more int overflow risks

poi-ooxml/src/main/java/org/apache/poi/xslf/usermodel/XSLFPictureShape.java

@@ -45,6 +45,7 @@
 import org.apache.poi.sl.usermodel.PictureShape;
 import org.apache.poi.sl.usermodel.Placeholder;
 import org.apache.poi.util.Beta;
+import org.apache.poi.util.MathUtil;
 import org.apache.poi.util.Units;
 import org.apache.poi.xslf.draw.SVGImageRenderer;
 import org.apache.xmlbeans.XmlCursor;
@@ -372,7 +373,9 @@ public static XSLFPictureShape addSvgImage(XSLFSheet sheet, XSLFPictureData svgP
 
         Dimension2D dim = renderer.getDimension();
         Rectangle2D anc = (anchor != null) ? anchor
-            : new Rectangle2D.Double(0,0, Units.pixelToPoints((int)dim.getWidth()), Units.pixelToPoints((int)dim.getHeight()));
+            : new Rectangle2D.Double(0,0,
+                Units.pixelToPoints(MathUtil.safeDoubleToInt(dim.getWidth())),
+                Units.pixelToPoints(MathUtil.safeDoubleToInt(dim.getHeight())));
 
         PictureType pt = (previewType != null) ? previewType : PictureType.PNG;
         if (pt != PictureType.JPEG && pt != PictureType.GIF && pt != PictureType.PNG) {

poi-ooxml/src/main/java/org/apache/poi/xssf/model/ExternalLinksTable.java

@@ -257,7 +257,7 @@ public String getSheetName() {
         @Override
         public int getSheetIndex() {
             if (name.isSetSheetId()) {
-                return (int)name.getSheetId();
+                return Math.toIntExact(name.getSheetId());
             }
             return -1;
         }

poi-ooxml/src/main/java/org/apache/poi/xssf/model/MapInfo.java

@@ -75,7 +75,7 @@ public void readFrom(InputStream is) throws IOException {
 
             maps= new HashMap<>();
             for(CTMap map :mapInfo.getMapArray()){
-                maps.put((int)map.getID(), new XSSFMap(map,this));
+                maps.put(Math.toIntExact(map.getID()), new XSSFMap(map,this));
             }
 
         } catch (XmlException e) {
@@ -127,7 +127,7 @@ public XSSFMap getXSSFMapByName(String name){
 
         XSSFMap matchedMap = null;
 
-        for(XSSFMap map :maps.values()){
+        for(XSSFMap map : maps.values()){
             if(map.getCtMap().getName()!=null && map.getCtMap().getName().equals(name)){
                 matchedMap = map;
             }

poi-ooxml/src/main/java/org/apache/poi/xssf/streaming/SXSSFSheet.java

@@ -30,6 +30,7 @@ Licensed to the Apache Software Foundation (ASF) under one or more
 import org.apache.poi.ss.util.PaneInformation;
 import org.apache.poi.ss.util.SheetUtil;
 import org.apache.poi.util.Internal;
+import org.apache.poi.util.MathUtil;
 import org.apache.poi.util.NotImplemented;
 import org.apache.poi.util.Removal;
 import org.apache.poi.xssf.usermodel.*;
@@ -1667,7 +1668,7 @@ public void autoSizeColumn(int column, boolean useMergedCells) {
 
         // get the best-fit width of rows currently in the random access window
         final double w1 = SheetUtil.getColumnWidth(this, column, useMergedCells);
-        final int activeWidth = (int) ((256 * w1) + getArbitraryExtraWidth());
+        final int activeWidth = MathUtil.safeDoubleToInt((256 * w1) + getArbitraryExtraWidth());
 
