From 51637fcc435f1a65edd08f30df1d71824b95843c Mon Sep 17 00:00:00 2001 From: Dominik Stadler Date: Wed, 17 Apr 2024 18:15:33 +0000 Subject: [PATCH] Bug 66425: Avoid exceptions found via poi-fuzz Prevent a few NullPointerException Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=66400 git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1917068 13f79535-47bb-0310-9956-ffa450edef68 --- .../xssf/eventusermodel/FromHowTo.java | 2 +- ...imized-POIXSSFFuzzer-5089447305609216.xlsx | Bin 0 -> 7958 bytes test-data/spreadsheet/stress.xls | Bin 64000 -> 64512 bytes 3 files changed, 1 insertion(+), 1 deletion(-) create mode 100644 test-data/spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5089447305609216.xlsx diff --git a/poi-examples/src/main/java/org/apache/poi/examples/xssf/eventusermodel/FromHowTo.java b/poi-examples/src/main/java/org/apache/poi/examples/xssf/eventusermodel/FromHowTo.java index 14d5fbd9e8..fbe4f58822 100644 --- a/poi-examples/src/main/java/org/apache/poi/examples/xssf/eventusermodel/FromHowTo.java +++ b/poi-examples/src/main/java/org/apache/poi/examples/xssf/eventusermodel/FromHowTo.java @@ -136,7 +136,7 @@ public class FromHowTo { if(nextIsString && StringUtil.isNotBlank(lastContents)) { Integer idx = Integer.valueOf(lastContents); lastContents = lruCache.get(idx); - if (lastContents == null && !lruCache.containsKey(idx)) { + if (lastContents == null && !lruCache.containsKey(idx) && sst != null) { lastContents = sst.getItemAt(idx).getString(); lruCache.put(idx, lastContents); } diff --git a/test-data/spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5089447305609216.xlsx b/test-data/spreadsheet/clusterfuzz-testcase-minimized-POIXSSFFuzzer-5089447305609216.xlsx new file mode 100644 index 0000000000000000000000000000000000000000..7b30e5ca9d0a144555b6c590631a8274fb507f23 GIT binary patch literal 7958 zcmeHMWmH^Snk^`-@DMC`a0_lhDp&{<6cXG$5ZonLps)mYhu{(efALRqeC)_wDn2%JM)ILI4^70{{Tr2P}v7>4qTz z058!1fV+S>BwZqTL1C=MKm?