when writing PPDrawing items
Add an allocation check which can be disabled if necessary.
Fixes https://issues.oss-fuzz.com/issues/477289649 and https://issues.oss-fuzz.com/issues/479564936
---
.../java/org/apache/poi/hslf/record/PPDrawing.java | 7 +++++--
.../org/apache/poi/hslf/dev/TestSlideIdListing.java | 1 +
.../poi/hslf/dev/TestSlideShowRecordDumper.java | 4 +++-
.../poi/hslf/dev/TestUserEditAndPersistListing.java | 4 +++-
...ase-minimized-POIHSLFFuzzer-6028723156746240.ppt | Bin 0 -> 547740 bytes
test-data/spreadsheet/stress.xls | Bin 77824 -> 78336 bytes
6 files changed, 12 insertions(+), 4 deletions(-)
diff --git a/poi-scratchpad/src/main/java/org/apache/poi/hslf/record/PPDrawing.java b/poi-scratchpad/src/main/java/org/apache/poi/hslf/record/PPDrawing.java
index 267034076a..886468362e 100644
--- a/poi-scratchpad/src/main/java/org/apache/poi/hslf/record/PPDrawing.java
+++ b/poi-scratchpad/src/main/java/org/apache/poi/hslf/record/PPDrawing.java
@@ -47,6 +47,7 @@ import org.apache.poi.ddf.EscherSpgrRecord;
import org.apache.poi.ddf.EscherTextboxRecord;
import org.apache.poi.sl.usermodel.ShapeType;
import org.apache.poi.util.GenericRecordUtil;
+import org.apache.poi.util.IOUtils;
import org.apache.poi.util.LittleEndian;
/**
@@ -65,6 +66,7 @@ import org.apache.poi.util.LittleEndian;
// would require a wrapping class
public final class PPDrawing extends RecordAtom implements Iterable<EscherRecord> {
+ public static final int MAX_RECORD_SIZE = 20_000_000;
private final byte[] _header;
private long _type;
@@ -214,8 +216,9 @@ public final class PPDrawing extends RecordAtom implements Iterable<EscherRecord
// Write out our header
out.write(_header);
- // Now grab the children's data
- byte[] b = new byte[newSize];
+ // Now grab the children's data, but fail if it tries to allocate
+ // too much
+ byte[] b = IOUtils.safelyAllocate(newSize, MAX_RECORD_SIZE);
int done = 0;
dgContainer.serialize(done, b);
diff --git a/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/TestSlideIdListing.java b/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/TestSlideIdListing.java
index f86247c86b..684f4e8e42 100644
--- a/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/TestSlideIdListing.java
+++ b/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/TestSlideIdListing.java
@@ -32,6 +32,7 @@ public class TestSlideIdListing extends BaseTestPPTIterating {
static {
LOCAL_EXCLUDED.add("clusterfuzz-testcase-minimized-POIHSLFFuzzer-5306877435838464.ppt");
LOCAL_EXCLUDED.add("clusterfuzz-testcase-minimized-POIHSLFFuzzer-6360479850954752.ppt");
+ LOCAL_EXCLUDED.add("clusterfuzz-testcase-minimized-POIHSLFFuzzer-6028723156746240.ppt");
}
@Test
diff --git a/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/TestSlideShowRecordDumper.java b/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/TestSlideShowRecordDumper.java
index 73bbd376fd..f5705fe981 100644
--- a/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/TestSlideShowRecordDumper.java
+++ b/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/TestSlideShowRecordDumper.java
@@ -25,12 +25,14 @@ import java.util.Set;
import org.apache.poi.EmptyFileException;
import org.apache.poi.hslf.HSLFTestDataSamples;
+import org.apache.poi.util.RecordFormatException;
import org.junit.jupiter.api.Test;
public class TestSlideShowRecordDumper extends BaseTestPPTIterating {
static final Set<String> LOCAL_EXCLUDED = new HashSet<>();
static {
LOCAL_EXCLUDED.add("clusterfuzz-testcase-minimized-POIHSLFFuzzer-6360479850954752.ppt");
+ LOCAL_EXCLUDED.add("clusterfuzz-testcase-minimized-POIHSLFFuzzer-6028723156746240.ppt");
}
@Test
@@ -58,7 +60,7 @@ public class TestSlideShowRecordDumper extends BaseTestPPTIterating {
void runOneFile(File pFile) throws Exception {
try {
SlideShowRecordDumper.main(new String[]{pFile.getAbsolutePath()});
- } catch (IllegalStateException e) {
+ } catch (IllegalStateException | RecordFormatException e) {
