From e666d3756eaea55a138e7b2b319bc70ad28bf74d Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Mon, 11 Sep 2023 18:25:06 +0000 Subject: [PATCH] Bug 66425: Avoid a NullPointerException found via oss-fuzz We try to avoid throwing NullPointerException, but it was possible to trigger one here with a specially crafted input-file Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62208 git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1912251 13f79535-47bb-0310-9956-ffa450edef68 --- .../ReadOnlySharedStringsTable.java | 6 ++++-- ...mized-XLSX2CSVFuzzer-6504225896792064.xlsx | Bin 0 -> 10245 bytes test-data/spreadsheet/stress.xls | Bin 51712 -> 52224 bytes 3 files changed, 4 insertions(+), 2 deletions(-) create mode 100644 test-data/spreadsheet/clusterfuzz-testcase-minimized-XLSX2CSVFuzzer-6504225896792064.xlsx diff --git a/poi-ooxml/src/main/java/org/apache/poi/xssf/eventusermodel/ReadOnlySharedStringsTable.java b/poi-ooxml/src/main/java/org/apache/poi/xssf/eventusermodel/ReadOnlySharedStringsTable.java index 07d00bd99aa..590251960a3 100644 --- a/poi-ooxml/src/main/java/org/apache/poi/xssf/eventusermodel/ReadOnlySharedStringsTable.java +++ b/poi-ooxml/src/main/java/org/apache/poi/xssf/eventusermodel/ReadOnlySharedStringsTable.java @@ -259,7 +259,7 @@ public void startElement(String uri, String localName, String name, } else if ("rPh".equals(localName)) { inRPh = true; //append space...this assumes that rPh always comes after regular - if (includePhoneticRuns && characters.length() > 0) { + if (includePhoneticRuns && characters != null && characters.length() > 0) { characters.append(" "); } } @@ -287,7 +287,9 @@ public void endElement(String uri, String localName, String name) throws SAXExce public void characters(char[] ch, int start, int length) throws SAXException { if (tIsOpen) { if (inRPh && includePhoneticRuns) { - characters.append(ch, start, length); + if (characters != null) { + characters.append(ch, start, length); + } } else