From e686e84512ce1518885750899ad543fb32e03253 Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Thu, 7 Sep 2023 12:20:28 +0000 Subject: [PATCH] Bug 66425: Avoid a ClassCastException found via oss-fuzz We try to avoid throwing ClassCastException, but it was possible to trigger one here with a specially crafted input-file Also add SXSSFWorkbook.write() to integrationtests Fixes https://oss-fuzz.com/testcase-detail/5185049589579776 git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1912162 13f79535-47bb-0310-9956-ffa450edef68 --- .../apache/poi/stress/XSSFFileHandler.java | 9 +++++++++ .../apache/poi/xssf/usermodel/XSSFTable.java | 7 ++++++- .../poi/xssf/streaming/TestSXSSFWorkbook.java | 10 ++++++++++ ...imized-POIXSSFFuzzer-5185049589579776.xlsx | Bin 0 -> 9053 bytes test-data/spreadsheet/stress.xls | Bin 69120 -> 69632 bytes 5 files changed, 25 insertions(+), 1 deletion(-) create mode 100644 test-data/spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5185049589579776.xlsx diff --git a/poi-integration/src/test/java/org/apache/poi/stress/XSSFFileHandler.java b/poi-integration/src/test/java/org/apache/poi/stress/XSSFFileHandler.java index d8c11089060..1f75723c66c 100644 --- a/poi-integration/src/test/java/org/apache/poi/stress/XSSFFileHandler.java +++ b/poi-integration/src/test/java/org/apache/poi/stress/XSSFFileHandler.java @@ -28,6 +28,7 @@ Licensed to the Apache Software Foundation (ASF) under one or more import java.io.FileInputStream; import java.io.IOException; import java.io.InputStream; +import java.io.OutputStream; import java.io.PrintStream; import java.util.HashSet; import java.util.Iterator; @@ -54,6 +55,7 @@ Licensed to the Apache Software Foundation (ASF) under one or more import org.apache.poi.util.IOUtils; import org.apache.poi.xssf.eventusermodel.XSSFReader; import org.apache.poi.xssf.extractor.XSSFExportToXml; +import org.apache.poi.xssf.streaming.SXSSFWorkbook; import org.apache.poi.xssf.usermodel.XSSFMap; import org.apache.poi.xssf.usermodel.XSSFSheet; import org.apache.poi.xssf.usermodel.XSSFWorkbook; @@ -115,6 +117,13 @@ public void handleFile(InputStream stream, String path) throws Exception { // and finally ensure that exporting to XML works exportToXML(wb); + // also try to read and write the sheet via SXSSF + try (SXSSFWorkbook swb = new SXSSFWorkbook(wb)) { + try (OutputStream out = NullOutputStream.INSTANCE) { + swb.write(out); + } + } + // this allows to trigger a heap-dump at this point to see which memory is still allocated //HeapDump.dumpHeap("/tmp/poi.hprof", false); diff --git a/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFTable.java b/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFTable.java index 535683be6a0..d9f71894462 100644 --- a/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFTable.java +++ b/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFTable.java @@ -803,7 +803,12 @@ public int getColumnCount() { * manually add cells with values of "Column1", "Column2" etc first. */ public void updateHeaders() { - XSSFSheet sheet = (XSSFSheet)getParent(); + final POIXMLDocumentPart parent = getParent(); + if (!(parent instanceof XSSFSheet)) { + throw new IllegalArgumentException("Had unexpected type of parent: " + (parent == null ? "" : parent.getClass())); + } + + XSSFSheet sheet = (XSSFSheet) parent; CellReference ref = getStartCellReference(); if (ref == null) return; diff --git a/poi-ooxml/src/test/java/org/apache/poi/xssf/streaming/TestSXSSFWorkbook.java b/poi-ooxml/src/test/java/org/apache/poi/xssf/streaming/TestSXSSFWorkbook.java index 6af45425255..1f57111839d 100644 --- a/poi-ooxml/src/test/java/org/apache/poi/xssf/streaming/TestSXSSFWorkbook.java +++ b/poi-ooxml/src/test/java/org/apache/poi/xssf/streaming/TestSXSSFWorkbook.java @@ -33,6 +33,7 @@ import java.io.FileInputStream; import java.io.FileOutputStream; import java.io.IOException; +import java.io.OutputStream; import java.time.LocalDate; import java.util.Arrays; @@ -725,4 +726,13 @@ private void testUseSharedStringsTableWithRichText(boolean compressTempFiles) th } } + @Test + void writeBrokenFile() throws IOException { + try (final Workbook wb = _testDataProvider.openSampleWorkbook("clusterfuzz-testcase-minimized-POIXSSFFuzzer-5185049589579776.xlsx")) { + try (OutputStream out = NullOutputStream.INSTANCE) { + assertThrows(IllegalArgumentException.class, + () -> wb.write(out)); + } + } + } } diff --git a/test-data/spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5185049589579776.xlsx b/test-data/spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5185049589579776.xlsx new file mode 100644 index 0000000000000000000000000000000000000000..b14f41fa57475bc0187df8fe3609d89ec3ca597f GIT binary patch literal 9053 zcmb7KbzGDC+a4fYqa~!ILAnK`8>AEjX@_)X^5QGc>5CA9udQx__ zV2~}?P|MvOfDYy z#JN{ifW5(~LJ-_47DbM~fgrgs6viKJ(mK1jQj4WRphn|SI5K{5X}w}9GIbAB9qiZf zK?