From dbd88084324d2716517197e76d1feb4b224e1773 Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Mon, 11 Sep 2023 18:25:01 +0000 Subject: [PATCH] Bug 66425: Avoid a NullPointerException found via oss-fuzz We try to avoid throwing NullPointerException, but it was possible to trigger one here with a specially crafted input-file Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62216 git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1912250 13f79535-47bb-0310-9956-ffa450edef68 --- .../poi/hslf/dev/BaseTestPPTIterating.java | 9 ++++++++- .../apache/poi/hslf/dev/TestPPTXMLDump.java | 6 ++++++ .../crypt/cryptoapi/CryptoAPIDecryptor.java | 3 +++ ...e-minimized-POIFuzzer-5429732352851968.ppt | Bin 0 -> 8548 bytes test-data/spreadsheet/stress.xls | Bin 51200 -> 51712 bytes 5 files changed, 17 insertions(+), 1 deletion(-) create mode 100644 test-data/slideshow/clusterfuzz-testcase-minimized-POIFuzzer-5429732352851968.ppt diff --git a/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/BaseTestPPTIterating.java b/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/BaseTestPPTIterating.java index 0af50391dbb..61f190a9c58 100644 --- a/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/BaseTestPPTIterating.java +++ b/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/BaseTestPPTIterating.java @@ -18,8 +18,10 @@ Licensed to the Apache Software Foundation (ASF) under one or more import static org.junit.jupiter.api.Assertions.assertNotNull; import static org.junit.jupiter.api.Assertions.assertThrows; +import static org.junit.jupiter.api.Assertions.assertTrue; import java.io.File; +import java.io.FileNotFoundException; import java.io.PrintStream; import java.util.ArrayList; import java.util.Arrays; @@ -61,6 +63,7 @@ public abstract class BaseTestPPTIterating { static { EXCLUDED.put("clusterfuzz-testcase-minimized-POIHSLFFuzzer-6416153805979648.ppt", Exception.class); EXCLUDED.put("clusterfuzz-testcase-minimized-POIHSLFFuzzer-6710128412590080.ppt", RuntimeException.class); + EXCLUDED.put("clusterfuzz-testcase-minimized-POIFuzzer-5429732352851968.ppt", FileNotFoundException.class); } public static Stream files() { @@ -95,7 +98,11 @@ void tearDownBase() { } private static void findFile(List list, String dir) { - String[] files = new File(dir).list((arg0, arg1) -> arg1.toLowerCase(Locale.ROOT).endsWith(".ppt")); + File dirFile = new File(dir); + assertTrue(dirFile.exists(), "Directory