Repository.mk | 1 bin/oss-fuzz-setup.sh | 1 sc/source/filter/xml/xmlimprt.cxx | 76 +++++++++++++++++++++++++++++ vcl/Executable_fods2xlsfuzzer.mk | 50 +++++++++++++++++++ vcl/Module_vcl.mk | 1 vcl/workben/fftester.cxx | 10 +++ vcl/workben/fods2xlsfuzzer.cxx | 96 +++++++++++++++++++++++++++++++++++++ vcl/workben/fods2xlsfuzzer.options | 3 + 8 files changed, 238 insertions(+)
New commits: commit 53c5d570cab036b23f4969b858a648c8f0c24f93 Author: Noel Grandin <[email protected]> AuthorDate: Tue Jan 30 13:47:03 2024 +0200 Commit: Caolán McNamara <[email protected]> CommitDate: Tue Mar 19 22:35:06 2024 +0100 fods2xls fuzzer Change-Id: I095178b1b3c61829abf5c08b8b81cd7415e3e795 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/162747 Tested-by: Caolán McNamara <[email protected]> Reviewed-by: Caolán McNamara <[email protected]> diff --git a/Repository.mk b/Repository.mk index c0d86f868971..aa740fae6860 100644 --- a/Repository.mk +++ b/Repository.mk @@ -146,6 +146,7 @@ $(eval $(call gb_Helper_register_executables_for_install,OOO,brand, \ $(call gb_Helper_optional,FUZZERS,slkfuzzer) \ $(call gb_Helper_optional,FUZZERS,fodtfuzzer) \ $(call gb_Helper_optional,FUZZERS,fodt2pdffuzzer) \ + $(call gb_Helper_optional,FUZZERS,fods2xlsfuzzer) \ $(call gb_Helper_optional,FUZZERS,fodsfuzzer) \ $(call gb_Helper_optional,FUZZERS,fodpfuzzer) \ $(call gb_Helper_optional,FUZZERS,xlsfuzzer) \ diff --git a/bin/oss-fuzz-setup.sh b/bin/oss-fuzz-setup.sh index 5e7452640799..d8ad9f44f262 100755 --- a/bin/oss-fuzz-setup.sh +++ b/bin/oss-fuzz-setup.sh @@ -166,5 +166,6 @@ curl --no-progress-meter -S \ -C - -O https://dev-www.libreoffice.org/corpus/htmlfuzzer_seed_corpus.zip \ -C - -O https://dev-www.libreoffice.org/corpus/zipfuzzer_seed_corpus.zip cp fodtfuzzer_seed_corpus.zip fodt2pdffuzzer_seed_corpus.zip +cp fodsfuzzer_seed_corpus.zip fods2xlsfuzzer_seed_corpus.zip echo end downloading dependencies at `date -u` diff --git a/sc/source/filter/xml/xmlimprt.cxx b/sc/source/filter/xml/xmlimprt.cxx index b94d1d44d8fa..dcd8229c77ad 100644 --- a/sc/source/filter/xml/xmlimprt.cxx +++ b/sc/source/filter/xml/xmlimprt.cxx @@ -29,6 +29,7 @@ #include <xmloff/xmlmetai.hxx> #include <sfx2/objsh.hxx> #include <unotools/streamwrap.hxx> +#include <unotools/tempfile.hxx> #include <xmloff/xmlscripti.hxx> #include <xmloff/XMLFontStylesContext.hxx> #include <xmloff/DocumentSettingsContext.hxx> @@ -83,6 +84,7 @@ #include <comphelper/processfactory.hxx> #include <com/sun/star/document/XDocumentPropertiesSupplier.hpp> +#include <com/sun/star/document/XExporter.hpp> #include <com/sun/star/frame/XModel.hpp> #include <com/sun/star/io/IOException.hpp> #include <com/sun/star/lang/WrappedTargetRuntimeException.hpp> @@ -1722,6 +1724,80 @@ extern "C" SAL_DLLPUBLIC_EXPORT bool TestImportFODS(SvStream &rStream) return ret; } +extern "C" SAL_DLLPUBLIC_EXPORT bool TestFODSExportXLS(SvStream &rStream) +{ + ScDLL::Init(); + + SfxObjectShellLock xDocSh(new ScDocShell); + xDocSh->DoInitNew(); + uno::Reference<frame::XModel> xModel(xDocSh->GetModel()); + + uno::Reference<lang::XMultiServiceFactory> xMultiServiceFactory(comphelper::getProcessServiceFactory()); + uno::Reference<io::XInputStream> xStream(new ::utl::OSeekableInputStreamWrapper(rStream)); + uno::Reference<uno::XInterface> xInterface(xMultiServiceFactory->createInstance("com.sun.star.comp.Writer.XmlFilterAdaptor"), uno::UNO_SET_THROW); + + css::uno::Sequence<OUString> aUserData + { + "com.sun.star.comp.filter.OdfFlatXml", + "", + "com.sun.star.comp.Calc.XMLOasisImporter", + "com.sun.star.comp.Calc.XMLOasisExporter", + "", + "", + "true" + }; + uno::Sequence<beans::PropertyValue> aAdaptorArgs(comphelper::InitPropertySequence( + { + { "UserData", uno::Any(aUserData) }, + })); + css::uno::Sequence<uno::Any> aOuterArgs{ uno::Any(aAdaptorArgs) }; + + uno::Reference<lang::XInitialization> xInit(xInterface, uno::UNO_QUERY_THROW); + xInit->initialize(aOuterArgs); + + uno::Reference<document::XImporter> xImporter(xInterface, uno::UNO_QUERY_THROW); + uno::Sequence<beans::PropertyValue> aArgs(comphelper::InitPropertySequence( + { + { "InputStream", uno::Any(xStream) }, + { "URL", uno::Any(OUString("private:stream")) }, + })); + xImporter->setTargetDocument(xModel); + + uno::Reference<document::XFilter> xFilter(xInterface, uno::UNO_QUERY_THROW); + //SetLoading hack because the document properties will be re-initted + //by the xml filter and during the init, while it's considered uninitialized, + //setting a property will inform the document it's modified, which attempts + //to update the properties, which throws cause the properties are uninitialized + xDocSh->SetLoading(SfxLoadedFlags::NONE); + bool ret = xFilter->filter(aArgs); + xDocSh->SetLoading(SfxLoadedFlags::ALL); + + if (ret) + { + utl::TempFileFast aTempFile; + + uno::Reference<document::XFilter> xXLSFilter( + xMultiServiceFactory->createInstance("com.sun.star.comp.oox.xls.ExcelFilter"), uno::UNO_QUERY); + uno::Reference<document::XExporter> xExporter(xXLSFilter, uno::UNO_QUERY); + xExporter->setSourceDocument(xModel); + + uno::Reference<io::XOutputStream> xOutputStream(new utl::OStreamWrapper(*aTempFile.GetStream(StreamMode::READWRITE))); + + uno::Sequence<beans::PropertyValue> aFilterData(comphelper::InitPropertySequence({ + })); + uno::Sequence<beans::PropertyValue> aDescriptor(comphelper::InitPropertySequence({ + { "FilterName", uno::Any(u"Excel 2007–365"_ustr) }, + { "OutputStream", uno::Any(xOutputStream) }, + { "FilterData", uno::Any(aFilterData) } + })); + xXLSFilter->filter(aDescriptor); + } + + xDocSh->DoClose(); + + return ret; +} + extern "C" SAL_DLLPUBLIC_EXPORT bool TestImportXLSX(SvStream &rStream) { ScDLL::Init(); diff --git a/vcl/Executable_fods2xlsfuzzer.mk b/vcl/Executable_fods2xlsfuzzer.mk new file mode 100644 index 000000000000..2c11d5d23e95 --- /dev/null +++ b/vcl/Executable_fods2xlsfuzzer.mk @@ -0,0 +1,50 @@ +# -*- Mode: makefile-gmake; tab-width: 4; indent-tabs-mode: t -*- +# +# +# This file is part of the LibreOffice project. +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. +# + +include $(SRCDIR)/vcl/commonfuzzer.mk + +$(eval $(call gb_Executable_Executable,fods2xlsfuzzer)) + +$(eval $(call gb_Executable_use_api,fods2xlsfuzzer,\ + offapi \ + udkapi \ +)) + +$(eval $(call gb_Executable_use_externals,fods2xlsfuzzer,\ + $(fuzzer_externals) \ + epubgen \ + revenge \ +)) + +$(eval $(call gb_Executable_set_include,fods2xlsfuzzer,\ + $$(INCLUDE) \ + -I$(SRCDIR)/vcl/inc \ +)) + +$(eval $(call gb_Executable_use_libraries,fods2xlsfuzzer,\ + $(fuzzer_calc_libraries) \ + $(fuzzer_core_libraries) \ + pdffilter \ +)) + +$(eval $(call gb_Executable_use_static_libraries,fods2xlsfuzzer,\ + $(fuzzer_statics) \ + fuzzer_calc \ +)) + +$(eval $(call gb_Executable_add_exception_objects,fods2xlsfuzzer,\ + vcl/workben/fods2xlsfuzzer \ +)) + +$(eval $(call gb_Executable_add_libs,fods2xlsfuzzer,\ + $(LIB_FUZZING_ENGINE) \ +)) + +# vim: set noet sw=4 ts=4: diff --git a/vcl/Module_vcl.mk b/vcl/Module_vcl.mk index 31d751a6e332..c0729d78209b 100644 --- a/vcl/Module_vcl.mk +++ b/vcl/Module_vcl.mk @@ -191,6 +191,7 @@ $(eval $(call gb_Module_add_targets,vcl,\ Executable_slkfuzzer \ Executable_fodtfuzzer \ Executable_fodt2pdffuzzer \ + Executable_fods2xlsfuzzer \ Executable_fodsfuzzer \ Executable_fodpfuzzer \ Executable_xlsfuzzer \ diff --git a/vcl/workben/fftester.cxx b/vcl/workben/fftester.cxx index 753c59e2653c..587b26fd2495 100644 --- a/vcl/workben/fftester.cxx +++ b/vcl/workben/fftester.cxx @@ -332,6 +332,16 @@ SAL_IMPLEMENT_MAIN_WITH_ARGS(argc, argv) SvFileStream aFileStream(out, StreamMode::READ); ret = static_cast<int>((*pfnImport)(aFileStream)); } + else if (strcmp(argv[2], "fods2xls") == 0) + { + static FFilterCall