         // the best-fit width for both flushed rows and random access window rows
         // flushedWidth or activeWidth may be negative if column contains only blank cells

poi-ooxml/src/main/java/org/apache/poi/xssf/usermodel/XSSFCellStyle.java

@@ -34,6 +34,7 @@ Licensed to the Apache Software Foundation (ASF) under one or more
 import org.apache.poi.ss.usermodel.VerticalAlignment;
 import org.apache.poi.ss.util.CellUtil;
 import org.apache.poi.util.Internal;
+import org.apache.poi.util.MathUtil;
 import org.apache.poi.xssf.model.StylesTable;
 import org.apache.poi.xssf.model.ThemesTable;
 import org.apache.poi.xssf.usermodel.extensions.XSSFCellAlignment;
@@ -369,7 +370,7 @@ public XSSFColor getFillBackgroundXSSFColor() {
         // bug 56295: handle missing applyFill attribute as "true" because Excel does as well
         if(_cellXf.isSetApplyFill() && !_cellXf.getApplyFill()) return null;
 
-        int fillIndex = (int)_cellXf.getFillId();
+        int fillIndex = Math.toIntExact(_cellXf.getFillId());
         XSSFCellFill fg = _stylesSource.getFillAt(fillIndex);
 
         XSSFColor fillBackgroundColor = fg.getFillBackgroundColor();
@@ -408,7 +409,7 @@ public XSSFColor getFillForegroundXSSFColor() {
         // bug 56295: handle missing applyFill attribute as "true" because Excel does as well
         if(_cellXf.isSetApplyFill() && !_cellXf.getApplyFill()) return null;
 
-        int fillIndex = (int)_cellXf.getFillId();
+        int fillIndex = Math.toIntExact(_cellXf.getFillId());
         XSSFCellFill fg = _stylesSource.getFillAt(fillIndex);
 
         XSSFColor fillForegroundColor = fg.getFillForegroundColor();
@@ -423,7 +424,7 @@ public FillPatternType getFillPattern() {
         // bug 56295: handle missing applyFill attribute as "true" because Excel does as well
         if(_cellXf.isSetApplyFill() && !_cellXf.getApplyFill()) return FillPatternType.NO_FILL;
 
-        int fillIndex = (int)_cellXf.getFillId();
+        int fillIndex = MathUtil.safeDoubleToInt(_cellXf.getFillId());
         XSSFCellFill fill = _stylesSource.getFillAt(fillIndex);
 
         STPatternType.Enum ptrn = fill.getPatternType();
@@ -935,7 +936,7 @@ private CTFill getCTFill(){
         CTFill ct;
         // bug 56295: handle missing applyFill attribute as "true" because Excel does as well
         if(!_cellXf.isSetApplyFill() || _cellXf.getApplyFill()) {
-            int fillIndex = (int)_cellXf.getFillId();
+            int fillIndex = MathUtil.safeDoubleToInt(_cellXf.getFillId());
             XSSFCellFill cf = _stylesSource.getFillAt(fillIndex);
 
             ct = (CTFill)cf.getCTFill().copy();

poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFParagraph.java

@@ -25,6 +25,7 @@ Licensed to the Apache Software Foundation (ASF) under one or more
 import org.apache.poi.ooxml.POIXMLDocumentPart;
 import org.apache.poi.ooxml.util.POIXMLUnits;
 import org.apache.poi.util.Internal;
+import org.apache.poi.util.MathUtil;
 import org.apache.poi.util.Units;
 import org.apache.poi.wp.usermodel.Paragraph;
 import org.apache.xmlbeans.XmlCursor;
@@ -932,7 +933,8 @@ public void setPageBreak(boolean pageBreak) {
      */
     public int getSpacingAfter() {
         CTSpacing spacing = getCTSpacing(false);
-        return (spacing != null && spacing.isSetAfter()) ? (int)Units.toDXA(POIXMLUnits.parseLength(spacing.xgetAfter())) : -1;
+        return (spacing != null && spacing.isSetAfter()) ?
+                MathUtil.safeDoubleToInt(Units.toDXA(POIXMLUnits.parseLength(spacing.xgetAfter()))) : -1;
     }
 
     /**
@@ -998,7 +1000,8 @@ public void setSpacingAfterLines(int spaces) {
      */
     public int getSpacingBefore() {
         CTSpacing spacing = getCTSpacing(false);
-        return (spacing != null && spacing.isSetBefore()) ? (int)Units.toDXA(POIXMLUnits.parseLength(spacing.xgetBefore())) : -1;
+        return (spacing != null && spacing.isSetBefore()) ?
+                MathUtil.safeDoubleToInt(Units.toDXA(POIXMLUnits.parseLength(spacing.xgetBefore()))) : -1;
     }
 