if (! inRPh){ if (characters != null) { characters.append(ch, start, length); diff --git a/test-data/spreadsheet/clusterfuzz-testcase-minimized-XLSX2CSVFuzzer-6504225896792064.xlsx b/test-data/spreadsheet/clusterfuzz-testcase-minimized-XLSX2CSVFuzzer-6504225896792064.xlsx new file mode 100644 index 0000000000000000000000000000000000000000..9426600d727a44b965acfa69d6e145c32621630c GIT binary patch literal 10245 zcmeHtWmKEn)^6}(MGD1&I~1otfl|CdLeUl}#kELqhvH6g4N%;nKyfMV?vP?difeKE z(w;NU?(W{_8~5Iy=bn}1O)|zipN!1)Oj&bIML8s70st!D9smHK2H4zx!U{nE06w4q z01p5#1T6_`D|;g=dmU95h>@K(yR)SQRpvAT(+2<|{Qm#0|11p*#DW#tIdT2ZKwqej z9@1Nd`r(?-p*)kzM+Uac#B>!JXi?OBsxgTk!B7lR9YaZxRN~!lx-j0^bk|BUL_(;l zd_rbI8~-j&!K`6mcDrA~br3(SjYSXY58VaKx;uLEdCa=B_!Y9P7l(~5LLw^sWOdht z)h|_Q6@x+Pdc94NtmVieB;lpC_Iy6!X2p+ZEG{Jxd|pOAk_>vENkiHESU8&W)3A-S z>!UhL%(wec^!@O78fDw&@~yzPTOs0diVCHyM}4H_p_=}8=0P?l05q)(94dl%KsmPt zYrRvmuXr(7ey>LIgFi*fl1+(6+dzJW8KvBAd3Q#-_Olo#qL554 zei>iFW9T?u?-h*!QX0eD>lfeess(Il)OUJ^CA$FqM+urQyrUmCsL&9J4{FcFn z=X$N3II24EZTl+!MOY z5PFn=+5PP7G2Jp|8wyM41pD`70}|3r2bU@AK4EYT_x0pE{aogVI3GwcAC-dd`=PtH z4fR%X?lx;C@8iqVd#s6u3~`@?Y>iN{CTh}k_c8=`P?fc>@(1)L=vI)m8_IFQ9_#gN zyqgpXOcbv#HlKRqA+cG1NW9VaB9FA^ecD5l*N98vPRlNw0@`L2}{lVWL5EZ8z|IDbCtpT;cDFx7J;8W zo22Gv+`GS8(Xeo6XdJz^rOteWJ|&Z-B1q90`)(*a(lveTY;b&#jef|Et(Kcq*%k5m ztJ#yuipQr1dIR26-j2*{O=Uz%t4H`Od(ye6;VEr1A#T835!)&h_Sfi3tc2wPX;Op< z$){MDSCscv2)F~$V)zM77h}{Fzht?;>YE$2&;X&p7VwrGZrWHUJXB+u_O7!cDI{g{ z1d<Vs=kbez-{AKFibNu^B~?PWSOS(Rb~4=gFn`^L1{R84-ta{`JyG zGcf;-uF_5c&TH{XOx{zZ zYu?PIuk}F%0943+WQ{-f!rs)#(um{dmFtHs?`XWRhVc=6#+h-VvbVNmtR_Qq2$?BQ zDFKspSOrp;CB>_&WQvZ-c#zGlyhCWO*GoWX*yXff9YJicPiN2yEJ3;?JO#;C5ckWC zp^{Ba21?R+x!*0W&^nyV`37Z3(9o^fz>2g>U4uGAD8~g%-JAk$t{<8EbaUtLJi2M76sksKgwLu?!Ug4>BAyOjD2dPaJ zP8!p<@t!J%(Nej&ac78#Nr1;-eL-i$ja{-^2}8_CpM5c9)n@-&E$1s-_#_=f;1_wMDrg#l?jjnvTg8*y% z*NNp4&96zv8Y91>fK_2voUM^~n671MUUyp;D&My*Vpal&BPeg}uQx^y+bP-DOqSUr ze809OEP9@Po2JZqmgaeUbV#)3tkH3I+0OX+`r73QF1IQ5XedYe_32J;Xqm{(O+z>R zfu;9zsq;u_$xN-)d*lcA?0Eug=ox8knhD!