This is an automated email from the ASF dual-hosted git repository.
pjfanning pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
The following commit(s) were added to refs/heads/trunk by this push:
new 4046f948dd Reject oversized OOXML ptCount values in
XDDFDataSourcesFactory (#1070)
4046f948dd is described below
commit 4046f948dd022f1ae307d2fced8cc45e77dfb446
Author: metsw24-max <[email protected]>
AuthorDate: Thu May 14 02:43:33 2026 +0530
Reject oversized OOXML ptCount values in XDDFDataSourcesFactory (#1070)
---
.../usermodel/chart/XDDFDataSourcesFactory.java | 12 +++---
.../chart/TestXDDFDataSourcesFactory.java | 50 ++++++++++++++++++++++
2 files changed, 56 insertions(+), 6 deletions(-)
diff --git
a/poi-ooxml/src/main/java/org/apache/poi/xddf/usermodel/chart/XDDFDataSourcesFactory.java
b/poi-ooxml/src/main/java/org/apache/poi/xddf/usermodel/chart/XDDFDataSourcesFactory.java
index 8e89c3620d..c57c7c453a 100644
---
a/poi-ooxml/src/main/java/org/apache/poi/xddf/usermodel/chart/XDDFDataSourcesFactory.java
+++
b/poi-ooxml/src/main/java/org/apache/poi/xddf/usermodel/chart/XDDFDataSourcesFactory.java
@@ -67,7 +67,7 @@ public class XDDFDataSourcesFactory {
@Override
public int getPointCount() {
- return (int) category.getPtCount().getVal();
+ return Math.toIntExact(category.getPtCount().getVal());
}
@Override
@@ -98,7 +98,7 @@ public class XDDFDataSourcesFactory {
@Override
public int getPointCount() {
- return (int) category.getPtCount().getVal();
+ return Math.toIntExact(category.getPtCount().getVal());
}
@Override
@@ -141,7 +141,7 @@ public class XDDFDataSourcesFactory {
@Override
public int getPointCount() {
- return (int) category.getPtCount().getVal();
+ return Math.toIntExact(category.getPtCount().getVal());
}
@Override
@@ -178,7 +178,7 @@ public class XDDFDataSourcesFactory {
@Override
public int getPointCount() {
- return (int) category.getPtCount().getVal();
+ return Math.toIntExact(category.getPtCount().getVal());
}
@Override
@@ -230,7 +230,7 @@ public class XDDFDataSourcesFactory {
@Override
public int getPointCount() {
- return (int) values.getPtCount().getVal();
+ return Math.toIntExact(values.getPtCount().getVal());
}
@Override
@@ -285,7 +285,7 @@ public class XDDFDataSourcesFactory {
@Override
public int getPointCount() {
- return (int) values.getPtCount().getVal();
+ return Math.toIntExact(values.getPtCount().getVal());
}
@Override
diff --git
a/poi-ooxml/src/test/java/org/apache/poi/xddf/usermodel/chart/TestXDDFDataSourcesFactory.java
b/poi-ooxml/src/test/java/org/apache/poi/xddf/usermodel/chart/TestXDDFDataSourcesFactory.java
index 0cbb10b0f2..e979486c7d 100644
---
a/poi-ooxml/src/test/java/org/apache/poi/xddf/usermodel/chart/TestXDDFDataSourcesFactory.java
+++
b/poi-ooxml/src/test/java/org/apache/poi/xddf/usermodel/chart/TestXDDFDataSourcesFactory.java
@@ -20,6 +20,7 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
import org.apache.poi.ss.util.CellRangeAddress;
@@ -27,6 +28,10 @@ import org.apache.poi.ss.util.SheetBuilder;
import org.apache.poi.xssf.usermodel.XSSFSheet;
import org.apache.poi.xssf.usermodel.XSSFWorkbook;
import org.junit.jupiter.api.Test;
+import org.openxmlformats.schemas.drawingml.x2006.chart.CTAxDataSource;
+import org.openxmlformats.schemas.drawingml.x2006.chart.CTNumData;
+import org.openxmlformats.schemas.drawingml.x2006.chart.CTNumDataSource;
+import org.openxmlformats.schemas.drawingml.x2006.chart.CTStrData;
/**
* Tests for {@link XDDFDataSourcesFactory}.
@@ -136,6 +141,51 @@ class TestXDDFDataSourcesFactory {
assertNotNull(exception);
}
+ @Test
+ void oversizedCategoryPointCountIsRejected() {
+ // A crafted chart cache with an unsignedInt ptCount >
Integer.MAX_VALUE
+ // must not silently truncate to a negative int during conversion.
+ long oversized = (long) Integer.MAX_VALUE + 1;
+
+ CTAxDataSource numRefDS = CTAxDataSource.Factory.newInstance();
+ CTNumData numCache = numRefDS.addNewNumRef().addNewNumCache();
+ numCache.addNewPtCount().setVal(oversized);
+ XDDFCategoryDataSource numRefSource =
XDDFDataSourcesFactory.fromDataSource(numRefDS);
+ assertThrows(ArithmeticException.class, numRefSource::getPointCount);
+
+ CTAxDataSource strRefDS = CTAxDataSource.Factory.newInstance();
+ CTStrData strCache = strRefDS.addNewStrRef().addNewStrCache();
+ strCache.addNewPtCount().setVal(oversized);
+ XDDFCategoryDataSource strRefSource =
XDDFDataSourcesFactory.fromDataSource(strRefDS);
+ assertThrows(ArithmeticException.class, strRefSource::getPointCount);
+
+ CTAxDataSource numLitDS = CTAxDataSource.Factory.newInstance();
+ numLitDS.addNewNumLit().addNewPtCount().setVal(oversized);
+ XDDFCategoryDataSource numLitSource =
XDDFDataSourcesFactory.fromDataSource(numLitDS);
+ assertThrows(ArithmeticException.class, numLitSource::getPointCount);
+
+ CTAxDataSource strLitDS = CTAxDataSource.Factory.newInstance();
+ strLitDS.addNewStrLit().addNewPtCount().setVal(oversized);
+ XDDFCategoryDataSource strLitSource =
XDDFDataSourcesFactory.fromDataSource(strLitDS);
+ assertThrows(ArithmeticException.class, strLitSource::getPointCount);
+ }
+
+ @Test
+ void oversizedValuesPointCountIsRejected() {
+ long oversized = (long) Integer.MAX_VALUE + 1;
+
+ CTNumDataSource numRefDS = CTNumDataSource.Factory.newInstance();
+ CTNumData numCache = numRefDS.addNewNumRef().addNewNumCache();
+ numCache.addNewPtCount().setVal(oversized);
+ XDDFNumericalDataSource<Double> numRefSource =
XDDFDataSourcesFactory.fromDataSource(numRefDS);
+ assertThrows(ArithmeticException.class, numRefSource::getPointCount);
+
+ CTNumDataSource numLitDS = CTNumDataSource.Factory.newInstance();
+ numLitDS.addNewNumLit().addNewPtCount().setVal(oversized);
+ XDDFNumericalDataSource<Double> numLitSource =
XDDFDataSourcesFactory.fromDataSource(numLitDS);
+ assertThrows(ArithmeticException.class, numLitSource::getPointCount);
+ }
+
private <T> void assertDataSourceIsEqualToArray(XDDFDataSource<T> ds, T[]
array) {
assertEquals(ds.getPointCount(), array.length);
for (int i = 0; i < array.length; ++i) {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