     /**
@@ -1146,7 +1149,7 @@ public void setSpacingBetween(double spacing) {
     public int getIndentationLeft() {
         CTInd indentation = getCTInd(false);
         return (indentation != null && indentation.isSetLeft())
-            ? (int)Units.toDXA(POIXMLUnits.parseLength(indentation.xgetLeft()))
+            ? MathUtil.safeDoubleToInt(Units.toDXA(POIXMLUnits.parseLength(indentation.xgetLeft())))
             : -1;
     }
 
@@ -1212,7 +1215,7 @@ public void setIndentationLeftChars(int indentation) {
     public int getIndentationRight() {
         CTInd indentation = getCTInd(false);
         return (indentation != null && indentation.isSetRight())
-            ? (int)Units.toDXA(POIXMLUnits.parseLength(indentation.xgetRight()))
+            ? MathUtil.safeDoubleToInt(Units.toDXA(POIXMLUnits.parseLength(indentation.xgetRight())))
             : -1;
     }
 
@@ -1277,7 +1280,7 @@ public void setIndentationRightChars(int indentation) {
     public int getIndentationHanging() {
         CTInd indentation = getCTInd(false);
         return (indentation != null && indentation.isSetHanging())
-            ? (int)Units.toDXA(POIXMLUnits.parseLength(indentation.xgetHanging())) : -1;
+            ? MathUtil.safeDoubleToInt(Units.toDXA(POIXMLUnits.parseLength(indentation.xgetHanging()))) : -1;
     }
 
     /**
@@ -1318,7 +1321,7 @@ public void setIndentationHanging(int indentation) {
     public int getIndentationFirstLine() {
         CTInd indentation = getCTInd(false);
         return (indentation != null && indentation.isSetFirstLine())
-            ? (int)Units.toDXA(POIXMLUnits.parseLength(indentation.xgetFirstLine()))
+            ? MathUtil.safeDoubleToInt(Units.toDXA(POIXMLUnits.parseLength(indentation.xgetFirstLine())))
             : -1;
     }
 

poi-ooxml/src/main/java/org/apache/poi/xwpf/usermodel/XWPFRun.java

@@ -807,7 +807,7 @@ public int getKerning() {
         if (pr == null || pr.sizeOfKernArray() == 0) {
             return 0;
         }
-        return (int)POIXMLUnits.parseLength(pr.getKernArray(0).xgetVal());
+        return Math.toIntExact(POIXMLUnits.parseLength(pr.getKernArray(0).xgetVal()));
     }
 
     @Override

poi-scratchpad/src/main/java/org/apache/poi/hemf/draw/HemfImageRenderer.java

@@ -39,6 +39,7 @@ Licensed to the Apache Software Foundation (ASF) under one or more
 import org.apache.poi.sl.draw.EmbeddedExtractor;
 import org.apache.poi.sl.draw.ImageRenderer;
 import org.apache.poi.sl.usermodel.PictureData;
+import org.apache.poi.util.MathUtil;
 import org.apache.poi.util.Units;
 
 @SuppressWarnings("unused")
@@ -84,7 +85,10 @@ public BufferedImage getImage(Dimension2D dim) {
             return new BufferedImage(1, 1, BufferedImage.TYPE_INT_ARGB);
         }
 
-        BufferedImage bufImg = new BufferedImage((int)dim.getWidth(), (int)dim.getHeight(), BufferedImage.TYPE_INT_ARGB);
+        BufferedImage bufImg = new BufferedImage(
+                MathUtil.safeDoubleToInt(dim.getWidth()),
+                MathUtil.safeDoubleToInt(dim.getHeight()),
+                BufferedImage.TYPE_INT_ARGB);
         Graphics2D g = bufImg.createGraphics();
         g.setRenderingHint(RenderingHints.KEY_ANTIALIASING, RenderingHints.VALUE_ANTIALIAS_ON);
         g.setRenderingHint(RenderingHints.KEY_RENDERING, RenderingHints.VALUE_RENDER_QUALITY);

poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfComment.java

@@ -247,7 +247,7 @@ private EmfCommentData _next() {
                 final EmfCommentData record = commentType.constructor.get();
 
