From b801711afea9d452312a0e23be50bf64d59ea281 Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Wed, 6 Sep 2023 10:38:51 +0000 Subject: [PATCH] Bug 66425: Avoid a NullPointerException found via oss-fuzz We try to avoid throwing NullPointerException, but it was possible to trigger one here with a specially crafted input-file Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=62059 git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1912127 13f79535-47bb-0310-9956-ffa450edef68 --- .../poi/xssf/usermodel/XSSFTableStyle.java | 3 +++ ...mized-XLSX2CSVFuzzer-5542865479270400.xlsx | Bin 0 -> 9344 bytes test-data/spreadsheet/stress.xls | Bin 67072 -> 67584 bytes 3 files changed, 3 insertions(+) create mode 100644 test-data/spreadsheet/clusterfuzz-testcase-minimized-XLSX2CSVFuzzer-5542865479270400.xlsx diff --git a/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFTableStyle.java b/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFTableStyle.java index cbbdef9c4a2..652c377e1a0 100644 --- a/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFTableStyle.java +++ b/poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFTableStyle.java @@ -84,6 +84,9 @@ public XSSFTableStyle(int index, CTDxfs dxfs, CTTableStyle tableStyle, IndexedCo } for (CTTableStyleElement element : tableStyle.getTableStyleElementList()) { + if (element.getType() == null) { + throw new IllegalArgumentException("Did not have a type in table-style " + element); + } TableStyleType type = TableStyleType.valueOf(element.getType().toString()); DifferentialStyleProvider dstyle = null; if (element.isSetDxfId()) { diff --git a/test-data/spreadsheet/clusterfuzz-testcase-minimized-XLSX2CSVFuzzer-5542865479270400.xlsx b/test-data/spreadsheet/clusterfuzz-testcase-minimized-XLSX2CSVFuzzer-5542865479270400.xlsx new file mode 100644 index 0000000000000000000000000000000000000000..4dc129d8f0fa0b54eccba503b933686aded80602 GIT binary patch literal 9344 zcmeHsWmH^i)@Bt&;qDHFySqyu_yvM%kOB&~;80j_f@_cffdGLJAUGj7!KH!)3+}-+ z$dG%xzwVjtA2ah~)|%DdKI_Q4&b!V!&pvxU&%5{0QUf6q0Z;&F00002ICu^-nF0a; zRgXhL02-2sf~$)c)Wyp}*Ut^=X~ymA>_k_DjKul|fb=;3zwJNR1C{z3uJgQDpK)j5 zyk68+B~n=3c<-V4B#xg*8-}d?%u?nN5(<3_2=@#!f$~$G0 z_((q`9a5ZEpQukK)t7+^5h(%(OBKL3CMA%g1cu3+ny-M4HA04q2ixaz1F91Gi!