From 24bf8c33f221a16656a4be90869f17f356a80961 Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Wed, 6 Sep 2023 14:33:59 +0000 Subject: [PATCH] Bug 66425: Avoid a NullPointerException found via oss-fuzz We try to avoid throwing NullPointerException, but it was possible to trigger one here with a specially crafted input-file git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1912138 13f79535-47bb-0310-9956-ffa450edef68 --- .../poi/xwpf/usermodel/XWPFParagraph.java | 9 +++++---- ...imized-POIXWPFFuzzer-6061520554164224.docx | Bin 0 -> 7789 bytes test-data/spreadsheet/stress.xls | Bin 67584 -> 67584 bytes 3 files changed, 5 insertions(+), 4 deletions(-) create mode 100644 test-data/document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-6061520554164224.docx diff --git a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFParagraph.java b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFParagraph.java index d747e44cf93..2a337337f6a 100644 --- a/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFParagraph.java +++ b/poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFParagraph.java @@ -78,11 +78,12 @@ public XWPFParagraph(CTP prgrph, IBody part) { XmlObject o = c.getObject(); if (o instanceof CTFtnEdnRef) { CTFtnEdnRef ftn = (CTFtnEdnRef) o; - footnoteText.append(" [").append(ftn.getId()).append(": "); + final BigInteger id = ftn.getId(); + footnoteText.append(" [").append(id).append(": "); XWPFAbstractFootnoteEndnote footnote = ftn.getDomNode().getLocalName().equals("footnoteReference") ? - document.getFootnoteByID(ftn.getId().intValue()) : - document.getEndnoteByID(ftn.getId().intValue()); + document.getFootnoteByID(id == null ? 0 : id.intValue()) : + document.getEndnoteByID(id == null ? 0 : id.intValue()); if (null != footnote) { boolean first = true; for (XWPFParagraph p : footnote.getParagraphs()) { @@ -93,7 +94,7 @@ public XWPFParagraph(CTP prgrph, IBody part) { footnoteText.append(p.getText()); } } else { - footnoteText.append("!!! End note with ID \"").append(ftn.getId()).append("\" not found in document."); + footnoteText.append("!!! End note with ID \"").append(id).append("\" not found in