^Re)_~zHwxx`9Yp#ZVqm1{7-b9x`@bt*k$47=n_7r<2ePW*I zek&@Io8`Lq4kNqHo^rXk&QdLK5X-TXO;Qo|tVVw|ym2-WoX>KZF1V?Wv$|vql})JO4(Dx%%lc9bFQ3 z;hv076-Kq)5i4Te@m^2C@NT?uMNf()3qarmA0(RZLhBQWJ; zq(E9FtFd5DH2KPYspA?ZbgN0RFCGTghR+z)v}>bM+-BOxcJ=F-M7F1?;pLpWkWIy> z7`9}Kw({bWXXEEs+x_4 zYbN0f!!^(&opSSeUi2d0_3p^SGCGXB2Loem@`5ufnaP6BI$$rbGSv)3BU??~H-(lm zYp6yH8yIs3wi3fWPo0?_f&hTqTOdIB?^Ic<&P8{Epqc_gbXb59Bts{28)r_AA6J^3 zfq$#@TCN+m+9gB_>*7%r6oW6SZldqw68@oQqiAE=Zch)%UzVW4}Vmw+!s zzgN}sLG3*_*L_Tq6vM?c?}`k%tw}w@DjuCLN|hXxgApC2Pu}Ujq%{R*GS2BK9pBao zInv6%8k1c)5?y}nEWW+%&yi(WeBLr5x>^|c32Jt3+}@3+W{B9fKXQEubj^&6$Uq-~ z000>P1IfdN^RIMww|BBOvA4JWk%NAtKFSa3Bi{Z0J(}Z2t$vaQ)&d*%ag4Pyj~8wU zm#EM^12C$rj&%tno-)}#ij!&-@8`%Sfze<2JQ^#!{#3Z%MS^CPp&re^f>D$IR%f31 zT&M*s3ZsG7O=MIT8Hoo-Ir`Q6bt*bvNf(^Z=e%Y>4W8Z4%bPH&U~#0fP5;PooN9WH zY}3^fjx!(%t>?L#dTCO?5}6R-P%1#92#XrIwQg#(llOL9vxrKp(CV`%88O3u_TwVZ{1zH|h?l@YLFLv=%x?7QzBZGUB`Uhptp2_S4{yJdYbnEbWYZvxdl8KH z8Qx$H2hCX=n;v-!7Iq022*v40$S4_YvVLgMcAKLB*Mjlsl?8GWoQG*KY*ZwMccca1 zIH+2w@`mKjqStY^HIxDL9>9dKEhL5mbAX*4S0PeK`OGUSB(^vMIP_@r&dkdiIhA~d ziIN>|4$@ka%~fQs)C>%<+Gkxsz|3)$$VS*(;G_UvS+s9jFbmG%_?NW%6c9M1Uc$@5 zZHO(i=U|A=hfo(OHpLS5YTAl8-D0Pfg zqmvx_ygW~BC75dRI?I+h&-d2PMcNsbG%|&Y9%6qOJ3uA7yhCyON|9r1CTb&3b2=_J zFQ6Ye_pm!GIpqBK<a1CLJ6U zz0W-aZ3ulApm|5F2bmgaF;pF1GWCq1gYQ&1oQ}rJizgc_AqAb79|%1oZSH|=A!WVt zXN0B`p^0R|`6NfolRz$^+VeoLsV^TrUVI2?A|~UU!PHgr0DKB_Nr8mB*2LCWfB9;{ zbu-|=W%wImJF|t(_O!01o6`ka+ee=A>1|i9+Vo5$qh)kx8T;eZlN*_`xN-KEJD+)W z?P^uZn$D50PZ&~kGZYKQA?B6RIDKGv(l_#{XFguT?c~wjf{EWwM%?P>UB0229Sk#g z-$LGMyC0wt@{lPdjm>3W`$EJ*6olp<1la?;b5lD=m_vg_8~MUOQBx&aVc&c>E&yZV z!9)=;sZ3@8KB21|kum`$!vK2%z2r)%Rz0$b=ICQosM`D`S9|mwtQQrTez#lSRgbs6 z$9)bNjikPDx!M>%=%jw|z~U1}By6=KY1#Mm>oj%lqfFnU!vm5v5ACkoi%zBwS67}7 