@R_8P;s3N?xznJ~l7vgO3+msr#&7lI76PM7XYroa2y^bKW|lkSXk}D*ic<8nbc= zYH!-dU`4#kkZ1cWdc{Otp>sRxX8rg&PYOqYal5RGmYN#-wF^tNvAGqr9u^ChS}gHL zx!r^ndbXt(sNwo)P^{`+exiK3RV1cJWWYVpe4ueICn~KiR(NL!f>H&dD+r+tcc-I_c%^xWR;BJy(7WcIxfnNsZBri-*SYXUs<41IGN3cpvaR11 ztVl+k+;9e_bD1~2OdRL}17Z&8jb=>kr0ctaF)~&NKS@oV!Y&85$m(<*D@xZqC&>qu zy!xTYD=~(VfU#EJa`V(1p2Pv-%X^E_(h0CSy#l)?6z_mrPyz5Bk{X;h47keyfY;6f zcfY;);|U$k+ao(uHAg#pCysAy`NEm{8@9ee{Gh&U71R|1r=A%J003TvFt)e<9q*|c zDt42cSdF;jzMNpYN3K-Y5g)WawOuuCMQq#bPf_la1a$)+-270UzCj&TwN*WN^LXdW zK9jTS>O+1bI&v@OC->O7_Zi-gZY%BTcsCx?ahvS$y_&5cl%sRVpMj}QUiW}l$5hhI z6%yWZYD$Pzj<_+v66u}HOXJd92=OFM?jUQxUCxzyx5xkPj-m+X3E4W-hnSGD{h;}h zRTq`#Bs>4pIHPE3QS&UzWM==f2EtEHGq<^cW2AJz8imHu5m+5uI zqR4tRHn9Xh<^;b+kSkcs&7=f&aK1FUX~DPSA>K-3_Q*G1&@TEA6HN}9d!1T$hfTFw zlgoIFK<=EU?Xe|ZQhW-O;GtvUIBcw4T7EW}>G4f;L%kBV+c{Ky#I%>K4i#V#cOYhT z{h;A)&y4%9;RJNxU{=%5QFf-pH?I?han$S<_4#$7%Pr}WVdUjkD^40=91l%oulj3v?&wV%O`bt#t<&$?OuxT9AJ{qY1Y?-BfwGSsP3#qB;$oX&}{5 z5qRC_(}D_8i8Pl`Ly^@fd|M>D9r3^?x)N9y(@=wA2|wg{eVZ!u6a=HK#V>KZw1Ab; z-2Uj=+0KwCV~RF1UR)W+=XC6)V63d- zAeWc;e#wd$3?e(`-kNitX>XJ*(ew{TCSoiu@ULl4<3wznikmS5CObu0sIv1{+OhcP zGviW}9TiF9U&L1Kez6kR%euVwK9uH?F##fyf*0-Qz14en;Ov{*|NbPRz};@>2(tb! z$FSxe=goEaNmho_hWXd$*}tOvtMbP7S+;Uw`E3U_1`al=PqbXmR^>1qn7sZ0$-H(? z3cq*UHW7B-&^nH&zh*4gJCuJ{a&k%}@>3Vh;XH3i1U}*Io3*Z`Aumtd4*)C-jtR03 zC39_fE+dzG^`qggZ`z8}b4q{7QybIZ~Rdz|P?hE9-shIPw>8>t2Yt!(Jr zfg+3q6dvA}8lSwacF_Hq&)On+dMECAYa4s2g}(@+OTuPP=tC-v^n7)`;Dk67)@Az8 zo3TeSvPfwH6A$h7kE#V7XqCbTe#uZjKK!d}eoc4q58FFhz%!nsCI}3+uzmbrm_r=H zw-zz;R}>L%kljN=%%8l1wz3g^3V@LaB9 zZ141!6nypA*XtLL1#3*IE^q?9QNn#+oFTkwwxlYm#m6tzDr|mI0Cg=bE{_QzHJRS{(2O4qzL-tru4t1VAG=z@5C?Y#e~;pI4KU&@d?f?b{T)1sF>ykw zv~^)&wtX|jFVQXmsEqr!=}WI?D9C38rMcY)cat4Z5jY1T8OMp~5ps_9!${Imn~8aP zEs&pwzMOnv$-DDtkKb2qk9W*NmV=(7BglKr)G{+8VUqFQW4=?^j zZ@y-JcnJSj$$5%i+J6cU+S~BVPj(f;)y~n%#Lmv@Yl!@R6iBs|6Bx8D-w;^iI-hff zmMPpwokRIb+zr4w-KI`3S(%vLAc~2ctaz`DhS7>~BI(_3i2#)p$24bN|7~QMgg|j^ z&*8fJElLOW4w$qtF0x0{nE`kN);*uA4hRmD-IzbH)3va(Gry3YQ|-~xqX74KiFX>3 zQK71cblgYL-v&oGK3fssRu#<<*(21;rnc>)53|JjLS;82s2_O*^SLoF7><@?zHyA0 zHB=#^@gkk)5W!v8r{jTP{K+?uOG>O2jcZ6u$VE8Re$L%N`2X4cy)v z?@`}*L(x2v75qXt%RR5lJN?jvBec2D9JMfz1#{y1u19qD8a0)hXFp3Gk_D-wVo z*B93Sfa~9Bxq|Zzj_a?(`ws1Shb0hH>+@jt>V;ye&QLK7wv3Zd}oz&AW~| zV6j7g6|VWwnyZ6fWu`&{o!HFO_65Umz4lnxtswJ?TZ{Hj6%a~WhHBR(eSCdhy?