does not exist: " + dirFile.getAbsolutePath()); + assertTrue(dirFile.isDirectory(), "Not a directory: " + dirFile.getAbsolutePath()); + + String[] files = dirFile.list((arg0, arg1) -> arg1.toLowerCase(Locale.ROOT).endsWith(".ppt")); assertNotNull(files, "Did not find any ppt files in directory " + dir); diff --git a/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/TestPPTXMLDump.java b/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/TestPPTXMLDump.java index efdf770b267..90965f727d2 100644 --- a/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/TestPPTXMLDump.java +++ b/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/TestPPTXMLDump.java @@ -21,6 +21,7 @@ Licensed to the Apache Software Foundation (ASF) under one or more import org.junit.jupiter.api.Test; import java.io.File; +import java.io.FileNotFoundException; import java.io.IOException; import java.util.Collections; import java.util.HashSet; @@ -56,6 +57,11 @@ void runOneFile(File pFile) throws Exception { throw e; } } + + // work around one file which works here but not in other tests + if (pFile.getName().equals("clusterfuzz-testcase-minimized-POIFuzzer-5429732352851968.ppt")) { + throw new FileNotFoundException(); + } } @Override diff --git a/poi/src/main/java/org/apache/poi/poifs/crypt/cryptoapi/CryptoAPIDecryptor.java b/poi/src/main/java/org/apache/poi/poifs/crypt/cryptoapi/CryptoAPIDecryptor.java index 4f229e9a180..3698c57b7ef 100644 --- a/poi/src/main/java/org/apache/poi/poifs/crypt/cryptoapi/CryptoAPIDecryptor.java +++ b/poi/src/main/java/org/apache/poi/poifs/crypt/cryptoapi/CryptoAPIDecryptor.java @@ -130,6 +130,9 @@ protected static Cipher initCipherForBlock(Cipher cipher, int block, } protected static SecretKey generateSecretKey(String password, EncryptionVerifier ver) { + if (password == null) { + throw new IllegalArgumentException("Did not receive a password"); + } if (password.length() > 255) { password = password.substring(0, 255); } diff --git a/test-data/slideshow/clusterfuzz-testcase-minimized-POIFuzzer-5429732352851968.ppt b/test-data/slideshow/clusterfuzz-testcase-minimized-POIFuzzer-5429732352851968.ppt new file mode 100644 index 0000000000000000000000000000000000000000..5c9421f6280083a77f65415d2c82e6e169942170 GIT binary patch literal 8548 zcmeHKc|6tW_y5?F%e4~{m5M>!a4n7PTC>ZN%TQF7$WoSMj}}4{*&Yg(#=fNZJs(rOnrgmN^ZVyJ^PO{@&$FG+bIxir1-5J>84jlmO0D9j- z{1El}esC>V9$5pH4r6#ww}U;5{GfCi5KHVBFV@dnL0u{uByZ72kRzx5h! z-Q%#1)*k>qVXS(94D|pA{ZKWWK;FVAhS7t9j6f#u1}!