document."); } footnoteText.append("] "); diff --git a/test-data/document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-6061520554164224.docx b/test-data/document/clusterfuzz-testcase-minimized-POIXWPFFuzzer-6061520554164224.docx new file mode 100644 index 0000000000000000000000000000000000000000..70f491c23a5d99ae30fca8c7bdbb03920d4676e0 GIT binary patch literal 7789 zcmeI0MOa+zmW2ypvQMeRRSa2t}26qcuxVr@n!8K@bcS7^u?%VS8 zKkd=&J@_Wyo}6>m+Uq@AT?q~zAAkrz1^@um09Lne(Md1>KqVpofCoT^HIR0609!hM zjkO?7maax`J?-tN^5J2basjZf{r_M8!fybYtfJH>fgO4p_(FZ8o$-xQrmzf2{0ob2 z&ta=Di0C#d3uOD!kqE`0;d`&d5rDm$?y>F*uxuoZk;`sIKU#5F=z$G1 zgl~y@o~(t!-R$|&O82r2k}=-yl)}Wv?iwxTO_D-a*rg`p^FLpz>chTdn)hA?6@jNh zkp(@E&rTvzR^ZQUN7qsUyGozGieqV!l|Js>|BdfEyVs?*`O zqj=zBk!SUY&a79!kl2_-Q+Pr6yXrRxNm!u=y!Ds797B6 zIlZ&Tj_|-5zJc6DH>P#4+pfvsU7u{2OnOw7V0cxB)3Uf=-g|HI6b@uW?cuL@Ot^(xw{nT=g6?OZwD{&oJpiT{P2``;ct zI$>E6P7*!z6k*+T*jHc~m1bsfO+L?q<`6D8{RqYb^Lyb^XGZ~5tNQY%-K)JZwYjfB zUuT6&L=dY@^?v3qd^M3-lk!BOxhnF1)rU&b ziP2c`)D#$o40md^#*r(aXvW5WC%cZWXzd)j(t*oJFJ98a00B=W8isWFjps0p1W5f* ztxgxlA_#_&OdS{Bnz7g^47$YFFkiEg+Hp?OXT_UUqVjKm@_$~-yckD)31LIYLy4HY z^l{6C)Bl78Ud)FKRSUnN)?*{|^?sBNs^_p4dyTdK?U7!6sdr4TH$(6M0672|#>3IY zg5%$fV&Q1+X8)Rfe}&#ZO#}0qe6QXA+Etk}uG+_m9egU^F1;=6tdUElRYDXz%ZeXS zacJi!a};yL9@jLKuPC4A!Xb8|n|%*$yRmsLYTJgZw4FvyDIrnnW@0nYM7wGAZEXcc z(1H{f^I&=qo$QPZKUHSuC2n)H6dxP?GK$8lq&|4_&Z8WL-6&F&__Idd&jcTk?V8f{ zTicB&HUk&oTa$r!U>!3;{nwd2$FMcVoZG>28v>F1C0kA~O<>|4tRs^>2Hk=h1p9I} zh}$n?Q-~o5j%MBHHj0adI=C$jnSgX@)JVW~fG&iJkc*leBg?oLL>wlBpEDG#<1JUZ z{xroH$h(s`Y5+@N7-^|Y%2_0t(PXYAh0zidp-w&XCR71ca-~1`E_ijU>y`^o4%_eQ z8Grp%9{*cuw@@6*QsF;oFo!o-X>|JYF+aRu5~i@O3jN2H0ZuXDqF8W=4}ePd)MAN=?b~{ zWmE=Y&(fJwP8@N{jN|RK8f7aP`C5_sID~TF&0uaHlgU8#JCUfqx=RQ&^F6XPi2<7` zT5Ud!U8;0udN@idCD}Edh{s($E<0Knr21Jl~rM6^vERN z<7xbl@D_$?`v;F3CMl!O$Y8D@4tBf7h{?zd{LVBZ<;3&59nXtZV$4OXant=+#7T>Z z2Fy2;-yP8#hFyu?RC!zTD{WNiso{Zc)(sg77Dq~R2I~)W)*(02&Kb~{m{}dR+{{r0 zj#YgIp5Ao346Eljbl#b$MWC2}XV#%|yFQlAHvC>^XeQaYkk{Lfi^*S)d zOxo7H9K*Oy&@==bYg3RLm{N$2@*6fk(T`V8>mvw5_yf~#0|E1gwZ*}y6=vG)g0<2a z}^S3 zfmwE4!@8_lr3fDfPPp2ir>$G8u5V&b573wq`~G|_*^ePcx?8p%uph53=Yeb)#vjuU z$~`L;IzO${k)mplcd`_2@d23(zwi*0?Ve4?