#a; zYpXP6gcaVKS|4>h`BEG` z6sjh-wRQ~Lrr}#<4#Q_@v{)tIg8Au>wfT1j4r0H|v=TRf-J&L=M3SR|2$!`mc?)WI=41CALYLuRL>U-G$pe@ zOk9qEXlBY;AKn%AjC=oC?5S|!)HzzKLO~cNFl+MJ=Q(;JpBi8n386H?)AI>v_ zaX5s*Ehkiz@1f^;?Hu<8mHdcL=W&!vo$iR_C5a0=vjZN zWA<59#>51-)TS92`d*Gww1I-sZmT(r_DGPC0hbYf+<8oUk}+9*{i!lnL?IzDZk#2| zRrQTD<`b2qR}4}tn3lJCSGhy9DY|Wvmq(w?V6EO)uG$uj_ijRP5(J%K-o}=~+JE|H zQnG~PzF_-;GEo?a?!ai%b%oK~205U9WAGwhjy>jC4^QE!RBz8J+wF2aPskbl+I^~3 zv0tir_7K1Ie7Luc;nyF&cQQA21U=FO!wZ(jKeG5g2!V5y1jZXqpv+N#D_Yf9AuVle z4rU9%DuU$g32~mn)WX%x(kEyEP~2^AF)zJo4Xd*EN^duexHy`D+I3N0F7_fDkI6Z+ z{MQG}7*JjDna;r`GVdXJ#Hf*$FJ#==2C zc?F=ics%SIK3`hgU$vUXQ&aD2)*|W2zC8wa@;;zzdzzZ98UF-^*N5LF!$S^j#iGQl zN9VfHi}Ci_{Cfbia?pq3Y`iF-;9C{4dZh(XS|5#mM+xc5K>4TwOZg3ZlNDd zoASCL*B{GA;|`(=0Q?~lQ3=M~(Z*Y80@{i}+N&%c-p3DCZxMzN$bAAWv?vaK_Tn%v z-?$xoZu78w8q=etC+%7@6FyJP%NIWRAJ$GVOAuMu`D*JA%B&K1o_M=r&K!QWL*Fjj zohF9O;EsuDiMQvL?}inVzoP_3^q`#B;k?oLg(`%s=uG zYV^I_pMFQyuEcqx_{lri<@~nY9b{k8ldTVd<@;`V^S+mBRWm;48n}xrJ8NUOmu_b} zYXa$)$E`@%4XG{u7|_X^yCKSt^wnjj`ei6L?fjiB9pL zVT8f6WJ|jE)eVw+wP8rgtgYSzH!nPTPeKZcPp)-)nkCsPQ0p2*J8=gv>2Dz9TBgnJ z=jM867o2WKyoMFLI*8B(^QyEk8K|voL=fQ6_4(H(B5>;zY+k93RvP}e$hDij3xTj#8gTU`Z zhVJ#V-JKj%E?-N1kfTHw4`z*18{!O+s%92j&=G*1sNL2jJLs4UtEtl`m)EuRH?3HH zX!tyQwi*O!+f{qWplKYvvu8a_SN82#I5?!aX8%!+j5ugh_BZ&a1|q z4a=(4d0F|NdVq*LJ)sS6dPb`DYHG?pyfA1`YB&zbP_tSstn;wE=h;b0i55Q>fYBuM zY|yK9%818GW$7Wao}L}!>TGS-S(#v2KicDVQ$GTSXdrt!E6Fo)#l(@Npuh(qdL1`< z?L0FVLivj4jx5vGAJl}*xLDcDxNfG|=}kpBX$uB-hHsLX9<`riC2<(Q~JYEYzDB2I5FCvsJ#4uZmIHes@#1_HG32*P_>ji=)ks#{3O!s zvJ4@LZrrLqlVqQ)rWvO-nM6nET(;`|5k>yy$Yf;N7_5G$=K1lS@0vlk)zP=y^J5%( zCyp&*5?-1l!kZ%8ALYrP?a;qoNMrgRVmz52j|m-3^t+7z^m@0 zJXvC6c0>hti9y$GwK5Hoy2XJAGrX0B%ebM9iyS&3Kj$~Av3c1+_yZrcB)1h$Og}Rx ztIdlH6UE6&DZHCqJwH3I|1dayKKfi#!q0`?rok@XVZ#mSNnMPE!~%3er(Gn$g`|EI zvG^g<>@!FeU0pa4L9zjw<|%PVp;e2qge@fVF;;W!>lsiQfMALZx4!1NeeD}TaoicBBgxKG+ivBM}WSMA#O4Eh_tP2 zSK_{l<~6Wa`_^6KFzF*(Dyb-p)9KfrMkWfI+scZo8L>=L6r#2yS4oH;#LRzE^Bs=f z07#JIGAPKvoYNf0k+|{k?be1h?-a4@nV;OIHJe;uCZUlw`-sbp-gir9%LW*9AWcw8u+FHT zWAZ~onH(4v+I>9;NL5QU0H7^Ih=E#mt@lpS=U`g)bK&NpKt(Rpj5pWj?A=HR74?|G zJ*K%Yie|TZ^O&^@JBA8QYEV78OoTk2i$sqayj;IYj=$4>U9!rUiP?bEnf0uJ|fOkpQ1luF~B%u=lo`x>03om+oNGisI`wyNh z=^XBOOFtW#A==gnpf!*Px|E?F$y{`}N#R)95I-_~E zGv985@FXy59rFPm0&B1qh1K(-p<-4UdjoRdV}sSxo6)8$YQ3CuAB5;AiaYZhdAeCk z){?o4ToW*bM4%rNBv~5FsGZ5N9BNl;m!