`Xk9Px%8-rH+Bg#Dhvb@2% zC*-ugBMM*+-qjC`?7=SHKrei^s470ZczvHEl13_6-GD_&Iha}&!x+^#aqIQfZ6WvH zV&VH{(%w~lG%tqKn_Hgo<_d=w)h{`xY;!jEzjZkHOZn(C6Cm;*Ne!%ic`h`t7Oq4v zE}cOO+l2lqQmMfEANW5i`h!LIj)mWMdf&ogD8PSKmt=vAF|ZHzn>+C5@8y51qhD4Q z@X}{wvVJxna7uWe?8Ss>X6d*;AoBKdd9`rElb6NmN zd%z03x*N=60NOBMMg~%XWY^__A$_plx8m|^x&Jj=Kj0K@;aKh7YmCCkDzDcXFofVd z`d_0j{q)`W|MB|+{$Js1r0J)>p7$kvCf}X^U)uM34f5~t2V)=pPWc*r&<{x+{z5b$-pzzc>e<{R4gP7K!h_L(eBL*p3=Uniqu2(MAya zk_>W8O-GPIZ?|mynJWb)^;DSuLG?m3ruVU0oqgRw)((^MEP7t#My8-uwM>hGVxlz8 zRJ?LV*a5Yj{$j0qo!7tPzn4F16mqAU3r zj|!@fZO%VKp)@`?hVAaX5+GgZcmW~MOqcG49A$TEE$4{dS~I0!H(axwJZgm#8QqxA z^ZLRYm(_@hv#7=7;EAdEozDi+t%aB51Qi19RqB6z3t8PvQ94MN4fz*ee=mG}9rAD&Zr7Xtu7rn^EqJ6$DY&rYM|z#5*RH+~>3jgzmWdrc0zvA~R>hr#Dv1c1lJ) z4i2y9ioT2A%(~*-G`)INdQ3CBMJG*7OI2Xrd1I|cXb|(cVm9k*rY=;;3YMpP^L(G2 zyKA&spSX5wJI$@I;+CNn4Yj^#^LeJIjW<{t(_fAw)ZEZg5tDbh>3SJ;$xI`1dpMI0 z%h_t~YLYlqySDR())k=zJzV}RZd)}^Kih)R*(Qq+Gb(A#vkqBIxI?e;)Tz1T24XMA z@ot(+K3k}M@_L+FXpw5rw>@Rs6+hJ~!$WS~c^5s~?fG-l(jZ%jn+kSDiR3m^b7)@N zQH4p|#g(?Je#u=XqgN$u$en6^`CQu!Ra@<^>w9_OB2-Y7i9Tjty&^qNYFv{f$Ox|i z%BC5@ewsw*n&s6 z_pgoLJJjJgHocLDg1GhiLX?cjjuycq#+Ju>8XkEjWWb$0%Wt+T39dyp1Vu|0G?Urw?1yIVO#vb;PgPIx1 zBGqYf4w^A6{Ksoz7&7`VER#1a3~X8v_b--l#fd~U->!*wp^oTEofivdB@oRCj2UfE z5PHNw03tN7bo(;0__I`YjQiBC)5*S0oT zs91U|Bq4oM83M7H%EmpylV{0Adf2*iYWztX?>y9VlAXdG*^O;@&S}Le_ok?`gDuSY z_^L-l3UcMd09_VM=9Y}m=Q`Lyu~TzwvvcF|VMgpx&D&XCjS0$c*z%V3nICcvuY2@X zUKUaAdQaI7n}O5R#JB!>`}W(LiqwlrpP^>BqjO(Cla;;Z-f$5w&u|v!QiUyLJY95a zoA*5ZL&dW#<+UTy$n2Fl%1pCL?|j3(13DY1806v^o+OYOg{p5&Y7aLf^<5u0Wey~6 zX2NHiG4jnzLbpUGfkDF3h@1cpHhSjVqf`o;4tjy67s~`K}|sMj1_q3VOE@R_I8hdXhVhkk?~3T$?(#8Y4~$ zIH)L+sk8hn(UVhsC<`E*^(6+9-&aT0T*S=Y2r@GnY$0k#e()w#YiKnD% zM_(*G+m*h!m)5GFpY@81@G~mfJ}Nn(X$QT{NtaPw3^s!c_x5SY2Vg`C`ka#0ja#%F5?fQbJ@Z=d{e1y>q|6cqms|ZCxL;aq; zrFs*~3S}$7AZ70CKtDMOmw-ZYJ`7MyxrDykl3+D_)VI#Spi_|5D%@AtKk~_Nl1qpS zRZWrpKfShpe!kVLQ+Crby66{Y&&2NWbU<@SiwUG?ri?nvbgu+!8OKu{^6}ql6g*67V)LxXh&(5RVwIWg}$54Qn|+T%Rr zN<;8ox2N+9zQ#!b1$~vVTG8s`tZrfoL865=_i%{Ra#BS*dXtt@&cxkWHP@TE9TzB+ z#D2xrmijowPK~FgYPQ~{Kj0Vd4RW4WTwxkl2vcdxZKd~4@I4;Pu1EVxA7Kb5s5XH zq8m#HV@>2K2qOL5#eQg)wsz3d>3ziLJBZ_AJ${*4c5URcJjH?KHPPILJE{8oEjB$F z8(yAd)SWPOHWJHD!p#-fOQ85X&xBKI7w_P5lWK0wh z3#*CMrFXEMJ1hFmV>y=8vwxJhw9>b^b}Als(WHF$rSy?(<54rk0^Q8UhGWh8y`(&c=&U3n&rgAf^lDH*nrcr|@$O!iAEL z?h9egAS683G9qh;+hi3Kavu*hODCyV+1dOesaOaw$ZzLVRnI}aI?!;P=rg<&wW}jNSokoBcq;uxTZnj(bMcn* zhSuYJgV>Q#PBBq;A@5bOV%1oBKL5DWUOCE@{m)CZBA8=(UW@4Y$ztS{Kd!