|*+ zy4ZveGA?k6*8ToB%9L!2>U!jjjcEd}JbC0o9n_HNZx9Eo_{0$97^c24k9+L#cF2@) z95>~bHGP(#`u0Rj4!s(GIRX*{XTr5^lJWgRcS{w0QPLvIL%B8<9+25va<^uKtJe>D{kMM(4>>^?^q5Naz zFG)J`7fN_f8j2fu-IrJv)NVaqkI&0YyCpoQEy9Hb-m{Fyqv8wY8lN|3JY9Q-hlq&d zU5J>ONGi6oBx6YEpZK7V{{`cl*3WRY;vHOGyRUxNbB6aI0N~*P1kn1Q*nrTy9g6hG z2Fs7hj`_$279LP1Paf{y$Ny%5|KQaBC+L+a8fqXuyvW0_2gvYeiFtPVNhcn~Z4H|{ zAYb;~bCK+%w=H*4K)6_)js)t+2^*k#lFRO0p0`|is)gvwun~!F15R+CRF@X z52b{C<*rbAr;5Gz=K=}r8-=sy(y^7RMG@Rg4JIimnpPH1bau7(Ih-UMbcMo*KNWg8r85Nf7gK$29BiCC!(OZLPSd8xqwhtXAbaa%MUgm)EHm~-aLBYUsFc+2x3h6m@*@e2}J=w1Nu58{*^U8t{#q7uC9*1 zCG_tZ1bo!d$GQL6R+-xA(9Me#c^LjV{5Z&c(ixg2F6D&fzsNs3C8|nAG2f}vxN%^| zpHr$;tHzC@a`hmicH(_$ZE^tyQXVpnrKAbCea}pI&-B1*ewZ(+pz}eu%7@Mm_p8tK z!N>)+vEng7PN@Qk9+j#~bV~wW8Mfien8S`<)s1jHqHe7?&7JTHxynf|t}fm1Ez%q( z3sstn4JkXtWyP(B`XD_a3iCE;V>ho}dAf7wKmdnsSt#Q}T6f@JMp@x8Pv8}6#ijF@=J=qh9Vt3R1BhODj#^07`ZF>bO)y&))42#y4F>T=V?f&|<%Op3eEm#L3720Pf=qUnib_ z4yw0l%dQAsy#D3nD_TyO&hDJju=>~(brbR;Wd%aV8Pvh>JyVMJ_xMgx4G&UVZ|B(A zd+>M?#$2S^e+3_=m>;Aw%5;ibdMT}SCJ~G;5Xrmpw`9TFvb0tu5#UrM1tr`c+j{pm zdMyIpt-`iycyG*?PR}^oFhNMUvlheeBW$m=D+sQkg5oqH9RV zTUm7RLfJ$EdE2z#1fkZ@W%r+%F*(d2h~Vg&e67yAm@c{r(e+7Pw8pGVu`G27!WmUe z8J`oEFKtZo3)6p0i$1#n78P+1)cLPj67`!6_!(oMC+6)(Or4XKc5$T;4CH>{iin~w zw#FL4$rs^8pZ_M3kmO5Yp{YbjvGIrgf=Sq@Tz`&17gr+9OBqY4naS{};qGtti6_)A zA1um^FFx_xV_jp&P*?(gL0B{1T@CqmP5;cljuq6m^~$Lv!Qrq75++7aEL1cisx$>{ zw@~iG2jio17&u$hDoq}^W%DC(f{8wQjb7z|<=A?1Kx@CYmuSOv_v+6Ci=p7P`Fj3@i{<6g3G@}$ zCh}lvBFWB{qd&@?@iGr)uNSHuPfUxviYj(DF?m{t({3b5{NXv!T<3j?g<(P(Xzlu{e4*HH-A^D@nZ~ z($3kJOXU+q+fK6C{hxxknEWTr1%EuFQp6dPWtX22S1u_>4U zLK*V1w0Tbi*6y>2jj?=PYS#nQ^io-2$C<~A2|qjapF)SVVUXophRx}ZPu7dJ`8O)t zQw*a;x76g)eG|^e{0>Gv-Ugb*wScG4RtNi?5ANrby6gu{ zNnNnR$G-NG;cf|*zXdL1#+e0aZqL{Z!jWLIPud+NhudKmNc@vQn)GiYN-03g;UQ8G zbv%aV6$&P&JeT^$G%okA@Ykq(%qG|GdugM~1{(Xx0$F=f0(TcUYrgbpN~##w*3H*+ zo0gf%sgX7I5lD9NUK;lAe}8o-k-s;eFXmR+-pnv+f?SgrzUF`m7b6Uvk}7 z%N+et3s(y#>if7jv=BruF%)3z?b7(rgCV|bB&V=0xK73V7CDDz%*vOS1}T<5jrp0O z{q^Oq4U7~~U`M7A>jm}PXXWrJChP7blfOqes)AKQR6RqEL{B4 z!_9ENp7=_~w>+VW`r@73reNW1ZeJw?