if (!LOCAL_EXCLUDED.contains(pFile.getName())) {
throw e;
}
diff --git a/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/TestUserEditAndPersistListing.java b/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/TestUserEditAndPersistListing.java
index fab8679776..e639e292b0 100644
--- a/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/TestUserEditAndPersistListing.java
+++ b/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/TestUserEditAndPersistListing.java
@@ -24,12 +24,14 @@ import java.util.HashSet;
import java.util.Set;
import org.apache.poi.EmptyFileException;
+import org.apache.poi.util.RecordFormatException;
import org.junit.jupiter.api.Test;
public class TestUserEditAndPersistListing extends BaseTestPPTIterating {
static final Set<String> LOCAL_EXCLUDED = new HashSet<>();
static {
LOCAL_EXCLUDED.add("clusterfuzz-testcase-minimized-POIHSLFFuzzer-6360479850954752.ppt");
+ LOCAL_EXCLUDED.add("clusterfuzz-testcase-minimized-POIHSLFFuzzer-6028723156746240.ppt");
}
@Test
@@ -42,7 +44,7 @@ public class TestUserEditAndPersistListing extends BaseTestPPTIterating {
void runOneFile(File pFile) throws Exception {
try {
UserEditAndPersistListing.main(new String[]{pFile.getAbsolutePath()});
- } catch (IllegalStateException e) {
+ } catch (IllegalStateException | RecordFormatException e) {
if (!LOCAL_EXCLUDED.contains(pFile.getName())) {
throw e;
}
diff --git a/test-data/slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6028723156746240.ppt b/test-data/slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6028723156746240.ppt
new file mode 100644
index 0000000000..96793914be
Binary files /dev/null and b/test-data/slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6028723156746240.ppt differ
diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls
index 18508cf972..a4ba77404e 100644
Binary files a/test-data/spreadsheet/stress.xls and b/test-data/spreadsheet/stress.xls differ
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org
(poi) 05/06: Avoid NPE with malformed master-style
Posted by ce...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
centic pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
commit 692caf0f3673b12126bd100a18496562d55d8375
Author: Dominik Stadler <do...@gmx.at>
AuthorDate: Sat Feb 14 18:40:12 2026 +0100
Avoid NPE with malformed master-style
---
.../apache/poi/hslf/usermodel/HSLFSlideMaster.java | 4 ++++
.../cf5f6fde99a8b3ea5a4946c258b7abad6f30b0c5.ppt | Bin 0 -> 9684 bytes
test-data/spreadsheet/stress.xls | Bin 79360 -> 79872 bytes
3 files changed, 4 insertions(+)
diff --git a/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFSlideMaster.java b/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFSlideMaster.java
index 65dcf6dda5..b0929d3bb7 100644
--- a/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFSlideMaster.java
+++ b/poi-scratchpad/src/main/java/org/apache/poi/hslf/usermodel/HSLFSlideMaster.java
@@ -112,6 +112,10 @@ public final class HSLFSlideMaster extends HSLFMasterSheet {
return null;
}
final TxMasterStyleAtom t = _txmaster[txtype];
+ if (t == null) {
+ throw new IllegalStateException("Cannot get master-style for type " + txtype);
+ }
+
final List<TextPropCollection> styles = isCharacter ? t.getCharacterStyles() : t.getParagraphStyles();
// TODO: what is the reaction for readOnly=false and styles.isEmpty()?
final int minLevel = Math.min(level, styles.size()-1);
diff --git a/test-data/slideshow/cf5f6fde99a8b3ea5a4946c258b7abad6f30b0c5.ppt b/test-data/slideshow/cf5f6fde99a8b3ea5a4946c258b7abad6f30b0c5.ppt
new file mode 100644
index 0000000000..a92aac2d04
Binary files /dev/null and b/test-data/slideshow/cf5f6fde99a8b3ea5a4946c258b7abad6f30b0c5.ppt differ
diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls
index feaeaa201d..099e41e45e 100644
Binary files a/test-data/spreadsheet/stress.xls and b/test-data/spreadsheet/stress.xls differ
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org