^4NGF^ z-%hd)QdL8H9|GQETEvY>rssUoo2;^)-cMi#M1Lv(HH%ePG9Q2ToGuLQtpe1cl*x=i z%SiP@8FmQ6Y>k#3L6Ku>2JemLZO47p`=))>o{S<)B;`Q+s;LrA=&Jc z1oF@CEBD@JjSd`t;LU#(kH}NiLOCcWeAvJ!Z#UZjdvQ5*QNkZLvFX6@W?5J0F(S27 z`Khur)a!MJEnpNBRDs%h)abT6Q)@5Xs##|D`C7|?QBmYVW<pf4HZ<$DJd(r*5cmlk2;*SH|YB}l6Bwr zEv)etj?6+oapq})BnnupMx7sz-@uVy>=^V~lWlGHs#7+-vrp3GN%i#di`V!&iv8Qy zRV`5-6tUJ4T-rnE3j{2d^e)9+3_U5L&eoZBrogkPTlPVnTW-8zA9*p}ESU>7g%1_v zi=I3`Y(5H@WfDs^??KNF5J_zMB$uhcd9H*v4I`M|z04aQrL#Q8?V!{pjDq{jl@r z?dVlIPp`uLwJZHMBY&X&yra8{+6$MMzl{8`vHLgJzrS~spYB}}-U|OYsQLfh_|N;O zt0o5gh4sg9=J&?^@51IPF_kEQ@9P^l(A7l**Y_V6{2Dqx&quFX2EqIW^y{>g^SeU- z-ppU8xP(9XkO=2j^ndUu=il4?WAN4N2cLXhHQe+cp#PYIx&JkWN4`AyI_UXL(EdC$ zy81;ixZm#KZ$?PJc!&S$J^UGAg1`LU;3|nBz;DQZ&S~Iqf1WM?{C6T;+(K6YubhOR z%Al*JT9SST{9agnD~kB}_;`4KPv#HwpOf|v^gmSLpI&nO$;iL^=}LnC#X*0Oj0}%n S0DuJk*M|xKm{ETH@BaXCuXAVs literal 0 HcmV?d00001 diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls index eeecaeb553fe6759a7b38b6c57d6e4534cd01ea1..b4c297fe284f801b2baba24f9051e236e416cf66 100644 GIT binary patch delta 1157 zcmZuwYivtl7=F&#>9o6#y3f?aEiNl*opy$XxU1V_7=pEDOvYxdX_#~uN+c5;L6Go6 zL`2*UTf{BeF+U`mOWgi2{wNcKUu2u7YxS3&JbB*t?e{+4bKdVeHK(PTv(lj@!uD%R zHNmhKKv#EncR))O?+Ynjrd32IOX}-{qq>T(uNv#sZPGsRWta9_dX!*5VnJhl`x_xa z752;54ad^W?_p%iLM^-cS1AE|wIA{jlUO`d%UF3ZTRmKvZ?sOdSQKc3GZ0!B^%{e|QFFReAHO z6qmQWGRL%KyT@xPR!k-3Wo6|%6t_v;>B;f;13VR#$_BS*lcIQYEwasKk97Mofq7fq ziZ9P(9%m{j-Kj9>#sNW(lnFozz52*La&9gm0Ci?U1e}uy`fRWeiNGH#(F-^z69&dM zA_=hP0e(A`TvLg3pu|D+29jnFoYmx+L|@?69AY3hn@4bH&*l?ZfPNv74HP^w@sEMr7(As6(jD{8z0Hbuk7jg^v#d7#@l@1*%fGj$zSOqLh20}%^85-NQ z23V2ClV1zGrNNWyc`^i-Oa6A-9l6yLrHzu$$~4pCwn5 zUz2Z;`zZOqHwI1x7}FovM|P1r$dAb%N`QL2RQi9nnmHqvsw(Gm%*z_6uSnS0*rv)+I(GS&wEqEI=(4 zqN@^PtAY^^apfSt5C=T5o*<~~k4p#R(m_O|XUCUCr0ZhRLHv{EATSN}G1DPRI}!QT zB6dQQcJ?SoGl>}o9s5s*>Da@*SA5Cja}4rP6nWG^VOv@Vygw8R@zLpy*Xo54>fAs- z^;9^`V)+Ox@8DJZ1sFSlHC?=t+)AL32shGu;>=nK)DiW>9?kIir=Yfl&1!2PSxfGC KIOKeiApHf8tpWT1 delta 699 zcmX|-TS!z<6o$Vup3ynx9n%qYx?p5rDV2={g%NhqG__E(i`JxK4{D@hFz7TTqhV4V zDM6uv5F&`|RM6GzLAyai23bKOMPWvk6@gmQ>ZP+ee5}p>_xkp7ol{-i>WN&Xwl~jE zw4=ZupU>B91e^MlpgJjkOIa_}hy6OtOmM73KcIR{Ju}9XI^d_dezmohjJ{I*^lvTp ztJ>*MtJ4yR(;|ugUp8Kkl4J~6y*BGc=fCYhG8!CZHMN!1RR^01qj^NXY%ef7RB#zu zTKrs7yUj=}YPU7{a4QymEQTP-l`eq>VRSMiE3iKW+$Km}3fU5_TMozl;aw_B2SB|Y z+BK=uqz;66t6-&El(iZhp^%dfd`ClrRjhh6Ym1e@F?@``YHQwq<-G;yy4#k51%BHZnOd@&vp4hqBeff^;3 z3e$xxLZ|S)@S1R1I3Y|egGJF$Ep!N92pR=J(4> z2is)yU0}ZmBRAmo1E}!Aj<*m#Vl;Z5gem<-X6K$f{o`1%_7Z=pB!-?jo)*%F%m9Tx zS!VN@-auu6etkS4LLG&KPtZLH@24PXMsM_FXouynTmB