                 long readBytes = record.init(leis, dataSize);
-                final int skipBytes = Math.toIntExact(recordSize-4-readBytes);
+                final long skipBytes = recordSize-4-readBytes;
                 assert (skipBytes >= 0);
                 leis.skipFully(skipBytes);
 

poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfHeader.java

@@ -175,8 +175,8 @@ public long init(LittleEndianInputStream leis, long recordSize, long recordId) t
             }
             int maxDescriptionLength = Math.toIntExact(Math.min(recordSize, Integer.MAX_VALUE));
             IOUtils.safelyAllocateCheck(descriptionBytes, maxDescriptionLength);
-            leis.mark((int)(skip + descriptionBytes));
-            leis.skipFully((int)skip);
+            leis.mark(Math.toIntExact(skip + descriptionBytes));
+            leis.skipFully(skip);
             byte[] buf = IOUtils.safelyAllocate(descriptionBytes, maxDescriptionLength);
             leis.readFully(buf);
             description = new String(buf, StandardCharsets.UTF_16LE).replace((char)0, ' ').trim();

poi-scratchpad/src/main/java/org/apache/poi/hemf/record/emf/HemfRecordIterator.java

@@ -81,7 +81,7 @@ private HemfRecord _next() {
             if (readBytes > remBytes) {
                 throw new RecordFormatException("Record limit exceeded - readBytes: "+readBytes+" / remBytes: "+remBytes);
             }
-            stream.skipFully((int) (remBytes - readBytes));
+            stream.skipFully(remBytes - readBytes);
         } catch (RecordFormatException e) {
             throw e;
         } catch (IOException|RuntimeException e) {

poi-scratchpad/src/main/java/org/apache/poi/hpbf/model/QuillContents.java

@@ -79,8 +79,8 @@ public QuillContents(DirectoryNode baseDir) throws IOException {
                             "QuillContents bit offset " + fromU + " exceeds Integer.MAX_VALUE");
                 }
                 IOUtils.safelyAllocateCheck(lenU, EscherPart.getMaxRecordLength());
-                int from = (int)fromU;
-                int len  = (int)lenU;
+                int from = Math.toIntExact(fromU);
+                int len  = Math.toIntExact(lenU);
 
                 byte[] bitData = IOUtils.safelyClone(data, from, len, EscherPart.getMaxRecordLength());
 

poi-scratchpad/src/main/java/org/apache/poi/hslf/blip/Bitmap.java

@@ -31,6 +31,7 @@ Licensed to the Apache Software Foundation (ASF) under one or more
 import org.apache.poi.hslf.usermodel.HSLFPictureData;
 import org.apache.poi.util.IOUtils;
 import org.apache.poi.util.Internal;
+import org.apache.poi.util.MathUtil;
 import org.apache.poi.util.Units;
 
 /**
@@ -98,8 +99,8 @@ public Dimension getImageDimension() {
         try (InputStream is = UnsynchronizedByteArrayInputStream.builder().setByteArray(getData()).get()){
             BufferedImage bi = ImageIO.read(is);
             return new Dimension(
-                (int)Units.pixelToPoints(bi.getWidth()),
-                (int)Units.pixelToPoints(bi.getHeight())
+                    MathUtil.safeDoubleToInt(Units.pixelToPoints(bi.getWidth())),
+                    MathUtil.safeDoubleToInt(Units.pixelToPoints(bi.getHeight()))
             );
         } catch (IOException e) {
             return new Dimension(200,200);

poi-scratchpad/src/main/java/org/apache/poi/hslf/dev/PPTXMLDump.java

@@ -121,10 +121,10 @@ public void dump(byte[] data, int offset, int length, int padding) throws IOExce
             pos += LittleEndianConsts.SHORT_SIZE;
             int type = LittleEndian.getUShort(data, pos);
             pos += LittleEndianConsts.SHORT_SIZE;
-            int size = (int)LittleEndian.getUInt(data, pos);
+            long size = LittleEndian.getUInt(data, pos);
             pos += LittleEndianConsts.INT_SIZE;
 