+RZLLsdpn|UreTmTl{_&vs=aR$?(|CZ zkO}Ec`n;1Nxu1TnDf%}uy;Z=OfC)LfEH*^qm_^-LAk^1(UH@eVxvsl z8M0?m!X{R!qeZ0?k%Iv1xN9J=9t65KAnQkozn*v~n8pl@ivoTPBEJ&`1uSRAe>Ql7IbGYPU~xje9YBe{2A#^0f&96&xI z@JRnzq{=;|u+usg-+dc?iSI(^2;Hpn9trr}^La!*Lc9=3P2`}oB=lW5rU`|caMNq2 z&P1jBEb_$)Sk1y3T_0!sNV@!?fG>_Fmy@k+)Ua z1nT)s^)4Sh$~U94;=o6K+RjjK@7C;rpJ{I)xNGNkIu)c6bUU$F}7* z?nfWE;4%1AiVlsNy^M=x%D)jDFxSlIu`41Ol`pWXU1RaZNl^1`{gOQ5Pqm@l(gzmE zd^-ifJ>jT!)ARs>9 z#N&?zXO1}jxLdi&*+wl(3SH?}X~rW=BVYxtMJQ?XeiI+s?dDK70}s>Ml-~G=;pwo{ zqgl0G*GgfSTWH8euvCiLa0Ox_VYSc8$B=(&&6d#^&n=0m)~wdh zf#jteKh?8fo7K4XP%!v5nAAVi+ZoF1Xs*{iHIb8 zYH5SK_G>y9J(#oAgx)*j1ehrNZnXwDI9BrcZ$nmfgywTvc=|93e-ZzYKG>NW8QI%$ z{Cwm75x2skT7Tr~0Y7tfA#gXZs0s|-EP3gjA1-8AGcS0mL+LA*v)h{kP}Ni(iD_fr{PpP>n}w`7mio z1v}u$qa67Xu{>ol1do@zQh5S-u9UBGKZf6WE{4;0JuU&a1EDApkBc)tp+ z@^pBHMeq;C+L`Lv8X2nC+nQOK*!@syu{unF>^X6B*@V+a_sKWBsEE8JVRm>0%GQPX zfoKrD2a#VNSEUx#9S;aB>k27=f|00~aXFDW0~6^YYzErHOm;m&J$V{Z=8&Np_~>j6 z+g`VKDf`cc0?KY5G!UM{Ky-{>*Fhielyx|D6SEG>(T~?b2k#fXF85?PBju$A%Qs4D z&BBoPiF=nOd!}{#AM~mM-VUyUAi{CU*IWd$5fNnNrbo)|W1NTm;m$M6Mzn2@u4TiMZBM;o1RKyWU8AO-+o>$VjuS>Nk#I zQUqNVB)^|Sv)pS#B?At7^8(qbV{l^FpoJVus*Rd?zu1g&sQUJ);#lzZiuY*N!4a0G$Wx=8ZZjj&80?+5>Em4__Dl3K?zPsU~0`Dbg z-@AhDLQWfzf*74=@qo4{P6FEBzO$Kd2pT>X)#}84YnCu>IrPSsW$>geb!~^)eR)_i z&$jyu2{N`IjKq=rdpWiBVtd3=-0+v02ei9H`<=A<-~`QMvO&$MIVR43vufT@YR+ma z>sPWVR12i88z#j(VkA)rfpRlCFExfruDhtZW1ux&1;sS_AOh7+5?B0elh;0Bl-Zps zGROo{8u5-eLFZR2q@KtNkv2OcLzk`jshd7P5|=njr2c0SybBgli(OUXrnMm zfyT$is>s@dUM}ZOnSz86W|7cB(AjK4xT6k(B~V;A2Dzu7xb3{y4MbMz=XIPZo-Fp& z=K$uT-rKEs0qhtg)dr@{=6sgU{ZMWHyl|_mPLz~mH*Flygu3d?S0cKBR;nC|YEohm z>be}GQR0eXlKQfd#q*G_o1&;~iUcc7ISj9&*XypXB*R2yLCrgFXk^{ zH&S{C6<%Hy$y0%T8Rzq9$ytlg&nqVxq>A$2c2B6c;XY4dw6tx&n-A0<-1gWvT<#eFaz#BJEMv z%SjaMj<~?&kd{f|G{SJ;1Sq}L#q0z1ND1W83TldtQZzK5OMz1jfeE-{>bQ0l$We4(SMWh^UH$ck0?|k|Ybb070RRLpEjR zSghQmmc<-UyN??*I4ks`xQ|pd_=?aCLuE;!;dMpsw~y3^ABSY5Cb9jJ0!fhpu&cT90tk3QV>?