&2JyL=9}$nam#YRx!agg?4wFK$}{p@ zBx79BL7$=>^l&QA5oy7xra`zXu1aFj{dEebJ6}~I`(iLIq;_ZWo+FpFc~r9P^*~WC zWrkoxzZRnIf}3pIII86Lv>1M zhSb23jJC4&2e*caQrJUegC_)C*(SbbfbyA zB+3cX+DHWD5Kd?U(}|H?T3?2=6bk^~JOK+sVpAI_wb8#InhvvuI9>IulS(1)cnw3d zFyyfSp_Zn#Y*No(rU-QQQewrs$L)OP8=Bih4SPm1BdNMC`-HcA@%g|cpKzaOt-B40 zQ-8!U&+$WzInMY}1sTP`Oor^6c#AoUc8e zBhxjB8wYwZ=(x+0_n67j@X&kwGu4)QdUoto2k926L*!E#R}xzl-Vht<`cE6~8{hET zngy#vcs=TUVl6MTV*69>VZ1u~i^-Ih%e&fru+(gwLV~j?QUz7?H=g(JHky_Ee_rqn zxdsj-4_UaJ*&7CuYXW}X)ifOThMG7(*Jb_W9@^f%_nhgaR#8|1h`ia7Emv@j@_{_N z>V@6xH4Cfg9@mySwr{2IqiqcyBx{mbLAhP30{!EVB#H~4z{pEJzT!NS22Z0Y(}PJY)Kb6DoYZhxI&$nDDsSqx4HN-fQTWbSZx zqly)2OvY5qWq%&uGJlBJqQdq%c#n9?)z(Mi`gkXIRtRUFo`9go&XeF@sWrZ>B$@qL zjGdpZ_RDC73w<6HQO$Pk(}U&m9+hnw`2sw3;kfYk?5rP zZB~g^PA!+oGQ{z8ej z*|7y))X%B|wF8D*t6j%wpW5Jf@$AWW8HHY45QOtSKw;2|;WQZ5(B67dCt>7}EZw&&acKbOisGUNpxXdSCUTb099$83gAW zE*t!bX|FsM%ZZ{yx1l5DIPT)sh|&2$3i)~#Egt9rbazkPId1#7sQQkhC&_|;T!8^S zOfh3VK}6i10WIOaTX_JV_(MX+*|xizU!z?VDHSntFL2n@r?&5mAKpOy;QpiaZiz`q zj|qlqy}#P6BA=^cOqSDB3c@{2GP<|W0!R&`3K!<82_mv0q=+C_Vdv$S3R)rYFZ9d z!!I_1Rxj&WsRGGB%!-UL-fBbV&EKL+ZaeW{!|O&UhztNA_~&;7TU**&a{S}u`pf!9 zdXo-h?}@u;&oK)+nriWcV+!7BA1z=&K?Mu!2hQ!3r>Z<{^%*3L*WVOl<*8&O$xGo4 z-%(L%L^VTCH^iiKkt1hyHom4Cc{8rX6~^QS?qYibKd--tUygh3T&#xY8PU+~IIprA zvq8f9#ZG^`EABPUeJTiV#bac8J!Fd<_=ZZmU?9a=;7bjno zZG-;!M@a7^pyo7a=VPkKq@s7(%CP6I#LXewsa2VNdGj6lO9)ApZH#PzzLHz5GRCmq zx9=ONic!f85F|$lLgTC+9a7uz-TWW{swm^ko+gf;gsgAZ{H0{KvPhtq)@@lXITDDO z_V~T2fKDyNO-+1@KDuRSI85wMkSj;8N3%6t0E30@G;!GnDa3^^8OL9xj7)Q|=iEIl z0`4QJJWBff37xqS<=&@^#F18`r#p$K#$u3Q%-c6_PF{RGU;b?ViA{-@ZV1?-QoH`O ztoFyp6YKeWzk&!$jCF8Ke6FSRKe-CadeNWQ+odZZL`v53y1o=OtJ z%&?zG)|~NAg3U^;1GXznw*dlzK#aGj9ZuR~qb)7M(LrXLW@$tA=IsV_Z4u^-o!?Ah zefgA>hR&?y$@!XyzYt)`E91|c-eFQB%&ivBo*yz?Bc%G|PT5D2rV+LlDtW8&t3>cy z!#k4@ETW&g`_x0w_};PBd1W27%9o;kM@>4#-EBTcrDP!|s6F}>zC+=MQBfm5G9iBl zF;rp+2TKskeG`kX3*QX|c)Ln=Mdk$&g!(4N&=4`>uQLCFV7O+>Rb6ITg%=beFXuU@ z4RtblP`&3``c;nHIkJj6J&BD({)X(tAnDzvSPR)oVL-tQujJL&ys6sYxnuA~_~7UH zFC-y;cCH&wOI*C&d&XjH!<7OJIMqGbT3RS%a!aSq%>^n=BkyxM??pW*u(sG?L1Jy^ z?e;B>235B?jx9q!FF|C-&?c$npRPd^3FE`$Szcz8>VrZy{lk2qP%D&2*)EKzj95YS zgpmjqlug^EJqkmrnmozC3anC8VQN*Ajkn$z3RIeN0Wv75PG>x0A?KT{jmkxzC!RayK@|3-!qNC< zPO>!1Sv`YqQk!CNol_lXFgXVJ`nx)Jpcj{}ud5j0ZW@D~1U+VLW)fi`>z(CTIV0wbu)=N6Gmw3R}ppecl{#XKCu(U?iZn0SH0PWETFbl=fxUi(Qj)`jQ2In)Mo!ie z?