Author: centic Date: Wed Aug 9 10:09:16 2023 New Revision: 1911573 URL: http://svn.apache.org/viewvc?rev=1911573&view=rev Log: Bug 66425: Avoid a ClassCastException found via oss-fuzz
We try to avoid throwing ClassCastException, but it was possible to trigger one here with a specially crafted input-file Should fix https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61306 Added: poi/trunk/test-data/slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6710128412590080.ppt (with props) Modified: poi/trunk/poi-scratchpad/src/main/java/org/apache/poi/hslf/record/CurrentUserAtom.java poi/trunk/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/BaseTestPPTIterating.java poi/trunk/test-data/spreadsheet/stress.xls Modified: poi/trunk/poi-scratchpad/src/main/java/org/apache/poi/hslf/record/CurrentUserAtom.java URL: http://svn.apache.org/viewvc/poi/trunk/poi-scratchpad/src/main/java/org/apache/poi/hslf/record/CurrentUserAtom.java?rev=1911573&r1=1911572&r2=1911573&view=diff ============================================================================== --- poi/trunk/poi-scratchpad/src/main/java/org/apache/poi/hslf/record/CurrentUserAtom.java (original) +++ poi/trunk/poi-scratchpad/src/main/java/org/apache/poi/hslf/record/CurrentUserAtom.java Wed Aug 9 10:09:16 2023 @@ -35,6 +35,7 @@ import org.apache.poi.hslf.exceptions.Co import org.apache.poi.hslf.exceptions.OldPowerPointFormatException; import org.apache.poi.poifs.filesystem.DirectoryNode; import org.apache.poi.poifs.filesystem.DocumentEntry; +import org.apache.poi.poifs.filesystem.Entry; import org.apache.poi.poifs.filesystem.POIFSFileSystem; import org.apache.poi.util.IOUtils; import org.apache.poi.util.LittleEndian; @@ -120,8 +121,11 @@ public class CurrentUserAtom { */ public CurrentUserAtom(DirectoryNode dir) throws IOException { // Decide how big it is - DocumentEntry docProps = - (DocumentEntry)dir.getEntry("Current User"); + final Entry entry = dir.getEntry("Current User"); + if (!(entry instanceof DocumentEntry)) { + throw new IllegalArgumentException("Had unexpected type of entry for name: Current User: " + entry.getClass()); + } + DocumentEntry docProps = (DocumentEntry) entry; // If it's clearly junk, bail out if(docProps.getSize() > 131072) { Modified: poi/trunk/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/BaseTestPPTIterating.java URL: http://svn.apache.org/viewvc/poi/trunk/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/BaseTestPPTIterating.java?rev=1911573&r1=1911572&r2=1911573&view=diff ============================================================================== --- poi/trunk/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/BaseTestPPTIterating.java (original) +++ poi/trunk/poi-scratchpad/src/test/java/org/apache/poi/hslf/dev/BaseTestPPTIterating.java Wed Aug 9 10:09:16 2023 @@ -60,6 +60,7 @@ public abstract class BaseTestPPTIterati static final Map<String,Class<? extends Throwable>> EXCLUDED = new HashMap<>(); static { EXCLUDED.put("clusterfuzz-testcase-minimized-POIHSLFFuzzer-6416153805979648.ppt", Exception.class); + EXCLUDED.put("clusterfuzz-testcase-minimized-POIHSLFFuzzer-6710128412590080.ppt", RuntimeException.class); } public static Stream<Arguments> files() { Added: poi/trunk/test-data/slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6710128412590080.ppt URL: http://svn.apache.org/viewvc/poi/trunk/test-data/slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6710128412590080.ppt?rev=1911573&view=auto ============================================================================== Binary file - no diff available. Propchange: poi/trunk/test-data/slideshow/clusterfuzz-testcase-minimized-POIHSLFFuzzer-6710128412590080.ppt ------------------------------------------------------------------------------ svn:mime-type = application/vnd.ms-powerpoint Modified: poi/trunk/test-data/spreadsheet/stress.xls URL: http://svn.apache.org/viewvc/poi/trunk/test-data/spreadsheet/stress.xls?rev=1911573&r1=1911572&r2=1911573&view=diff ============================================================================== Binary files - no diff available. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
