add fodp fuzzer

Change-Id: Ib6c439fa8db7de0544c8ee3340c07a40bf10bcb6
Reviewed-on: https://gerrit.libreoffice.org/42582
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>

7 files changed, 150 insertions, 1 deletions

diff --git a/Makefile.in b/Makefile.in
index 62924dc2aae0..47864801fb47 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -475,7 +475,7 @@ $(foreach ide,\
     eclipsecdt,\
 $(eval $(call gb_Top_GbuildToIdeIntegrationNS,$(ide))))
 
-fuzzers: Library_sal Library_salhelper Library_reg Library_store Library_unoidl codemaker Library_cppu Library_i18nlangtag Library_cppuhelper Library_comphelper StaticLibrary_ulingu StaticLibrary_findsofficepath Library_tl Library_basegfx Library_canvastools Library_cppcanvas Library_dbtools Library_deploymentmisc Library_deploymentmisc Library_editeng Library_fwe Library_fwi Library_i18nutil Library_localebe1 Library_sax Library_sofficeapp Library_ucbhelper Library_opencl Rdb_services udkapi offapi Library_clew Library_gie Library_icg Library_reflection Library_invocadapt Library_bootstrap Library_introspection Library_stocservices Library_xmlreader Library_gcc3_uno instsetoo_native more_fonts StaticLibrary_boost_locale StaticLibrary_fuzzerstubs StaticLibrary_fuzzer_core StaticLibrary_fuzzer_calc StaticLibrary_fuzzer_draw StaticLibrary_fuzzer_writer Library_forui Library_binaryurp Library_io Library_invocation Library_namingservice Library_proxyfac Library_uuresolver Module_ure Executable_wmffuzzer Executable_jpgfuzzer Executable_giffuzzer Executable_xbmfuzzer Executable_xpmfuzzer Executable_pngfuzzer Executable_bmpfuzzer Executable_svmfuzzer Executable_pcdfuzzer Executable_dxffuzzer Executable_metfuzzer Executable_ppmfuzzer Executable_psdfuzzer Executable_epsfuzzer Executable_pctfuzzer Executable_pcxfuzzer Executable_rasfuzzer Executable_tgafuzzer Executable_tiffuzzer Executable_hwpfuzzer Executable_602fuzzer Executable_lwpfuzzer Executable_olefuzzer Executable_pptfuzzer Executable_rtffuzzer Executable_cgmfuzzer Executable_ww2fuzzer Executable_ww6fuzzer Executable_ww8fuzzer Executable_qpwfuzzer Executable_slkfuzzer Executable_fodtfuzzer Executable_fodsfuzzer
+fuzzers: Library_sal Library_salhelper Library_reg Library_store Library_unoidl codemaker Library_cppu Library_i18nlangtag Library_cppuhelper Library_comphelper StaticLibrary_ulingu StaticLibrary_findsofficepath Library_tl Library_basegfx Library_canvastools Library_cppcanvas Library_dbtools Library_deploymentmisc Library_deploymentmisc Library_editeng Library_fwe Library_fwi Library_i18nutil Library_localebe1 Library_sax Library_sofficeapp Library_ucbhelper Library_opencl Rdb_services udkapi offapi Library_clew Library_gie Library_icg Library_reflection Library_invocadapt Library_bootstrap Library_introspection Library_stocservices Library_xmlreader Library_gcc3_uno instsetoo_native more_fonts StaticLibrary_boost_locale StaticLibrary_fuzzerstubs StaticLibrary_fuzzer_core StaticLibrary_fuzzer_calc StaticLibrary_fuzzer_draw StaticLibrary_fuzzer_writer Library_forui Library_binaryurp Library_io Library_invocation Library_namingservice Library_proxyfac Library_uuresolver Module_ure Executable_wmffuzzer Executable_jpgfuzzer Executable_giffuzzer Executable_xbmfuzzer Executable_xpmfuzzer Executable_pngfuzzer Executable_bmpfuzzer Executable_svmfuzzer Executable_pcdfuzzer Executable_dxffuzzer Executable_metfuzzer Executable_ppmfuzzer Executable_psdfuzzer Executable_epsfuzzer Executable_pctfuzzer Executable_pcxfuzzer Executable_rasfuzzer Executable_tgafuzzer Executable_tiffuzzer Executable_hwpfuzzer Executable_602fuzzer Executable_lwpfuzzer Executable_olefuzzer Executable_pptfuzzer Executable_rtffuzzer Executable_cgmfuzzer Executable_ww2fuzzer Executable_ww6fuzzer Executable_ww8fuzzer Executable_qpwfuzzer Executable_slkfuzzer Executable_fodtfuzzer Executable_fodsfuzzer Executable_fodpfuzzer
 