(poi) 04/06: Avoid NPE with malformed EscherAggregate
Posted by ce...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
centic pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
commit e96c9e17c0a9d0071c65423009a5a8c150b05941
Author: Dominik Stadler <do...@gmx.at>
AuthorDate: Sat Feb 14 18:25:36 2026 +0100
Avoid NPE with malformed EscherAggregate
---
.../org/apache/poi/hssf/record/EscherAggregate.java | 3 +++
.../org/apache/poi/hssf/dev/TestBiffViewer.java | 1 +
.../org/apache/poi/hssf/dev/TestRecordLister.java | 1 +
.../apache/poi/hssf/model/TestDrawingAggregate.java | 3 ++-
.../cf9f845e73447b092477d0472402a5baea4b8c9f.xls | Bin 0 -> 47616 bytes
test-data/spreadsheet/stress.xls | Bin 78848 -> 79360 bytes
6 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/poi/src/main/java/org/apache/poi/hssf/record/EscherAggregate.java b/poi/src/main/java/org/apache/poi/hssf/record/EscherAggregate.java
index 6a0414c31c..fc6d8270b9 100644
--- a/poi/src/main/java/org/apache/poi/hssf/record/EscherAggregate.java
+++ b/poi/src/main/java/org/apache/poi/hssf/record/EscherAggregate.java
@@ -292,6 +292,9 @@ public final class EscherAggregate extends AbstractEscherHolderRecord {
// Write the matching OBJ record
Record obj = shapeToObj.get(shapes.get(i));
+ if (obj == null) {
+ throw new IllegalStateException("Cannot serialize EscherAggregate with missing shape-object");
+ }
pos += obj.serialize(pos, data);
isFirst = false;
diff --git a/poi/src/test/java/org/apache/poi/hssf/dev/TestBiffViewer.java b/poi/src/test/java/org/apache/poi/hssf/dev/TestBiffViewer.java
index 33f28455a8..9d71b5fccd 100644
--- a/poi/src/test/java/org/apache/poi/hssf/dev/TestBiffViewer.java
+++ b/poi/src/test/java/org/apache/poi/hssf/dev/TestBiffViewer.java
@@ -49,6 +49,7 @@ class TestBiffViewer extends BaseTestIteratingXLS {
excludes.put("clusterfuzz-testcase-minimized-POIHSSFFuzzer-6483562584932352.xls", IndexOutOfBoundsException.class);
excludes.put("clusterfuzz-testcase-minimized-POIHSSFFuzzer-5816431116615680.xls", RecordFormatException.class);
excludes.put("clusterfuzz-testcase-minimized-POIHSSFFuzzer-4734163573080064.xls", IndexOutOfBoundsException.class);
+ excludes.put("cf9f845e73447b092477d0472402a5baea4b8c9f.xls", RecordFormatException.class);
return excludes;
}
diff --git a/poi/src/test/java/org/apache/poi/hssf/dev/TestRecordLister.java b/poi/src/test/java/org/apache/poi/hssf/dev/TestRecordLister.java
index eab59c339f..033c201dae 100644
--- a/poi/src/test/java/org/apache/poi/hssf/dev/TestRecordLister.java
+++ b/poi/src/test/java/org/apache/poi/hssf/dev/TestRecordLister.java
@@ -52,6 +52,7 @@ class TestRecordLister extends BaseTestIteratingXLS {
excludes.put("clusterfuzz-testcase-minimized-POIHSSFFuzzer-6483562584932352.xls", RecordFormatException.class);
excludes.put("clusterfuzz-testcase-minimized-POIHSSFFuzzer-5816431116615680.xls", RecordFormatException.class);
excludes.put("clusterfuzz-testcase-minimized-POIHSSFFuzzer-4734163573080064.xls", IndexOutOfBoundsException.class);
+ excludes.put("cf9f845e73447b092477d0472402a5baea4b8c9f.xls", RecordFormatException.class);
return excludes;
}
diff --git a/poi/src/test/java/org/apache/poi/hssf/model/TestDrawingAggregate.java b/poi/src/test/java/org/apache/poi/hssf/model/TestDrawingAggregate.java
index 146c69a568..f326f17b07 100644
--- a/poi/src/test/java/org/apache/poi/hssf/model/TestDrawingAggregate.java
+++ b/poi/src/test/java/org/apache/poi/hssf/model/TestDrawingAggregate.java
@@ -138,7 +138,8 @@ class TestDrawingAggregate {
filter(file ->
!file.getName().equals("clusterfuzz-testcase-minimized-POIHSSFFuzzer-5285517825277952.xls") &&
!file.getName().equals("clusterfuzz-testcase-minimized-POIHSSFFuzzer-4977868385681408.xls") &&
- !file.getName().equals("crash-e329fca9087fe21bca4a80c8bc472a661c98d860.xls")).
+ !file.getName().equals("crash-e329fca9087fe21bca4a80c8bc472a661c98d860.xls") &&
+ !file.getName().equals("cf9f845e73447b092477d0472402a5baea4b8c9f.xls")).
