Bug 66425: Avoid exceptions found via poi-fuzz

We try to avoid throwing NullPointerException, ClassCastExceptions and StackOverflowException, but it was possible to trigger them Also improve some exception messages Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62698 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62606 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62685 git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1912707 13f79535-47bb-0310-9956-ffa450edef68
apache · Oct 3, 2023 · 360c05d · 360c05d
1 parent 105966c
commit 360c05d
Show file tree

Hide file tree

Showing 5 changed files with 14 additions and 6 deletions.
diff --git a/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFGraphicFrame.java b/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFGraphicFrame.java
@@ -67,6 +67,10 @@ public ShapeType getShapeType(){
     @Override
     public Rectangle2D getAnchor(){
         CTTransform2D xfrm = ((CTGraphicalObjectFrame)getXmlObject()).getXfrm();
+        if (xfrm == null) {
+            throw new IllegalArgumentException("Could not retrieve an Xfrm from the XML object");
+        }
+
         CTPoint2D off = xfrm.getOff();
         double x = Units.toPoints(POIXMLUnits.parseLength(off.xgetX()));
         double y = Units.toPoints(POIXMLUnits.parseLength(off.xgetY()));

diff --git a/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFTableCell.java b/poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFTableCell.java
@@ -766,7 +766,7 @@ public boolean isBold() {
                 return super.isBold();
             } else {
                 final CTTextCharacterProperties rPr = super.getRPr(false);
-                if (rPr.isSetB()) {
+                if (rPr != null && rPr.isSetB()) {
                     // If this run has bold set locally, then it overrides table cell style.
                     return rPr.getB();
                 } else {
@@ -784,7 +784,7 @@ public boolean isItalic() {
                 return super.isItalic();
             } else {
                 final CTTextCharacterProperties rPr = super.getRPr(false);
-                if (rPr.isSetI()) {
+                if (rPr != null && rPr.isSetI()) {
                     // If this run has italic set locally, then it overrides table cell style.
                     return rPr.getI();
                 } else {

diff --git a/poi-ooxml/src/main/java/org/apache/poi/xssf/streaming/SXSSFSheet.java b/poi-ooxml/src/main/java/org/apache/poi/xssf/streaming/SXSSFSheet.java
@@ -96,8 +96,12 @@ public SXSSFSheet(SXSSFWorkbook workbook, XSSFSheet xSheet) throws IOException {
         setRandomAccessWindowSize(_workbook.getRandomAccessWindowSize());
         try {
             _autoSizeColumnTracker = new AutoSizeColumnTracker(this);
-        } catch (UnsatisfiedLinkError | InternalError e) {
-            LOG.atWarn().log("Failed to create AutoSizeColumnTracker, possibly due to fonts not being installed in your OS", e);
+        } catch (UnsatisfiedLinkError | NoClassDefFoundError | InternalError |
+                 // thrown when no fonts are available in the workbook
+                 IndexOutOfBoundsException e) {
+            LOG.atWarn()
+                    .withThrowable(e)
+                    .log("Failed to create AutoSizeColumnTracker, possibly due to fonts not being installed in your OS");
         }
     }
 

diff --git a/poi-scratchpad/src/main/java/org/apache/poi/hdgf/streams/PointerContainingStream.java b/poi-scratchpad/src/main/java/org/apache/poi/hdgf/streams/PointerContainingStream.java
@@ -30,7 +30,7 @@ Licensed to the Apache Software Foundation (ASF) under one or more
 public class PointerContainingStream extends Stream { // TODO - instantiable superclass
     private static final Logger LOG = LogManager.getLogger(PointerContainingStream.class);
 
-    private static final int MAX_CHILDREN_NESTING = 1000;
+    private static final int MAX_CHILDREN_NESTING = 500;
 
     private final Pointer[] childPointers;
     private Stream[] childStreams;

diff --git a/poi/src/main/java/org/apache/poi/hssf/record/OldStringRecord.java b/poi/src/main/java/org/apache/poi/hssf/record/OldStringRecord.java
@@ -89,7 +89,7 @@ protected static String getString(byte[] data, CodepageRecord codepage) {
         try {
             return CodePageUtil.getStringFromCodePage(data, cp);
         } catch (UnsupportedEncodingException uee) {
-            throw new IllegalArgumentException("Unsupported codepage requested", uee);
+            throw new IllegalArgumentException("Unsupported codepage requested: " + cp, uee);
         }
     }