You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@poi.apache.org by bu...@apache.org on 2021/12/13 09:15:25 UTC
[Bug 65743] New: java.lang.NullPointerException in `org.apache.poi.openxml4j.opc.internal.unmarshallers.PackagePropertiesUnmarshaller.checkElementForOPCCompliance::PackagePropertiesUnmarshaller.java:254` poi 5.1.0
https://bz.apache.org/bugzilla/show_bug.cgi?id=65743
Bug ID: 65743
Summary: java.lang.NullPointerException in
`org.apache.poi.openxml4j.opc.internal.unmarshallers.P
ackagePropertiesUnmarshaller.checkElementForOPCComplia
nce::PackagePropertiesUnmarshaller.java:254` poi 5.1.0
Product: POI
Version: 5.0.x-dev
Hardware: PC
Status: NEW
Severity: normal
Priority: P2
Component: OPC
Assignee: dev@poi.apache.org
Reporter: wenjiezander@gmail.com
Target Milestone: ---
# java.lang.NullPointerException in
`org.apache.poi.openxml4j.opc.internal.unmarshallers.PackagePropertiesUnmarshaller.checkElementForOPCCompliance::PackagePropertiesUnmarshaller.java:254`
poi 5.1.0
This vulnerability is of java.lang.NullPointerException, and can be triggered
in latest version poi (5.1.0).
It is caused by not checking the pointer before dereference it and also failing
to catch the runtime java exception (it should be wrapped as one kind of
JSONException), and can .
Likely, the root cause of this crash is in
`org.apache.poi.openxml4j.opc.internal.unmarshallers.PackagePropertiesUnmarshaller.checkElementForOPCCompliance::PackagePropertiesUnmarshaller.java:254`.
See more detail from the following crash stack.
# Crash stack:
The crash thread's stack is as follows:
```
org.apache.poi.openxml4j.opc.internal.unmarshallers.PackagePropertiesUnmarshaller.checkElementForOPCCompliance::PackagePropertiesUnmarshaller.java:254
org.apache.poi.openxml4j.opc.internal.unmarshallers.PackagePropertiesUnmarshaller.unmarshall::PackagePropertiesUnmarshaller.java:111
org.apache.poi.openxml4j.opc.OPCPackage.getParts::OPCPackage.java:760
org.apache.poi.openxml4j.opc.OPCPackage.open::OPCPackage.java:315
org.apache.poi.ooxml.util.PackageHelper.open::PackageHelper.java:47
org.apache.poi.xssf.usermodel.XSSFWorkbook.<init>::XSSFWorkbook.java:296
com.test.Entry.main::Entry.java:32
```
# Steps to reproduce:
1. Build the following java code with the corresponding poi library (version
5.1.0).
```
## Download poi_env_reproduce.zip from
https://drive.google.com/file/d/1N4gUC0MF-SAN-Xz0van0_7TbNj4aUuFd/view?usp=sharing
unzip poi_env_reproduce.zip
cd poi_env_reproduce
bash build.sh
```
2. Run the built program to see the crash by feeding one of the poc file
contained in the pocs.tar.gz, e.g. :
```bash
java -jar target/Entry-1.0-SNAPSHOT-jar-with-dependencies.jar
pocs/crash-58783598f633b5ccf0fc1e7024bd58e171d29f8f
```
Any further discussion for this vulnerability including fix is welcomed!
Feel free to contact me at wenjiezander@gmail.com
(https://github.com/ZanderHuang)
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 65743] java.lang.NullPointerException in `org.apache.poi.openxml4j.opc.internal.unmarshallers.PackagePropertiesUnmarshaller.checkElementForOPCCompliance::PackagePropertiesUnmarshaller.java:254` poi 5.1.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65743
--- Comment #2 from wenjiezander@gmail.com ---
Created attachment 38131
--> https://bz.apache.org/bugzilla/attachment.cgi?id=38131&action=edit
The poc file causes java.lang.NullPointerException in
`org.apache.poi.openxml4j.opc.internal.unmarshallers.PackagePropertiesUnmarshaller.checkElementForOPCCompliance::PackagePropertiesUnmarshaller.jav
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 65743] java.lang.NullPointerException in `org.apache.poi.openxml4j.opc.internal.unmarshallers.PackagePropertiesUnmarshaller.checkElementForOPCCompliance::PackagePropertiesUnmarshaller.java:254` poi 5.1.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65743
PJ Fanning <fa...@yahoo.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
--- Comment #3 from PJ Fanning <fa...@yahoo.com> ---
marking all these as need info - can you explain in plain English what you are
testing? are you testing that POI can't handle garbage input? and what do you
expect POI to do when it gets garbage input?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 65743] java.lang.NullPointerException in `org.apache.poi.openxml4j.opc.internal.unmarshallers.PackagePropertiesUnmarshaller.checkElementForOPCCompliance::PackagePropertiesUnmarshaller.java:254` poi 5.1.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65743
wenjiezander@gmail.com changed:
What |Removed |Added
----------------------------------------------------------------------------
OS| |All
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 65743] java.lang.NullPointerException in `org.apache.poi.openxml4j.opc.internal.unmarshallers.PackagePropertiesUnmarshaller.checkElementForOPCCompliance::PackagePropertiesUnmarshaller.java:254` poi 5.1.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65743
--- Comment #1 from wenjiezander@gmail.com ---
The poc file and report can be downloaded from
https://drive.google.com/drive/folders/1RsDEtpjmv3adeLg0E0H4g4FicUKxdpgG?usp=sharing
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 65743] java.lang.NullPointerException in `org.apache.poi.openxml4j.opc.internal.unmarshallers.PackagePropertiesUnmarshaller.checkElementForOPCCompliance::PackagePropertiesUnmarshaller.java:254` poi 5.1.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65743
PJ Fanning <fa...@yahoo.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|NEEDINFO |RESOLVED
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 65743] java.lang.NullPointerException in `org.apache.poi.openxml4j.opc.internal.unmarshallers.PackagePropertiesUnmarshaller.checkElementForOPCCompliance::PackagePropertiesUnmarshaller.java:254` poi 5.1.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65743
--- Comment #4 from PJ Fanning <fa...@yahoo.com> ---
There is a good chance this was fixed already on trunk -
https://github.com/apache/poi/commit/1e9efb5562517c657293e49d57654f3bd55fc3a5#diff-d51b5cf80ea05fe627afea10235c05a1c3c9823a7908990817b4fb73fef98117
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 65743] java.lang.NullPointerException in `org.apache.poi.openxml4j.opc.internal.unmarshallers.PackagePropertiesUnmarshaller.checkElementForOPCCompliance::PackagePropertiesUnmarshaller.java:254` poi 5.1.0
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=65743
--- Comment #5 from wenjiezander@gmail.com ---
I have tested in 5.2.0-SNAPSHOT taken from
https://ci-builds.apache.org/job/POI/job/POI-DSL-1.8/lastSuccessfulBuild/artifact/build/dist/
This bug is fixed and the exception is caught by newly implemented
POIXMLException.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org