-            if (size < 0) {
+            if (size < 0 || size > Integer.MAX_VALUE) {
                 // stop processing of invalid header data
                 continue;
             }
@@ -143,15 +143,15 @@ public void dump(byte[] data, int offset, int length, int padding) throws IOExce
             boolean isContainer = (info & 0x000F) == 0x000F;
             if (isContainer) {
                 //continue to dump child records
-                dump(data, pos, size, padding);
+                dump(data, pos, Math.toIntExact(size), padding);
             } else {
                 //dump first 100 bytes of the atom data
-                dump(out, data, pos, Math.min(size, data.length-pos), padding, true);
+                dump(out, data, pos, Math.toIntExact(Math.min(size, data.length-pos)), padding, true);
             }
             padding--;
             write(out, "</"+recname + ">" + CR, padding);
 
-            pos += size;
+            pos += Math.toIntExact(size);
         }
     }
 

poi-scratchpad/src/main/java/org/apache/poi/hslf/dev/SlideShowRecordDumper.java

@@ -235,7 +235,7 @@ public void walkTree(int depth, int pos, Record[] records, int indent) throws IO
             int len = getDiskLen(r);
 
             // Grab the type as hex
-            String hexType = makeHex((int) r.getRecordType(), 4);
+            String hexType = makeHex(Math.toIntExact(r.getRecordType()), 4);
             String rHexType = reverseHex(hexType);
 
             // Grab the hslf.record type

poi-scratchpad/src/main/java/org/apache/poi/hslf/record/SlideAtom.java

@@ -109,7 +109,7 @@ protected SlideAtom(byte[] source, int start, int len) {
     public SlideAtom(){
         _header = new byte[8];
         LittleEndian.putUShort(_header, 0, 2);
-        LittleEndian.putUShort(_header, 2, (int)_type);
+        LittleEndian.putUShort(_header, 2, Math.toIntExact(_type));
         LittleEndian.putInt(_header, 4, 24);
 
         byte[] ssdate = new byte[12];

poi/src/main/java/org/apache/poi/util/LittleEndianInputStream.java

@@ -216,4 +216,15 @@ public void skipFully(int len) throws IOException {
         }
         checkEOF((int)skipped, len);
     }
+
+    public void skipFully(long len) throws IOException {
+        if (len == 0) {
+            return;
+        }
+        long skipped = IOUtils.skipFully(this, len);
+        if (skipped > Integer.MAX_VALUE) {
+            throw new IOException("can't skip further than "+Integer.MAX_VALUE);
+        }
+        checkEOF((int)skipped, (int)len);
+    }
 }

test-data/poi-integration-exceptions.csv

@@ -375,7 +375,7 @@ spreadsheet/rde.imf.ru_sites_default_files_rde_documents_vodootvedenie_2020.xlsb
 spreadsheet/crash-e329fca9087fe21bca4a80c8bc472a661c98d860.xls,handle,HSSF,,org.apache.poi.util.RecordFormatException,33198 bytes written but getRecordSize() reports 33194,
 slideshow/61338.wmf,"handle,extract",HWMF,,org.apache.poi.util.RecordFormatException,Tried to skip 9699347 but skipped: 489,
 slideshow/file-45.wmf,handle,HWMF,,org.apache.poi.util.RecordFormatException,The width or height specified in the header exceed the current limit,
-spreadsheet/61294.emf,"handle,extract",HEMF,,org.apache.poi.util.RecordFormatException,java.lang.IllegalArgumentException: Skip count must be non-negative,
+spreadsheet/61294.emf,"handle,extract",HEMF,,org.apache.poi.util.RecordFormatException,java.lang.IllegalStateException: Unexpected end-of-file,
 publisher/clusterfuzz-testcase-minimized-POIHPBFFuzzer-6325615354773504.pub,"handle,extract",HPBF,,java.lang.IllegalArgumentException,File invalid - failed to find document entry,
 slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-6071540680032256.pptx,extract,"XSLF,OPC",,java.lang.IllegalStateException,"Invalid content in diagram, cannot extract text",
 slideshow/clusterfuzz-testcase-minimized-POIXSLFFuzzer-6071540680032256.pptx,handle,XSLF,,java.lang.IllegalStateException,SlideMaster was not found for Name,