 endif # MAKE_RESTARTS
 
diff --git a/Repository.mk b/Repository.mk
index 268b4982018a..c5924473eafa 100644
--- a/Repository.mk
+++ b/Repository.mk
@@ -132,6 +132,7 @@ $(eval $(call gb_Helper_register_executables_for_install,OOO,brand, \
 	$(call gb_Helper_optional,FUZZERS,slkfuzzer) \
 	$(call gb_Helper_optional,FUZZERS,fodtfuzzer) \
 	$(call gb_Helper_optional,FUZZERS,fodsfuzzer) \
+	$(call gb_Helper_optional,FUZZERS,fodpfuzzer) \
 	$(if $(filter-out ANDROID IOS MACOSX WNT,$(OS)),oosplash) \
 	soffice_bin \
 	$(if $(filter DESKTOP,$(BUILD_TYPE)),unopkg_bin) \
diff --git a/sd/source/filter/xml/sdxmlwrp.cxx b/sd/source/filter/xml/sdxmlwrp.cxx
index fa3bcfa10cdf..4370f37b3828 100644
--- a/sd/source/filter/xml/sdxmlwrp.cxx
+++ b/sd/source/filter/xml/sdxmlwrp.cxx
@@ -24,6 +24,7 @@
 #include <com/sun/star/embed/ElementModes.hpp>
 #include <com/sun/star/xml/sax/SAXParseException.hpp>
 #include <comphelper/processfactory.hxx>
+#include <comphelper/propertysequence.hxx>
 #include <sfx2/docfile.hxx>
 #include <sfx2/docfilt.hxx>
 #include <sfx2/sfxsids.hrc>
@@ -43,6 +44,7 @@
 #include <com/sun/star/document/XFilter.hpp>
 #include <com/sun/star/document/XImporter.hpp>
 #include <com/sun/star/document/XExporter.hpp>
+#include <com/sun/star/lang/XInitialization.hpp>
 #include <com/sun/star/lang/XServiceInfo.hpp>
 #include <com/sun/star/document/XGraphicObjectResolver.hpp>
 #include <com/sun/star/beans/PropertyAttribute.hpp>
@@ -68,6 +70,7 @@
 #include <svl/stritem.hxx>
 #include <svtools/sfxecode.hxx>
 
+#include "sddll.hxx"
 #include "sderror.hxx"
 #include "sdresid.hxx"
 #include "sdtransform.hxx"
@@ -1002,4 +1005,52 @@ bool SdXMLFilter::Export()
     return bDocRet;
 }
 