^%m*>X zOK-dUjhNslb^Sx$FcpT5B`GaqK&2#6oL<~>u`Dd1atgQl1YI7*SL{Y6EC}euiiRX` zb;R6}Yo;4eEnkUUS>G{Ehzl=y4!T_oxC;9@iS{cz&0^IrO0#91^BEPm0JO6#@4KW) zL=))VWf3@Ck*^PWzmZ%*m5jHkH-~GfMa1n_7~IjBsAvAIsT*<@?FEm;&Ey8~hxrpZD}r823fM-#(x`VXQx#Z9b{5}t_3Ow_yO$;r6V z(|Sa&GsLZWv@4YAQWD5Af%x1pvibcw+t|rNI)!bdPfU2VyR-^{z7vr>ENLD9o#zIH zkk$nW=BEDmH&!yJpx)RwebS{?1diEDk20lP`Ei@whJ(IjSO%lrPan!i6j^Hxd~>-`vXy zu0Uc>%?gf42a#iv&4b`$zwUXVI!5auZc%H*a^F##GPx{`#f+X}BF}wV^?DMZn*Ck> zWRV~%R6g@n4BOxg6O-~+WDg=RC#^sl{mdl~a7gP$;?CG5vpc~-#`KQJIzGz2d&zE` zI_eMSyw&9Uv4gjV%L|$ZqaC?e;+nY4)XRAbUZz|A9-ac{8uM-U2H7zdy!fQ20oz{< zNA;ARyX0?j4{8J(NKx(#%2Sw~b;vsDc}pt>tr^?eeHW;DwFVBy84g(({Z_wEIhMW9 z^2{K4QOXm=l_EoL_=iYFK(AXonr18-$Es=&Mj?0zg(<#^Q0csYq3_|}Diam*t>x|G za)+4ccRT9OC6AXq)EUb2=aKKXJ`EeHxvmN0wUchc>3k23W7k+#Ia5TJNM=oQh@=n% z=d)TxvXd&ehZ0n(wKi(6@?2W?6zCBJwvoB6=505(8R#cn>6*~?H}@=w1o^1^>ZiVP z5B|n?!X-~AGosYL=JIT3INn^}%vgMwU0{@4LtYv?&*ieWQs<+^@&XL0!&AUxD~-w( z@#I$(t8!(t9A8IzesrDog~ykOF^LVy?t?^BC-+o$KLaM3C%hqeyAy-!sN+X-jeyTn zKJv+=%p^qXQ77jyU&vLF5h%fiTDUS^Zb3rNPfwUE{g<5E8oU0uHoum?3Jew3Yx|IH zzLeeM9dQU*UI-K8(&ZM%;(SCy#?-(5;Q==jPW9M`#{b$H1j8&D5h6b+8bErJh zECACSZuo(Z8Pa1R`cV?9kNetl`l^=;?C*+>Wsg2Q*=BJ=ePmPIupTF)UFjmZy)BK+cE+7Q^@UMfXHz0ywr(u9 zv#O}xT-nn(yq8U%Jk+y;?!2INKlAb`oZ|Z~TFQdrAH40_hbmbd!Ydzu??PD|^JTpV zZ8;EV)M&k`sOm@K{QcL3tFMK2WLB3pKJ_b1-AF8WQb`>Tml9vLvlQA*6Y71^4_&}# zvcvbWCHD^-KNg#Ct0+nJG?c00d`UH-PO}t)Bbj&}K~8@}%MGYa`S3 zb>b5q{t)C!!*R4-GA22FS+X6;(uf!`|IQB9OgfpA3(S&{l%1XuXeF8+ZMyZ2m;P`Y ze$NqZgOw;a>YkUQ!_pb`m~}N2)>2s$mIp?v7-U=L2&HI!vj*Ya^;NMhQqJ-mfLZ_# zs$p-?JtG8A&%=-N`U=lwva1>(Kg4Jwr#}EnaeAXmcEVJl1n9j*A?*$&Z<>o4Q+V`5 zkP_s19as?$#QgO`I?oyWuF9GMHJ^w!eeE2J(f?$R_*kP zEQoI%ec-+z16^fC~;S#3lDBi`vio}!6` zN>1~Q{J;+sJAdj$@4)Qf=^ARZ;7B%0>eg&|7S8nzL9HkRP0XuI^Lf`6_qUCiKecS< zFJ8siY>TH}Mn#W{j-4q|ZPpN9#rzYpDckNXvy9JZ!R=jx7^I99rA)@tX$aC-5qp3akzpW2nSStpe zKi>KASR*q0MV7zoLr;4s)XS6SuP(%&gFkum&mKfu%82G;?HzKc+@`QDp<;q3Z@czg@>e49K^_8;EKTceaJNg>Q zm@kIX33q1mp?v$O5C#qKtMTocaPxZ-{s$ulQ&ME8*dm9bcgH|dJi0=;7vCR|YFPp4 z@ryY$de8J4+2MAw64tTlh$Mrb6g~c#s#{;?YWCWCqwFnMumX!-TGf%)05pCk3n@2` zjo+6+lff^(7mK}%8ruAJCT%3+uF!$x0Jfs*$r z{Jmql{yW=;+Pg;~`Pbs-ZkIIj%cHlL9tDWzFR%S2F@HJiA42n|!y*!gVv+dp6feUb z@Elw#=3in>!bJFgc#q?5%f>T{ks;C-;|xauQfDW)q>$6dWu9=Vl~&`d=H#^20)mcd!auQy#}2Q%Iy zu}##upA821X*dD+0^fLb8;{LKuNPu*KVYcU)-e2>3z5U;5751xUfzjG27`Dzi>DN z!b}&LUxdOogI%36bjDd$t7WkF&?jf8w9ZC?b{jpm?^*a$JNE}Zi+M124=|v zbGEdD@^L%3LG2!9AASJvRFzbe06-uRp!