z@p&xokB4z)U7haqhgE>DubX-qzS;Ued3+u%Bb}rB1%vV%h6``7BLfqiV=GZ7zN!T( zuD=^-GZT|?rR?D|^9EeU2zO2K17@H>)}p%^WuQrcCFm=;@fX0EkOd_N1jj+@h*ir& zC=BMbZlcjeY2>Zd(-dafTic?Itj>!C={;SH7Bbo6rC_6oPG-*gdLAE5u)C+SHRBp} z5g-p%*`Rt%sUQ#K$)jV6CJu9Zj^dk=w258rW>f7>;wr>8`67g(QC1dX2ogw5u%3J% zoXJ9w5JRyVN`&Kk_w74{zIMIy$9hVv-(18=pR{nt{K#2VHp8|^7sTnlK&cj1*GsCj zCmc_ig&*X4-gP#R-uw1kuuJ7>Fy)vKyUC+yRScEz)Ay{feMdp5W07;DUbaP_B!b?> zLXrRxJ_l(Xl+er+(5^i5N5$(1%PaTpWR;>G0kkEe&vo@Ux~kfcolNHTw+^@M9ZfKc z1F*lA;gZMF)S|oVwAc3bUWp#qx>lc1tEi>X^PNxSW^8T(^e~V|K-pQw4l>CkKf~VR zL;7)h2r1@ENCACdZ%uy->lNk@dr2feX@*-te=uMV4Fln@M`BySN!k&yTbg z;J-58-$G*tZsN1HyNYr*ts4~Ka^He0P zUzCGlqc41rB4EXo_zxT?u_p1=9I|X~u$+o+=hLhC6m&X^l_>6BU4TaFX$4Ei z!+IUv%0xZ`YqJi2k|h4%_U8MLl?n9CNAGS`KJi{UO4=7m`2uQ*+UwDv*d1s&7qPaY z(Hzlk4k!_Elr`;na@vyxWpQ;nb=rmwg=t4(#x@UTwXb{>O}`GO436}7hw-^t8TZ27 zZ1RiStC>^@gBfQfdW3qsr&xVGR&y^`HYgibv$z?cTPRpc~jY7_LB^ z9q&;E3bK*9KtZk+qC74$DpXOFqjj6vOFIfR8Ro0`tGGae2S!u&M^-w4fY6mXGx zh_#evipyoMSVsEe=xG~Gi-B#TL{*FBc@*W;@=>_C5@R#(bVu&UxhPOrP4w;*e-yw= z?rR-yYp_ejSzpH9AXad7Ks#(NlgKD9Hn>Tny!5SVjyhd*W_DM66LCWnsJl6-7e3XU%vXSKkO1WYW88x6uGH9xVK8|f$oD+;!~Tq-WOmvfUnB2V ztMY-h`t5F#F0*k>r$nNsFYVvew!ZyxIe)RG_*#0PzT^pBf~a`x;KgCig6RSyP&@zx zR-eERdYoC<^HPPK2sYikrVJmOyn zBFNV4+E?lcrr)lrEycllh0z#$#+x#|W_f9BoaLL*{jM9$Q3ONDmLV*g|8}y8s@~&O z4r-a3Sj+0o9UF^Kx-^UWX$x2aZBU?*5PKDllI1a93@Rlu)5ZbPHTQurM-gtO`cA1* z4*GDP3C(MvgTer=cL{{#^pb*9I2NFE?HI>unLO3@AvxWsB*~MyqpZZC@wJ+@@95jq ze@evv0^+T;?R$`X&(?Ae~9q2{|U!`iauNwYCq3~-GVpchwox& zW3h;iJ^y%;Mhg!Z>`HCXU0|DCwIOHIe08bvblX)NSA_J9Y|B|6Q)AtA1$;c9!mdG~B&T^yx)XYi&#~mlY9T|-i6S!< z3vPcvsyetRa=NbhaU~kHO8t}hRjFI3hPPu5%s`Cn;`JcYSf?y|)1r4Mc8pPlEPq1h z<97@TFYEzAsdHFW-k@7YZRK|(HT0hwej+m+@ zKe>9g=g5po6S7BrBGQfKcrR+=7l>RkJuBIla(r~UR@O?<&Px~Gl#!sluoK3k0wqz% zqjx+Mc9Et{HxW8~jieiIf9@0|JBq%pP%EW?X?|?vXGNB!)