^MeX4OxZ)mxIy%@>SZlU^h1`!&&dPFe!PrA1X8aCQfpflfJ5~rLTy?XzZwpm44LG zi1_FC$Pgh9@y?AY&y>ZVoKoGI3Vko>?BfoI^i|aFH0_ac*x;SUKz;q2>e614CjI4F zE4J)vt5HdOAbaS*h(uENGuF(D$xA^m@Fo?#BhUSw|LP;WxQw+`9Dm$TqN9xfa1b;~ zlsNM!Uxi_Ow3VMC3p!sn{*cMI8nHqv!d4L7|CcaNhgY~TJOmm6Tfk)CwsXV>56To-=7 z=KU+){&>y0|HNBYOE4JZ0Q?8uW@;}xWO8ErR?mKx5b=QXK28ahQE6O`O5h)5cw=G$ zVC@{?Z(H>99rBk}FJL;ryGiF6;>kXD^7=EZSA%3s|9${wyO6uio* zxt#*(8dM}O9b~B%!UotB&1UMl(zp@0Ws{`~kO#+DIk!jha+-0OXlh!vlfD@9iIm^a zJkBR9yi#Ns=!vvm?Uu^zeEU4*EHh|^8_E34O7L)ICm5B(e8B+R`q-YI&hT)jyp29~ zBd177o**h&gdV-BLH6rYz{GiAEmF!4PM3bEKMC&AF=pGI(k#t!7>xnNCPF+(g{C)O zEQDE;b)JZ;g-_cVGPVh?RO87LTatQhMntL!x{?e*-y1HOil9>Z&C@5~E@>qFLQ|35 zD{C?kZ=A3W_CW3r$3brMsfy^Q8e4)|`{KKIs9R<(Q3la7j5tHfo)63?=B{%++{V?N zRjEd^=3`c!Pj!%Kpn6~CgC^wH!w>qoZ;hU@FsGv)3ZBKxC{;#C=A|MdSA7TsYuPZJ zbe;~2eCYzJ3|T!+y$gi4I~WV?Sw-DTj=6Rri+s~Rb5}wq@t$e)CGIa3#`y^L9rgLk zHASuS{lZ~QKW~6*_peK9bdtPRco!$UQS7#X#j^Naw@WCpeFzk|QT0eG7)CfB?)CSr zT)a<9!{~rsd%JjsctthL@d?^LcrBpi$FrhvQNnf?VeX0A^=tgL_RX%1?$R!)Bz2D= zv|uHR>nND7-gaUpXtC^wcE4+P{J)7by6F1$r;e6-b_;H#Vsg-%UjPO?u!=Xu)jd#( z8BlAgPOi-i#tIQ?tl6=T@I3pu03lz|WTyiYhj=pw#u{Zs$>aj?>-1q!B2){i#IEfl6X20NRM;2Wa9<9aAy z$~Wef>yiE^*E@iQ(Jv4$x|RgZUr4O>XSy9|r@amnFRF`ERE7gq8# zjU_O^uEo6n!HiaMZeV}b5R?(Vh zFjGy6mBk6npHe3~*T#3-%r|&qYwHpqKVCli$Q+l!{%{h=Fr8a^h|bbdU&lI|ixC-a z!&s^@Xx_PLPP+WLKkRt8caEB)C*LVGL~nNoHmP!gh=43&AFTllflRBJ&>yjEDluVc zz5Dg0#E!ywVrx7ULa(?O9<1%IZDuq2x!!O5tbFQH-8@UJi7vxUtT0ZkE2;??`p4Hn z-mVCj*e9Ifju%y=+<=BF2Rnl6+>#B;(}hi luQz{fy(wQe-sWzuU`Kmhd%OQwdxOB1_WuC-|AU?PzX93X_qYH6 literal 0 HcmV?d00001 diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls index 84b3a84857a6ad5ecfcaee6e2108bc732f4760b6..ee43072f5c70aeff9d3bbf839bc1f4ccfe4faa7d 100644 GIT binary patch delta 412 zcmX|(UnoOy6vw~6ySv3SEhWn6CcKSp?N1~r*@HdU)2uwm?2=qAcUx?VMN*#Vx5=|K zU>>}AS`@V=MU9m5pk$?tU#)aHbw1zoIVZU-Cbz|7Mb!J#N97z{5I2R768jdf zbX9?da_*@>bd+p(PO4Wr$u(W|)C)KFbk`Hm4~am6eR!HBq29vG!Bi9R(Z{eg5FGJ) zy|F|>)~s%u+wOAMTrQ{G?Q}Stondui$p*-prfNOXpd!!8b5SW8pO>Z9@t%k_6&g^q zR%tdCiAo_^np71 z001eN001$j007yu006bW003dl001x9vkipH5COZh*_3rfvtrt62?^H#Isk?X000P+ zFXT0oX5=>uw*UYD00031w*a@7$pHZ