map(Arguments::of);
}
diff --git a/test-data/spreadsheet/cf9f845e73447b092477d0472402a5baea4b8c9f.xls b/test-data/spreadsheet/cf9f845e73447b092477d0472402a5baea4b8c9f.xls
new file mode 100644
index 0000000000..6bbcc15bb7
Binary files /dev/null and b/test-data/spreadsheet/cf9f845e73447b092477d0472402a5baea4b8c9f.xls differ
diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls
index a6db95bc78..feaeaa201d 100644
Binary files a/test-data/spreadsheet/stress.xls and b/test-data/spreadsheet/stress.xls differ
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org
(poi) 02/06: Avoid NPE with malformed Visio diagram
Posted by ce...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
centic pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
commit 5338b17a8f241595aabec7348bca799831b25b66
Author: Dominik Stadler <do...@gmx.at>
AuthorDate: Sat Feb 14 16:53:30 2026 +0100
Avoid NPE with malformed Visio diagram
Fixes https://issues.oss-fuzz.com/issues/477312394
---
.../xdgf/usermodel/section/geometry/RelLineTo.java | 4 ++++
...e-minimized-POIVisioFuzzer-6312416206454784.vsdx | Bin 0 -> 33849 bytes
test-data/spreadsheet/stress.xls | Bin 78336 -> 78848 bytes
3 files changed, 4 insertions(+)
diff --git a/poi-ooxml/src/main/java/org/apache/poi/xdgf/usermodel/section/geometry/RelLineTo.java b/poi-ooxml/src/main/java/org/apache/poi/xdgf/usermodel/section/geometry/RelLineTo.java
index e6a9731b66..2ec8d394a9 100644
--- a/poi-ooxml/src/main/java/org/apache/poi/xdgf/usermodel/section/geometry/RelLineTo.java
+++ b/poi-ooxml/src/main/java/org/apache/poi/xdgf/usermodel/section/geometry/RelLineTo.java
@@ -47,6 +47,10 @@ public class RelLineTo implements GeometryRow {
for (CellType cell : row.getCellArray()) {
String cellName = cell.getN();
+ if (cellName == null) {
+ throw new IllegalStateException("Cannot create a ReLineTo object without a cell-name indicating 'X' or 'Y' direction");
+ }
+
if (cellName.equals("X")) {
x = XDGFCell.parseDoubleValue(cell);
} else if (cellName.equals("Y")) {
diff --git a/test-data/diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-6312416206454784.vsdx b/test-data/diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-6312416206454784.vsdx
new file mode 100644
index 0000000000..e05ab739fa
Binary files /dev/null and b/test-data/diagram/clusterfuzz-testcase-minimized-POIVisioFuzzer-6312416206454784.vsdx differ
diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls
index a4ba77404e..9b4388c582 100644
Binary files a/test-data/spreadsheet/stress.xls and b/test-data/spreadsheet/stress.xls differ
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org
(poi) 06/06: Avoid NPE with malformed wmf headers
Posted by ce...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
centic pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
commit bc02ef070348ff2c94f85776d344c83cdcd80ec7
Author: Dominik Stadler <do...@gmx.at>
AuthorDate: Sat Feb 14 20:04:58 2026 +0100
Avoid NPE with malformed wmf headers
---
.../java/org/apache/poi/hwmf/record/HwmfMisc.java | 14 ++++++++++++--
...sterfuzz-testcase-minimized-6701721724125184.wmf | Bin 0 -> 87 bytes
test-data/spreadsheet/stress.xls | Bin 79872 -> 79872 bytes
3 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/poi-scratchpad/src/main/java/org/apache/poi/hwmf/record/HwmfMisc.java b/poi-scratchpad/src/main/java/org/apache/poi/hwmf/record/HwmfMisc.java
index da669354df..8130f7d7e3 100644
--- a/poi-scratchpad/src/main/java/org/apache/poi/hwmf/record/HwmfMisc.java
+++ b/poi-scratchpad/src/main/java/org/apache/poi/hwmf/record/HwmfMisc.java
@@ -511,8 +511,18 @@ public class HwmfMisc {
@Override
public int init(LittleEndianInputStream leis, long recordSize, int recordFunction) throws IOException {
- style = HwmfBrushStyle.valueOf(leis.readUShort());
- colorUsage = ColorUsage.valueOf(leis.readUShort());
+ int brushStyle = leis.readUShort();
+ style = HwmfBrushStyle.valueOf(brushStyle);
+ if (style == null) {
+ throw new IllegalArgumentException("Could not read brush-style " + brushStyle);
+ }
+
+ int colorUsageEnum = leis.readUShort();
+ colorUsage = ColorUsage.valueOf(colorUsageEnum);
+ if (colorUsage == null) {
+ throw new IllegalArgumentException("Could not read color-usage " + colorUsage);
+ }
+
int size = 2*LittleEndianConsts.SHORT_SIZE;
switch (style) {
case BS_SOLID:
diff --git a/test-data/slideshow/clusterfuzz-testcase-minimized-6701721724125184.wmf b/test-data/slideshow/clusterfuzz-testcase-minimized-6701721724125184.wmf
new file mode 100644
index 0000000000..abda269ddb
Binary files /dev/null and b/test-data/slideshow/clusterfuzz-testcase-minimized-6701721724125184.wmf differ
diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls
index 099e41e45e..cd4be7f1dc 100644
Binary files a/test-data/spreadsheet/stress.xls and b/test-data/spreadsheet/stress.xls differ
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org