This is an automated email from the ASF dual-hosted git repository. centic pushed a commit to branch trunk in repository https://gitbox.apache.org/repos/asf/poi.git
commit 9c2f487c98a36b9b7036bd64a4576bd5a3085336 Author: Dominik Stadler <[email protected]> AuthorDate: Fri Jan 16 07:53:47 2026 +0100 Bug 69927: Avoid NPE when parsing wmf-file headerBitCount can be null if the header contains an invalid flag --- .../java/org/apache/poi/hwmf/record/HwmfBitmapDib.java | 7 ++++++- .../test/java/org/apache/poi/hwmf/TestHwmfParsing.java | 3 ++- test-data/slideshow/file-45.wmf | Bin 0 -> 24890 bytes 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/poi-scratchpad/src/main/java/org/apache/poi/hwmf/record/HwmfBitmapDib.java b/poi-scratchpad/src/main/java/org/apache/poi/hwmf/record/HwmfBitmapDib.java index b6c59a2dfe..bb2e66bfa2 100644 --- a/poi-scratchpad/src/main/java/org/apache/poi/hwmf/record/HwmfBitmapDib.java +++ b/poi-scratchpad/src/main/java/org/apache/poi/hwmf/record/HwmfBitmapDib.java @@ -243,7 +243,8 @@ public class HwmfBitmapDib implements GenericRecord { // The size and format of this data is determined by information in the DIBHeaderInfo field. If // it is a BitmapCoreHeader, the size in bytes MUST be calculated as follows: - int bodySize = ((((headerWidth * headerPlanes * headerBitCount.flag + 31) & ~31) / 8) * Math.abs(headerHeight)); + int bodySize = ((((headerWidth * headerPlanes * + (headerBitCount == null ? 0 : headerBitCount.flag) + 31) & ~31) / 8) * Math.abs(headerHeight)); // This formula SHOULD also be used to calculate the size of aData when DIBHeaderInfo is a // BitmapInfoHeader Object, using values from that object, but only if its Compression value is @@ -348,6 +349,10 @@ public class HwmfBitmapDib implements GenericRecord { } protected int readColors(LittleEndianInputStream leis) throws IOException { + if (headerBitCount == null) { + return 0; + } + switch (headerBitCount) { default: case BI_BITCOUNT_0: diff --git a/poi-scratchpad/src/test/java/org/apache/poi/hwmf/TestHwmfParsing.java b/poi-scratchpad/src/test/java/org/apache/poi/hwmf/TestHwmfParsing.java index dff936b099..3f8e270896 100644 --- a/poi-scratchpad/src/test/java/org/apache/poi/hwmf/TestHwmfParsing.java +++ b/poi-scratchpad/src/test/java/org/apache/poi/hwmf/TestHwmfParsing.java @@ -54,7 +54,8 @@ public class TestHwmfParsing { @CsvSource({ "santa.wmf, 581", /* Bug 65063 */ - "empty-polygon-close.wmf, 272" + "empty-polygon-close.wmf, 272", + "file-45.wmf, 1315" }) void parse(String file, int recordCnt) throws IOException { try (InputStream fis = samples.openResourceAsStream(file)) { diff --git a/test-data/slideshow/file-45.wmf b/test-data/slideshow/file-45.wmf new file mode 100644 index 0000000000..6293588017 Binary files /dev/null and b/test-data/slideshow/file-45.wmf differ --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