$*zw}TON8Q$& zlLKv%@y=eZhP%JerdrxtwQ4|~VAZ`NdmO3D>DsPAo<}r9Y|?4%5Q>dB=*dFcbC}t= z7ZN8i-|0xZSUkvTR>lSuyjsp)@iMlXsJ64N=XG-8l6FsTo+D$N5;AEPM6-N2uP{5Y zH^%l7peb5q!o929`NlEgt;zO&vi4KFn%Y{aR}@r&jB+pfo|fNu0d@t6T$Qa3ZH66= zoWCA_pJ5^Fuqg>WRk@$qT{lT7H9uhbo%F#44$meA_D-}|8)QME*3^V z{r)GF`N9cK+-4&8z(}_j)hIa6&D{1LA`>nbFIiTDVWQm3z4m4vC>$O*i!C*yXOOX- z>IQx^$wsr!^2X~|>x`W%hS);Pl%IT~O`L>=2qsELN8+xJ_3pO3E8pRhngR2phglA~ zx7I>wmMkVz$_Th+5i(Yvem!^@qf?QfUwi;e@MGS8?>q;hzxe3$+v?f(^BV{Gi(v6Ha+GH284b)2t^2|zP zQZ^y9F7dLxC!3r0D`or2f2a|e3IxAR*xDc??+{4l7*=S$nOl=F-TsxFjNHH4xWm3%7_ zz;VpybHL2gi69FTXd!n<_lkz9kresdz5aDC{hpiV9+ZR&IeK#=U*60Cf`gjwuM+_& zlcfMKC6j4~C%H%ky-6tNT=BrvGfW$^rf;G~FzZZ$I((rXQR0ml%N+NqfOK6mENU%- z4-&?8EJHMeMs@d99C2nZEFDLOKT1vPFF*UdduCX1n1k-9pWYO^Rn+KC(7BwiyVAR% zfYxJ#K6SvKkC6`oqN<&mi*R%*khek*0>o~|STt_7;su{?b8o(08n2UIzjI7>R5+M@ zGB_xrHCmV_evG|KqM>PLoK|2_X}(JTPTa@At zti}fq=(^P9qnrb!B06L^q+7<2#3<0->HD_168R>*vwSb}X=3^w-Pz;rAkGgANW>3( z#oFj~VFtA-BpnmeAey?e!OJXato$QD0Q-cCM73;7b$8;~@}qzEYShda7ni%3Ib&}(Kk^qEt-fz$zG}m^!w6hPk$m*zwcs*)%X2^nDJ$}pWx45;09AvOw*kO z_(25`U}Y4APdl26lkPdjyWxt@SHO^%NUh{;JVWBRs4Rv2YBG^SEfa9;lx= zgSvA;;o5=rH!D|Nr4JyU0Vdq9t-yD+D)twLf!hwAk+MUX90Lm)uS?k8H?7T)Exwl0 zhChF<&3n(VRHNEU968?RSP#fAK7TPQ=021xp;RNrd^*yzf(NW9pVmGuUhORw*Rjm; zx!Qr%&|WLxLJWZKm*T$26)ZGwkU8G<8ypk;-7(5nB7|KZ?(Qw%4188@=RVB7ac1Vw;ag$(PIG>~wC5~xo=SzL$rZVyQn>uxJQD7g*^KW-Qs zvJZoqU@nBDx)qHNsjJ1kLIGo?q%VEDxG~@SV) z-8neleKHAh3vf*$88@~%YnB!Jvhx+gutJZ!<1>Az6@%FY6)+{dItChR1aYfL%y3?c zX`yeH3&7;g%|bsZ)7cs_IdPaerG9pLhh`)C@YWC2KoEEm#3=e@RpgHHkpFKZ5LCE9 zJrqt%UU(G3{gs${5Xk>EFW>#x!T-z!jS+jX0-vSW2VGIpEEbIW;1&XDkwXO@Wh!f( zT0mtCmgk~Of;2s!#z^LDR=CYVyN=V+MBX!Q8P}X>V4`bd`6nvaMu~kax7Sk%I@wyj z)-(h$#CCN9{AZ9t$Zl5T*_17)qL2mzXmqK~GmY8l=SZtj86Tm&EKIBpI8Wr`ei>H@ zq1?TCh}f%zHtv$q%tH-$6vheW-x< zDnfY4u8K4GR@|M7VUGlL0l{SU5ZvvqlikF7Rl^$@VLgcxa&b#_xzB|gN;p#=;P_K&WyZOoB0z)IJ5py zph7@ogV#*{e#q%}`u)wwlcL<80scIx@hgBk+$w&V+xT7Z&u#Bt1x?