You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@poi.apache.org by ce...@apache.org on 2026/10/22 07:50:27 UTC
(poi) 01/03: Avoid possible NPE in formula parsing
This is an automated email from the ASF dual-hosted git repository.
centic9 pushed a commit to branch add_fuzzing_readme_and_fix_npe
in repository https://gitbox.apache.org/repos/asf/poi.git
commit 0fd4a46690065fa33fa3a548193f9801e8c2edcc
Author: Dominik Stadler <do...@gmx.at>
AuthorDate: Thu Oct 22 09:16:36 2026 +0200
Avoid possible NPE in formula parsing
Detected when running fuzzing locally
---
.../java/org/apache/poi/ss/formula/SheetRangeIdentifier.java | 5 +++++
.../java/org/apache/poi/hssf/model/TestFormulaParser.java | 11 ++++++-----
2 files changed, 11 insertions(+), 5 deletions(-)
diff --git a/poi/src/main/java/org/apache/poi/ss/formula/SheetRangeIdentifier.java b/poi/src/main/java/org/apache/poi/ss/formula/SheetRangeIdentifier.java
index e29022c78c..849a35e83f 100644
--- a/poi/src/main/java/org/apache/poi/ss/formula/SheetRangeIdentifier.java
+++ b/poi/src/main/java/org/apache/poi/ss/formula/SheetRangeIdentifier.java
@@ -32,6 +32,11 @@ public class SheetRangeIdentifier extends SheetIdentifier {
}
protected void asFormulaString(StringBuilder sb) {
super.asFormulaString(sb);
+
+ if (_lastSheetIdentifier == null) {
+ return;
+ }
+
sb.append(':');
if (_lastSheetIdentifier.isQuoted()) {
sb.append('\'').append(_lastSheetIdentifier.getName()).append("'");
diff --git a/poi/src/test/java/org/apache/poi/hssf/model/TestFormulaParser.java b/poi/src/test/java/org/apache/poi/hssf/model/TestFormulaParser.java
index 5a26b0b1b4..49d966dfb2 100644
--- a/poi/src/test/java/org/apache/poi/hssf/model/TestFormulaParser.java
+++ b/poi/src/test/java/org/apache/poi/hssf/model/TestFormulaParser.java
@@ -251,11 +251,9 @@ final class TestFormulaParser {
Ptg[] ptgs = parseFormula(formulaText);
confirmTokenClasses(ptgs, expectedTokenTypes);
Ptg ptg0 = ptgs[0];
- if (ptg0 instanceof IntPtg) {
- IntPtg intPtg = (IntPtg) ptg0;
+ if (ptg0 instanceof IntPtg intPtg) {
assertEquals((int)val, intPtg.getValue());
- } else if (ptg0 instanceof NumberPtg) {
- NumberPtg numberPtg = (NumberPtg) ptg0;
+ } else if (ptg0 instanceof NumberPtg numberPtg) {
assertEquals(val, numberPtg.getValue(), 0.0);
} else {
fail("bad ptg0 " + ptg0);
@@ -727,7 +725,7 @@ final class TestFormulaParser {
*/
private static void confirmStringParse(String singleQuotedValue) {
// formula: internal quotes become double double, surround with double quotes
- String formula = '"' + singleQuotedValue.replaceAll("'", "\"\"") + '"';
+ String formula = '"' + singleQuotedValue.replace("'", "\"\"") + '"';
String expectedValue = singleQuotedValue.replace('\'', '"');
StringPtg sp = (StringPtg) parseSingleToken(formula, StringPtg.class);
@@ -1589,8 +1587,11 @@ final class TestFormulaParser {
@Test
void testNPE() {
+ // fuzzing finds some strange ways of triggering NPEs
assertThrows(FormulaParseException.class,
() -> parseFormula("[\f]!E鈩"));
+ assertThrows(FormulaParseException.class,
+ () -> parseFormula("R1:[]!WQW"));
}
@Test
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org