~Q29_9fG05lX7R1`28Dk>^EIvNHR5jGYk zCKfpXAubU$1uYFV1r-$?BR2~jJtqSd6{`pvCoi9%pdc-an3O2LB)5Pd|L=zY(b3Vd zFtNz6vB~%$R1p6EV|(ZT;G+S+05Awh4?w~Pg7AS4Jpft&00@43+utwzHv=MpkijUZ zXy_Q2j}z+g07yU(2niVk1|vVF1Tg6FJ^&dXOaS4NLm||*M5T8p;tx$OL}QSz=_J;f zIARpA@(4r6AR#3qr(j}cVP#_%6cQE@6%$u@qNwy#Sw;1kuAaVup^>q*4b;}o9_HZb z^}^f7*UvvZ;$>u1bWChYYFc_mW>$7iQSsZ7(syO$6}5Gr>KhuHnp?WMdwTo&zYYve zBEC&c&&Y77P&yXk-?m+A zU5{*uN_tX`N08c~VhOK3y;Nc5@~Xxs6+cE;E_=Y5qN1P593c$2b@k+Zyjm0N_a#w8 zFDE`yiKLELX!b<4Qz9ZG=-1|#H)Z!O^{moY112E zLOM}DDkhQJX(AR#pXh4NE6#}mfHqP$;#(F?2IzVh!EbY#!`Vk_Y-NmhGQG9z_+?)9nU?TD80U^r0Xt6t#j5%rFUE$^J)Jj_%6wZd9fw?M2s-T*?0ZB2E)uKwrR8! z^H8wnM{r?Rv4LNP6(*18XdOE~yPbTWDZCW5Wy|g+9K?T3NGvxnW+3na;!XE}@nC>! z9Y?K1Yd)_|Yrl(J089HBX7DRIJ1NPg(%EofSo591X}Asb`lv~s)^ti2f00p}{fw(F(3=PcWu;Yc|MHPCA}Ey!V7C$ii+dDVPpS15Dd!!IiU%ErpD8(cg9Ed7<E*%``kr@w*p(3LHNi3-E$j+2>v zTqN|{y6I!t--k(fQ_ zB7K#5d~Ch@A1=Wk7#y*}Jx2yR%#PWsEu3=HRkiiblRI9l2O%U8!gCtyAWk+P@#3Y9 z=2ychItjYro(H|_wQ6)sJ}OmXoLFL4*J+<(rz)stG=C0xr$xP}V&RTI`NWO8R{@#P zoEwTvQyZ3yQTJ=exwC3^P~kHf!Kc5ovoQ8sOzVd^r*OK>aA0584H(CFU6SeK!+J+7 zhF>V)$mcWIdDfGuAJ%|$PE4!D=oDVz90z%PNc?f1p?4^OWvLS@t#fE^`c(h(oq&aE zWx}BF35^1KRlRw;X}^hc52yHE09Luz^bIQ3jCM=1@MDJLq-!@*wpn$^b9MQc~EdbzA8~z74Bu{t% literal 0 HcmV?d00001 diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls index fd160eeb72089b9d6b6383aae54de8902d5d6607..84b3a84857a6ad5ecfcaee6e2108bc732f4760b6 100644 GIT binary patch delta 626 zcmYL^L1+^}6o&tq-NZz#2~{apqN6BOuxSiwR|QKH8xT=?v6P-%&Bg{p63sRy3Q4R~ zk$SL<7LPqhEeKj2CAd9^2fcZ&K?DunEP|q?h`P=;AztRq|K9(;_g>|eTDh&xtJHfH zz+c<8$3+|cLe#R9{I`;I&5OfRbNqsOgRU%#U+Nphi@S%W=04Vl!pVg8)LRPDSdmw> zO?0uwr?ny1fC?1EH!Z;Eovp$@{JoPuN%WU{BjNphy%Fs|SPMl$pBhJhWOC-~AmK!w;lV$a@=k;?2OJpuK zGRNXJE)x%abOY<<{-=X-5g9vrfF2RZJ@9Q?kn+_{V9z~Z-z-oQ!1I@Y{#IIQe6l_$ z!q=|&$%1&qPYi7FP(NPCmNnQ-WI&Yo;N&c^^zOB%{0D1S%TbKUazhbBVMuF3QK>dc zMW|ak6{#9|RsQz2TrM0(UJ@EEchhA#16yPZ4mr~7u^`F+(N+s>!9mAbHV1vFiMHUN z7jY2R*FoMf$Y&n!;2%D1=orBW`e{3!xgV|$l@G=d<=gGeokuVunQija0DMrYPEGDo wMU|hlyZEX4uJ)n#K>joEbqVPE36z$_WPL2a{S&2WN<3ASk`;2F&{>txe}6TjYXATM delta 275 zcmV+u0qp*OkOY8?1h51G34Z_p0RI2~|ADg&0_y<;{{R2~ll%j41)yyXo28R+1cw54 z^|Sf}#sdj}GI^S%;MoBKlL3V{vI%}J0;G78fHxEZRoIi3H&z8Z1ONbav+*|_AOi9l zvk+MF8ndKx!Vey~0000Vi2wkHmjD2dr2qgovj6}SzW@Ng%m4tf*OLw8P_xv7dk_J+ zvrv>xMYF}(wg?K>05$-s3IG7$0h5u}7?WS33X@yo4ii2C5&*OYod5s;KmY&$004pj zK$W2Z6_b_Y4-2*c000000RXlDww2HUD3jOYBofrw008vj003<3006Y}008{-vkl~R Z9i{{U0+s>+2)7gh0qg;ha15pf0RsBDV^aVC