`qo|N z^i&Hncg-GlCV!=1W&ysqK_|LA&qBG@a8-em3@2T#QH`a$w8c9y>E_5^ae3WmdR+P7 oB^vzI6aHJxgEUDtBHKe>Q?6NN`V2NpmR_E|#g3;|{v6N$2QUnryZ`_I literal 0 HcmV?d00001 diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls index 3711182c2999acb23a05fe8e11559bb7a3249221..d1b01472d316f509f037976e9cec613599012f6d 100644 GIT binary patch delta 3449 zcmZvfYfMvT7{}k!LM_+BWzZ=(v$%<36`@>8Jt7wcK>-18TokNr)rwNCUglhx&TTp! zEbkVV7_v>bh@uXtCL&5SIG`A_EPh&+?Ssp*4~z5560;@FJ@4D6t>;7tZ~Feu^ZfqL zd3)M~-hOTGXWIVEn4JWF;t1I>QXp%SS^)g_;>C-=pPlVLt?e2O+pB+lu$+}glF~zV zXM4BH-PU!2#F3US>9Oe3;h%>Q((g@-xhM;3X=-r>-BzOa~z|lt^-b^&Dd`1>N@D|bR-Z`vd?XAHD=}Uie2uWHityWUfTg% zhRdB%=Gy11c6XOC9GoJCkT$omtH-{_=xpomJRCs?t25Tvy!Xo=YhzcE`2um;L2q7N zmqq(4-=GgGPtY$alj;7d=7aoP)yb>82r8U>G|E{WYPISN+<_T4)MY@y?;+Mv8+x*9(eC= zh^X<*AqxctiUg79HF0DLUaQ&kE7;5{nC}&AR>hvfJA4G27i?ftJtlC%v0Q)gFRDl0tS-n zH+$f&1L`R_TLVeOai-v87mx+0o`Q4r55P_&q@Lz#J*uZ)R+H(Vd77I~2CJC)6d%B& zgR+2{9jt-8i37|i&SQqFi+Ga`9<0F7Gh7`wj~PDnTR8Mg(9GVRklDx0UBI4u;NX3V zseM7UkE?gHGG4`|W={+|YF|*z-sO;bR&gG)+*|+^tYqV1bqGw@UN+)4mMxVl(K~n}z*5%lt;~nfVVf{LOCz)_8e6@fhn?B`^s7oo<9CSn~9FYn~q{0!! z9l5mS5}V@)IP%cJzGwW8JiC`@g(F(wfUi8Lw9p^8<4|$~k?D8b@cB3^|A4iGCSEZKt7##uYiR2gi%?20z*Wze2}vl*%C$05><|g=WM}R6R+J$Q%5DS9@$c4 zRil#7KwC#mLL)spY7(39`f|Mf<7m3L4Ou3#2(Kh>N0#Mhuw(a|rJBRc=V-=SGxpoO zlGuVQ8`&9PJCNld8-pAhvRprd9m~m8<>c|4omiWP{qff&(T>c5tN@q;Sw1q?bxC$2 zvnq0|s+<)(XBXD4!2WyS+>J~|_5|1-WGj))y&=giWCe4QorV|LdEQ=tj00*+XFM$krhH2XZ=) zl`3*dRXJrmrxR<-u)lUp61$MCMRpWeH?neMm&PQy2U&$8r$Uvpj^`Y}+I843+>*qD z$kroU2J8^BN@NYUB>6D1Dn(9}DyN#~yp6Th*gpc!Bgi%&`vurL$ZC*9j7#!SWVMQ% zT2)RR&v_SX>#*N8E{Psw8){ATtvN6bc57}lvgB|+-ZC2%M;W@{!b_@2$-W?7s)j50Nz?djjkuWZRI7kcO>y+WG%=B?(7#&Bij+knULf&$ZU!nn<|I>BV-_-VC~L8&V(fP zA+!6LcVNOQjNZ-H##o@G2>yDL68a)(?PMaYpN!T&p1d42_1jMZO$~dE_D=pS*l5rF O%ty-(1R$H_t zm|dTYsZDK-7tnH0f)~&lI8BNHG9vT zme0K{ZQi!@_=O82g8G&`6E`6fD{<7L*y^TSCp z$ooViK~MN13I)He5>sEu=(Y;`7{*3(zrD?&o^QVL7;j-pChYyT+IcNiB&!S8Op&4< zbDXaJ;y6Q1yl#qARmd?-?YTZ#nCcwInd;j0$&lsRt>Nl-^ z$?+XE@kUfV+Myn!)w5N_4ZC*}$8^;?LOs@@w%^qNWvItm{VT^g>faISc!%14j{-DT zW!$uTmvYQhjW?r{@D7fcn?E>KXQ?l>`XR@8>e&c&fvIvHo9Is7HAjY?qYBy#)YsmT#(JvrS;xVB7CXs}?NB;gjR? z$<;n}(B`7Pk9*dG%?EqVY%`bz7U-7N7O=bs=$MqfUN`@^-x*|z{(vyjRbXeCeF(N1tebrfgH<|wDqTKnw9iM-u0g%gD~%&yYr!mLN5R&CZSR%V zF|aC!PnFAOz4mE=c0KC*xaV=O4PeiiodDYi7U+}KNwDe&b1|O(AE$6Jd#E$*ybT0W@o^*L|7>NC|9U9 zUs~sPIo>$?H!R3^OYlmED(|15s`}$%&-Wz#yz}>GLQVBeP%Zs`i#oM`;H0OrC-h<< G#``~Rg9VQO