Apache
/
poi
mirror of https://github.com/apache/poi.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bug 66425: Avoid a ClassCastException found via oss-fuzz 

We try to avoid throwing ClassCastException, but it was possible
to trigger one here with a specially crafted input-file

Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61249

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1911501 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Dominik Stadler 2023-08-07 09:42:17 +00:00
parent 6f054ddce1
commit 31fd087a48
3 changed files with 45 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

86
poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFDocument.java
View File

@ -241,48 +241,52 @@ public class XWPFDocument extends POIXMLDocument implements Document, IBody {
for (RelationPart rp : getRelationParts()) { for (RelationPart rp : getRelationParts()) {
POIXMLDocumentPart p = rp.getDocumentPart(); POIXMLDocumentPart p = rp.getDocumentPart();
String relation = rp.getRelationship().getRelationshipType(); String relation = rp.getRelationship().getRelationshipType();
if (relation.equals(XWPFRelation.STYLES.getRelation())) { try {
this.styles = (XWPFStyles) p; if (relation.equals(XWPFRelation.STYLES.getRelation())) {
this.styles.onDocumentRead(); this.styles = (XWPFStyles) p;
} else if (relation.equals(XWPFRelation.THEME.getRelation())) { this.styles.onDocumentRead();
this.theme = (XWPFTheme) p; } else if (relation.equals(XWPFRelation.THEME.getRelation())) {
this.theme.onDocumentRead(); this.theme = (XWPFTheme) p;
} else if (relation.equals(XWPFRelation.NUMBERING.getRelation())) { this.theme.onDocumentRead();
this.numbering = (XWPFNumbering) p; } else if (relation.equals(XWPFRelation.NUMBERING.getRelation())) {
this.numbering.onDocumentRead(); this.numbering = (XWPFNumbering) p;
} else if (relation.equals(XWPFRelation.FOOTER.getRelation())) { this.numbering.onDocumentRead();
XWPFFooter footer = (XWPFFooter) p; } else if (relation.equals(XWPFRelation.FOOTER.getRelation())) {
footers.add(footer); XWPFFooter footer = (XWPFFooter) p;
footer.onDocumentRead(); footers.add(footer);
} else if (relation.equals(XWPFRelation.HEADER.getRelation())) { footer.onDocumentRead();
XWPFHeader header = (XWPFHeader) p; } else if (relation.equals(XWPFRelation.HEADER.getRelation())) {
headers.add(header); XWPFHeader header = (XWPFHeader) p;
header.onDocumentRead(); headers.add(header);
} else if (relation.equals(XWPFRelation.COMMENT.getRelation())) { header.onDocumentRead();
this.comments = (XWPFComments) p; } else if (relation.equals(XWPFRelation.COMMENT.getRelation())) {
this.comments.onDocumentRead(); this.comments = (XWPFComments) p;
} else if (relation.equals(XWPFRelation.SETTINGS.getRelation())) { this.comments.onDocumentRead();
settings = (XWPFSettings) p; } else if (relation.equals(XWPFRelation.SETTINGS.getRelation())) {
settings.onDocumentRead(); settings = (XWPFSettings) p;
} else if (relation.equals(XWPFRelation.IMAGES.getRelation())) { settings.onDocumentRead();
XWPFPictureData picData = (XWPFPictureData) p; } else if (relation.equals(XWPFRelation.IMAGES.getRelation())) {
picData.onDocumentRead(); XWPFPictureData picData = (XWPFPictureData) p;
registerPackagePictureData(picData); picData.onDocumentRead();
pictures.add(picData); registerPackagePictureData(picData);
} else if (relation.equals(XWPFRelation.CHART.getRelation())) { pictures.add(picData);
//now we can use all methods to modify charts in XWPFDocument } else if (relation.equals(XWPFRelation.CHART.getRelation())) {
XWPFChart chartData = (XWPFChart) p; //now we can use all methods to modify charts in XWPFDocument
charts.add(chartData); XWPFChart chartData = (XWPFChart) p;
} else if (relation.equals(XWPFRelation.GLOSSARY_DOCUMENT.getRelation())) { charts.add(chartData);
// We don't currently process the glossary itself } else if (relation.equals(XWPFRelation.GLOSSARY_DOCUMENT.getRelation())) {
// Until we do, we do need to load the glossary child parts of it // We don't currently process the glossary itself
for (POIXMLDocumentPart gp : p.getRelations()) { // Until we do, we do need to load the glossary child parts of it
// Trigger the onDocumentRead for all the child parts for (POIXMLDocumentPart gp : p.getRelations()) {
// Otherwise we'll hit issues on Styles, Settings etc on save // Trigger the onDocumentRead for all the child parts
// TODO: Refactor this to not need to access protected method // Otherwise we'll hit issues on Styles, Settings etc on save
// from other package! Remove the static helper method once fixed!!! // TODO: Refactor this to not need to access protected method
POIXMLDocumentPart._invokeOnDocumentRead(gp); // from other package! Remove the static helper method once fixed!!!
POIXMLDocumentPart._invokeOnDocumentRead(gp);
}
} }
} catch (ClassCastException e) {
throw new IllegalArgumentException("Relation and type of document-part did not match, had relation " + relation + " and type of document-part: " + p.getClass());
} }
} }
initHyperlinks(); initHyperlinks();

BIN
test-data/document/clusterfuzz-testcase-minimized-POIFuzzer-6709287337197568.docx Normal file
View File

Binary file not shown.

BIN
test-data/spreadsheet/stress.xls
View File

Binary file not shown.