+extern "C" SAL_DLLPUBLIC_EXPORT bool SAL_CALL TestImportFODP(SvStream &rStream)
+{
+    SdDLL::Init();
+
+    sd::DrawDocShellRef xDocSh(new sd::DrawDocShell(SfxObjectCreateMode::EMBEDDED, false));
+    xDocSh->DoInitNew();
+    uno::Reference<frame::XModel> xModel(xDocSh->GetModel());
+
+    uno::Reference<lang::XMultiServiceFactory> xMultiServiceFactory(comphelper::getProcessServiceFactory());
+    uno::Reference<io::XInputStream> xStream(new ::utl::OSeekableInputStreamWrapper(rStream));
+    uno::Reference<uno::XInterface> xInterface(xMultiServiceFactory->createInstance("com.sun.star.comp.Writer.XmlFilterAdaptor"), uno::UNO_QUERY_THROW);
+
+    css::uno::Sequence<OUString> aUserData(7);
+    aUserData[0] = "com.sun.star.comp.filter.OdfFlatXml";
+    aUserData[2] = "com.sun.star.comp.Impress.XMLOasisImporter";
+    aUserData[3] = "com.sun.star.comp.Impress.XMLOasisExporter";
+    aUserData[6] = "true";
+    uno::Sequence<beans::PropertyValue> aAdaptorArgs(comphelper::InitPropertySequence(
+    {
+        { "UserData", uno::Any(aUserData) },
+    }));
+    css::uno::Sequence<uno::Any> aOuterArgs(1);
+    aOuterArgs[0] <<= aAdaptorArgs;
+
+    uno::Reference<lang::XInitialization> xInit(xInterface, uno::UNO_QUERY_THROW);
+    xInit->initialize(aOuterArgs);
+
+    uno::Reference<document::XImporter> xImporter(xInterface, uno::UNO_QUERY_THROW);
+    uno::Sequence<beans::PropertyValue> aArgs(comphelper::InitPropertySequence(
+    {
+        { "InputStream", uno::Any(xStream) },
+        { "URL", uno::Any(OUString("private:stream")) },
+    }));
+    xImporter->setTargetDocument(xModel);
+
+    uno::Reference<document::XFilter> xFilter(xInterface, uno::UNO_QUERY_THROW);
+    //SetLoading hack because the document properties will be re-initted
+    //by the xml filter and during the init, while its considered uninitialized,
+    //setting a property will inform the document its modified, which attempts
+    //to update the properties, which throws cause the properties are uninitialized
+    xDocSh->SetLoading(SfxLoadedFlags::NONE);
+    bool ret = xFilter->filter(aArgs);
+    xDocSh->SetLoading(SfxLoadedFlags::ALL);
+
+    return ret;
+}
+
+
 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/vcl/Executable_fodpfuzzer.mk b/vcl/Executable_fodpfuzzer.mk
new file mode 100644
index 000000000000..1f8b05269b7c
--- /dev/null
+++ b/vcl/Executable_fodpfuzzer.mk
@@ -0,0 +1,49 @@
+# -*- Mode: makefile-gmake; tab-width: 4; indent-tabs-mode: t -*-
+#
+#
+# This file is part of the LibreOffice project.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+
+include $(SRCDIR)/vcl/commonfuzzer.mk
+
+$(eval $(call gb_Executable_Executable,fodpfuzzer))
+
+$(eval $(call gb_Executable_use_api,fodpfuzzer,\
+    offapi \
+    udkapi \
+))
+
+$(eval $(call gb_Executable_use_externals,fodpfuzzer,\
+	$(fuzzer_externals) \
+))
+
+$(eval $(call gb_Executable_set_include,fodpfuzzer,\
+    $$(INCLUDE) \
+    -I$(SRCDIR)/vcl/inc \
+))
+
+$(eval $(call gb_Executable_use_libraries,fodpfuzzer,\
+    $(fuzzer_draw_libraries) \
+    $(fuzzer_core_libraries) \
+))
+
+$(eval $(call gb_Executable_use_static_libraries,fodpfuzzer,\
+    findsofficepath \
+    ulingu \
+    fuzzer_draw \
+    fuzzerstubs \
+))
+
+$(eval $(call gb_Executable_add_exception_objects,fodpfuzzer,\
+	vcl/workben/fodpfuzzer \
+))
+
+$(eval $(call gb_Executable_add_libs,fodpfuzzer,\
+	-lFuzzingEngine \
+))
+
+# vim: set noet sw=4 ts=4:
diff --git a/vcl/Module_vcl.mk b/vcl/Module_vcl.mk
index 6cd31572c1c5..c3b001fff442 100644
--- a/vcl/Module_vcl.mk
+++ b/vcl/Module_vcl.mk
@@ -139,6 +139,7 @@ $(eval $(call gb_Module_add_targets,vcl,\
     Executable_slkfuzzer \
     Executable_fodtfuzzer \
     Executable_fodsfuzzer \
+    Executable_fodpfuzzer \
 ))
 endif
 
diff --git a/vcl/workben/fftester.cxx b/vcl/workben/fftester.cxx
index 4e806216d956..00fd982b4e02 100644
--- a/vcl/workben/fftester.cxx
+++ b/vcl/workben/fftester.cxx
@@ -407,6 +407,20 @@ try_again:
                 SvFileStream aFileStream(out, StreamMode::READ);
                 ret = (int) (*pfnImport)(aFileStream);
             }
+            else if (strcmp(argv[2], "fodp") == 0)
+            {
+                static FFilterCall pfnImport(nullptr);
+                if (!pfnImport)
+                {
+                    osl::Module aLibrary;
+                    aLibrary.loadRelative(&thisModule, "libsdlo.so", SAL_LOADMODULE_LAZY);
+                    pfnImport = reinterpret_cast<FFilterCall>(
+                        aLibrary.getFunctionSymbol("TestImportFODP"));
+                    aLibrary.release();
+                }
+                SvFileStream aFileStream(out, StreamMode::READ);
+                ret = (int) (*pfnImport)(aFileStream);
+            }
             else if (strcmp(argv[2], "xls") == 0)
             {
                 static WFilterCall pfnImport(nullptr);
diff --git a/vcl/workben/fodpfuzzer.cxx b/vcl/workben/fodpfuzzer.cxx
new file mode 100644
index 000000000000..cb775f7cae14
--- /dev/null
+++ b/vcl/workben/fodpfuzzer.cxx
@@ -0,0 +1,33 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/*
+ * This file is part of the LibreOffice project.
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+#include <tools/stream.hxx>
+#include <vcl/FilterConfigItem.hxx>
+#include "commonfuzzer.hxx"
+
+extern "C" bool TestImportFODP(SvStream &rStream);
+
+extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
+{
+    TypicalFuzzerInitialize(argc, argv);
+    return 0;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    SvMemoryStream aStream(const_cast<uint8_t*>(data), size, StreamMode::READ);
+    (void)TestImportFODP(aStream);
+    //fontconfigs alloc mechanism is too complicated for lsan/valgrind so
+    //force the fontconfig options to be released now, they are demand loaded
+    //so will be recreated if necessary
+    SvpSalGraphics::getPlatformGlyphCache().ClearFontOptions();
+    return 0;
+}
+
+/* vim:set shiftwidth=4 softtabstop=4 expandtab: */