}Yvwz HAK(55x$f## literal 0 HcmV?d00001 diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls index d1b01472d316f509f037976e9cec613599012f6d..b797f92f285ca83ecb5ab49a1efe63f57919f11b 100644 GIT binary patch delta 2787 zcmZ9NYfKbZ6vyw~2T+8L6m@IOO|hv~T+v+w790>%Ku|zX5Ks_yVYO6b6?{Og6|uHj zwZ$GynwUoWjv|^eE7TWA8zhZu+pnhaL(}w=@k5iErfn=ebN9e9vy(lU^Sl3Z{`WDn z+kMvB{js&z72m|@Gm|mzH#xc1*^LPPo0yoG{5I>kcE);oq~*-`3>UwimZp?b+-z z&fuq#qu?sDYjvf9D?hL~(Tv66r2a@@?0fBa*;anow{f;UO?C(eI9@*|L~;wWu&1$+ z+{&!XH!Zg@8}luUjN6%=<#x@P>KDbLSl_(JIJ)z`m~hT4&+9r1d!RL!ca_hLvCL%m z5k#{ETp!5e3e#Cg`|;uv>)~g(k@~QMEyCe `Z6V5D{C1S=cQK+kzKq!Csw`>8%%Frne5k;1}LxTm|Ng z^~iV;_3^k2!4ziI9Z||ccrm8seObfjKNXR!;`-Lkh~#z@_h~o2`rM){rVY@`9n1+k zFD3IOaPE?mr@$!2rSJsfGMIbW$z4!@(G7bp&*Q0Z8sl=fba|dg#U8^rmuOtgOL*Dj zX2sxC94rlfmFj00(_wC3ME#sW9V^utP|>IN-i6TvC#I=q7}WYfIanr)O7$a*S@8EX zb-Y2XKN}9V0^C>h-lZ5-Xt@%Z3GU#udE?uN>TLK_s_$UTfrr!72?q5GQoRxq`t{x^ z7;~YxKhitVpq?ewd2poP!&kwLekWfIzhhhj30IvwA964jKnun~ICs^<*TMsgMPR?? z$C6@NFQ+WQt)CdgVO^ZeEr8Tmcz3Fk6J-TyFec8MtMka_)uBo zVkeJDf0`X^6KNNQwGhyRQc3JJV&{=n5nDuTTodYMV#x-dWRuTg=~GSG#Z>=tP$)IT zoRZbTdSqLOEg^OwDEL-57j*JE7!5j=dKzCwULu|*O zP`4AyH27qie6pm^4$@{({RsAao!AOukCC+yQ;9i-g!%@tY=cj>$tOqp>?Cat)dz-z z(n@S4vGd4w5z7rTZG7kxi`qso&tQ~iGFl~#0;F9Bo$wt(t4+!D%OVui#GBHKr7EwQg}33WfQB7;wn$w&X=cCZ7aEvEVj z?Ab|d9Wm!^p>z>jPpta3P~Rk0V(=+3`IJhZgQP8``fJ$pEn;QFenEDK*al+JcZB*j zv2ue?xyh$O`Wz;01=Tm)5lT0)jl@nOJ3?#|u_5&7Ayye?nCUN2rOBsC`Wz)~71b-l zLV1VSW@0L`W5lY7?HCs7yTob?J~bwvTIus1X=|x|1bZGQwuRVZWG9GiCFU3r>ifj% z3_f)xpL*$YlCSOc-~kzMKs#2O7gjV2$j^!bpq-btUkLg^*u zoAg0;hFDXWY2$aZIP{M0hF+U{;JZv~y#D)=hu`k(``^Yw#aJTLjK#$SkDLwO`|Tlz Z`La2+9ekf?$`HNU5cjN|0q{ zNjej+<3O<^?iL`pXc}< z(D8}0z}giPElXkQjQ1J@Ynk8=_ybd2~Gc8IONbGUSnJ;AV`u;jtOI)nY_#8u z)`HDfn)9`$S2pY5dKK5JxtY>k4>uFD4qh~k4PZXW>P62*b3qs^YmCv(eot9ilm5KW z)7~gXF8X+bNFVSSjks?iS`7o5rRmq2xw6>`H&=0UH8&vL zZEypaHRrNvJO{QMto*VWje-T0W>9N}Wb=8rA;k@8Zk}|v!_C92+cbX%*b1;wVlRNL z9Aj3-H=j9zF9PN(gYvaO1#-|%xCMwlykZ({V5`6~2hHd%utKF-s5OgZvmI`c;udLc zv2Xl}_)(p$$TX4gQ8`j*7(mf1!BWBIHZW?ccHGq|0H>2->H7d%8`0cN(tQ{1Cd|4`^N)gU1{)>z9@rMJj2kcRk5J{P`Ofa}%bE Vj+-OAS?nF|avZ#3jSf$6{s-1b_H6(F