**jH34~dVdKD7ipa!zJ zYRbD$6CLsmwmN7TPx;f|@cW0Dw5D{D}8vPR8!f?JS%*-E3{7|2pU9K+Ja% zNA2gh2z&SAP9JG4`D4YW(1%Z;6mQqe3p`J&>Eu&q6zD4ZOw!F5cyrQ8+-IbCrf+rUYn!ImIT z%rX6N7wBY`CJ!ZPP{bS}ZjMdeH~K8wX|~P78swBQf0@AS={hKd;x3xYP3g|iQ*XsS z!5Ht-1R-GHd9fsOF6=HBuN({f*ipikGENVU%rQQLg5X6C=F~9TnAc6TxogVkev~Gz z4K-EvxSCGH;ty(ojcs6f9*}0^dzH@e-V}@G8P|*?Ax>5L0#y)Q@|I+Ts z0=|Q?v+ApeTr-HAthckgfu)JEzq+EovG;Qc`}A}#6^4rGf$$o=hXOwC@d|8$`?k2O z#MGXh8X(Pg9z0k#k|nO6w7i}8j+WlW@JQCN?_mlIl;lqg>}q8PMn5yqA+@zOh-j2a zKI#WnJ=OX8CVQlahs|U3XwVghoUU&)ZbMVhVZp*QpG{(g>%6DkxC?x*9;Z64X;K99 zs?@O=xei4^aK*Phzh}x}K|ami>Xp#3DcEL&n%uapZ+q9d?=ykU#OT!E-GO}~T=%Y8 z)7B~f-sotxqG!|_M`IQ6;O~xj#G9lo`g+24T808wcC#s`F5coL{Yh)68n;W_2lw=p z$mDcSL1f>h-mfZH*}|UL-vqNS8-w{hkz6gqyQBz|Lg>k2&19Ew`?+s=+~Xs4-FWc_ zGjcMcgbuo&l$Y%wpC-~&nHw56Z9KgmUh)V|PGFq5^x8i}EuZ>s$@#$x_vZEK!QD4L zhelO#Bvo0|v$97vN&>W0O1Bw1U4`H~v(>#!UIam~?>DCNk6vHqdhz%@tjn6Jj1Z?@ z$-JUoi0ggn74Anz@*|f0ox#zNj*Uk=dxD5>_=w_~nZ2p9lf8p8r?G>>k4!?7^N&hu z`Urvi^Tr0^cmDTBdYqE=XDlHuqzILwvMG_pNf=SQzHW$Y8vQKsI%Si2F+g8R6<{?4r__OX4)|`;K%$ zUIEIIo>Q5~-N_9*8-7xQmR?}*St=bg_}^Fi|J{T8M_aztYTHsBd>((%RLx>i%6us+ zOKoN9>PjqNv>cZU8%apFo9ZFMW5b0f9AH2)$+tiXk7{ZiLA6_!v;O(XJTBCtbwPaw zIFeDSp(FGb$lMzC|w> z;7t*naojMpqOc3t*(b7U^P=^8{JylXY?z-s-R7}c=bPkx!5noPox8Z~=_U3Y&7Yi` zBJhG&JU~g%+G1!x?EY?17WvkzuUX#IRVC0F3D4szmSd%L^DB}Ut;uW6!AVX#h^~&Z zJQDH)z^}IK?@OA$0O~^YZGRk4emj@^e&O#+aK9Ep5!nv0(8cm^z2E<--L$p&-}Cl= o<}`o(m)}k#zaG3olpBAbV($d7{_WiM^Y+s&|HA0kg5S^n0ws`A?f?J) literal 0 HcmV?d00001 diff --git a/test-data/spreadsheet/stress.xls b/test-data/spreadsheet/stress.xls index 1e6d98a3a8e79874d08fb18fa4a02b3a7cde6376..f32cb34e1611cd30c6dc4e7bf07c488a82604dec 100644 GIT binary patch delta 2733 zcmZve3s6*57{|}qWqG<@5Xo#iD@^5#EGmky;1xj$Ee%mje2^M4j>GuMSPH@iYMLdc zbt-xh_RgpbZ!fbnvzJm5sVN9fiaMi+R3p|nQ}o@te;)Tv?C=fecfRlUKliaSlwY%# z|83t9?<`~Z31_UdHnrLwRYKt3uCA``-_`nB`@=prNZtqu4TxqeSW6F!Zs=FxNC;%CNsDw&NaroutgPY?IXyFVSbTEIm@(dj_{606 zl+mM-MwBcoDjC37M*fNwD}B*R7W<+LeT$bz=lirHxj_!4os9@$tRJNuO=4_|_FG;a z=dp6!{2`{<0#awuN#z8bel<2E$G7<8L7Zmw&F_w4DGD9*I-V{yE{o1~0!