pfnImport(nullptr); + if (!pfnImport) + { + pfnImport = load(u"libsclo.so", "TestFODSExportXLS"); + } + SvFileStream aFileStream(out, StreamMode::READ); + ret = static_cast<int>((*pfnImport)(aFileStream)); + } else if (strcmp(argv[2], "docx") == 0) { static FFilterCall pfnImport(nullptr); diff --git a/vcl/workben/fods2xlsfuzzer.cxx b/vcl/workben/fods2xlsfuzzer.cxx new file mode 100644 index 000000000000..9436a4403e3d --- /dev/null +++ b/vcl/workben/fods2xlsfuzzer.cxx @@ -0,0 +1,96 @@ +/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * This file is part of the LibreOffice project. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. + */ + +#include <tools/stream.hxx> +#include <vcl/FilterConfigItem.hxx> +#include <com/sun/star/awt/XToolkit.hpp> +#include <com/sun/star/ucb/XContentProvider.hpp> +#include <com/sun/star/ucb/XUniversalContentBroker.hpp> +#include <libxml/parser.h> +#include "commonfuzzer.hxx" + +extern "C" void* ScCreateDialogFactory() { return nullptr; } + +extern "C" bool TestFODSExportXLS(SvStream& rStream); + +static void silent_error_func(void*, const char* /*format*/, ...) {} + +extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) +{ + if (__lsan_disable) + __lsan_disable(); + + CommonInitialize(argc, argv); + + // initialise unconfigured UCB: + css::uno::Reference<css::ucb::XUniversalContentBroker> xUcb( + comphelper::getProcessServiceFactory()->createInstance( + "com.sun.star.ucb.UniversalContentBroker"), + css::uno::UNO_QUERY_THROW); + css::uno::Sequence<css::uno::Any> aArgs{ css::uno::Any(OUString("NoConfig")) }; + css::uno::Reference<css::ucb::XContentProvider> xFileProvider( + comphelper::getProcessServiceFactory()->createInstanceWithArguments( + "com.sun.star.ucb.FileContentProvider", aArgs), + css::uno::UNO_QUERY_THROW); + xUcb->registerContentProvider(xFileProvider, "file", true); + + // create and hold a reference to XToolkit here to avoid the lsan warning about its leak + // due to getting created in the unusual case of no vcl main loop + static css::uno::Reference<css::awt::XToolkit> xTk( + comphelper::getProcessServiceFactory()->createInstance("com.sun.star.awt.Toolkit"), + css::uno::UNO_QUERY_THROW); + + if (__lsan_enable) + __lsan_enable(); + + xmlInitParser(); + xmlSetGenericErrorFunc(nullptr, silent_error_func); + + return 0; +} + +extern "C" size_t LLVMFuzzerMutate(uint8_t* Data, size_t Size, size_t MaxSize); + +extern "C" { +__attribute__((weak)) void __msan_unpoison(const volatile void*, size_t) {} +} + +extern "C" size_t LLVMFuzzerCustomMutator(uint8_t* Data, size_t Size, size_t MaxSize, + unsigned int /*Seed*/) +{ + size_t Ret = LLVMFuzzerMutate(Data, Size, MaxSize); + + __msan_unpoison(Data, Ret); + + // an effort to only generate valid xml, in this fuzzer we only really care + // about the deeper levels of turning valid input into calc layout and + // xls export + + xmlParserCtxtPtr ctxt = xmlNewParserCtxt(); + xmlDocPtr Doc = xmlCtxtReadMemory(ctxt, reinterpret_cast<const char*>(Data), Ret, nullptr, + nullptr, XML_PARSE_NONET); + if (Doc == nullptr) + Ret = 0; + else + xmlFreeDoc(Doc); + xmlFreeParserCtxt(ctxt); + xmlResetLastError(); + return Ret; +} + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + SvMemoryStream aStream(const_cast<uint8_t*>(data), size, StreamMode::READ); + bool bFODTLoaded = TestFODSExportXLS(aStream); + // if the fodt didn't load then reject so that input will not be added to the corpus + // we're not interested in input that doesn't go on to exercise the xls export + return bFODTLoaded ? 0 : -1; +} + +/* vim:set shiftwidth=4 softtabstop=4 expandtab: */ diff --git a/vcl/workben/fods2xlsfuzzer.options b/vcl/workben/fods2xlsfuzzer.options new file mode 100644 index 000000000000..b75fa1aff355 --- /dev/null +++ b/vcl/workben/fods2xlsfuzzer.options @@ -0,0 +1,3 @@ +[libfuzzer] +max_len = 32768 +dict = odf.dict