=H~R5 zLz{AZ4v*L;dhZ(7@1mxi&}>Q(E&)G%Hwt513OL$Z$Q!}2exCGxgL4=^f8Y?3v79N{KMgyGl>M})}{0Y?`(9+R%--g68v zIrNur5ZeMrq{$Hp$I50Ge_U>D_VOp>p=J-?Dm$oFNLP!8Z85~|N=@=T45KP%JDdiZm4Db-3@dDhFHm-SR%kU{6X{6(2|&ck1l zOR2srE2&n=LsVap9aO8OtJS0K#9=+gVPB=ye)?W|=&<@D>VDzkj0<}Wy>b3txxQ8K z*JX99hrc1~T0P2}*dK{~$N6E(TVU~Espp0AHrObz!t+9X2W+&T(MmtZXv;YgjC1Tl zZvy5IlJi}#F<|Y)YQPe~244{BdtgbXoFq$**T{Jvy>kLi0uYT0Xs}N zAA*fF<&3rDs76jLdR5HFTolS4uyJ5n#5Ax}u+ob{{RnKlDQCPTC(X$D7`?E}jMn|oQP zUw}P#14Sn4HnWS)UUv%_!+JA7jB9rXR48N5WQ0| zpWh~wufgsC+eYjVSQgk`%J~Ltnki?RB`4d+`4+v|n2)$3l<&Z%gQXJt9&83!;T56& z0G4CQ$+6_jG;$83cP8c!lJf}IycD1!4Q?0ek6^i`oLo!JY$N9<^v=fos&=6q z1)Bp_MXVldF4$qp`5A1UDQBJ~C(p=fKyM!AW3CG27qI)lvWOi6n-5lcRj9|o7MOAt zSaKE`IVaG&5c3UJmn*-5-QS(lA(WF~`Q14kLOlhx$dt3ll2c&hG@`e_->WrrjI_y} zzx($5nQV6^#50yoZRN2W#yRAS&PX|@vtRIOXL4;~MH81X0Rv@u=QaBOq4@en+rTT@ Jjq8E-{{W_1KaKzZ delta 2391 zcmZ9N4Nz277>3W;UH(?!vQSYmcZjiRhPlirnBuY_U};Jrp(!9P1xzzBlbIF{!GPE@liGsrBSavi^#EwlFBY+iZEJrArc zU3LGOjVywd9u_-7w**`t$k=bD5tfn8*O@D`%0kQqxj_M1Kf5Z3u~5q0JBzUtvv5TL z=Luq;KQ^(&eWm4N8|c_ckA(j{cQF@BxMA`HLtRs(mTJ*^fwE`zTXxirf}4b6u{6U}v^ zyUXyFBM~SQbnP-9$Q+cfptBaT1=3YtOAnVkqx+<@^&+i1hF6G!?ig<+9KnhsSaAd^ zju7d1STspT8#y+>;Z_`O#o<;QQ>5b&5qrYA4&R9w@1t;pDvnUaVZ8>E_Yx)@RbrcT zG?1ejj&Q{ht~kOKhbA45i81MjIT_=vfg?h3L@163#o>{T$Hl6X*1c>d$3{3J6-T7v zh*TU=((#1ok&b_9J}IJ4CG$-p`;@_-5|uQc7WFhYiz76*h%uU5h0&ADpAjWAw~3uS z2H!3Y(X17J(|p#9{k_4#g=qWJ;LnL+n$L@=r<3^$qJZX$LeP9kw4FBi%VL=34l%XY z;5$V&%~wPv%{o!vYiO_Hb_{ttyTl*8y7n4a0$5m|&R-WspTXY{xqXKACeEkfytXf1 zdkbtjSZkl|dmAiqoYAuu`luz+zsh={C*HP6^563gc9W2gJELp$U^Bq7h`kGTBUr^5 z-S-~YOr>Y0t;hNZMYH#@I}7=CayEb^gN+jV0Bkl`{8`=C2!hANV5v$^s;y^^>}kgC9OM(v>6!_aHqK1{xjKjT5nwtNL(c2I zkHIpOq6}NnTv_x9cIP5rbY9m!1-lt+E3wbOZUNg%J$u3CDLwOSJ@aMHKJ3m%-qWvZ zpM%{BmP+gkumxbH{krc}kPnCh`Z!`4!l0U<1VVgWV2x&4BJZ0G2h* z=$ZA#&a(9^l09EzcM-e zxKcX`cK1ZjpziAcD^hxjY(2%Y=NNX2CweaF+HtUwac252O>;C4&31+*c^ONmSXJke sQJ2UWjuLspp~0yK_vg>>b#W2rx