add rtf fuzzer

Change-Id: I36a6294c158232bef8fceeaf5159527f467f5786

6 files changed, 92 insertions, 6 deletions

diff --git a/vcl/CustomTarget_nativecode.mk b/vcl/CustomTarget_nativecode.mk
index f424a2170dca..f092541a5f66 100644
--- a/vcl/CustomTarget_nativecode.mk
+++ b/vcl/CustomTarget_nativecode.mk
@@ -13,6 +13,6 @@ fuzzer_PYTHONCOMMAND := $(call gb_ExternalExecutable_get_command,python)
 fuzzer_Native_cxx=$(call gb_CustomTarget_get_workdir,vcl/workben)/native-code.cxx
 
 $(fuzzer_Native_cxx): $(SRCDIR)/solenv/bin/native-code.py | $(call gb_CustomTarget_get_workdir,vcl/workben)/.dir
-	$(call gb_Helper_abbreviate_dirs, $(fuzzer_PYTHONCOMMAND) $(SRCDIR)/solenv/bin/native-code.py -g core -g draw) > $@
+	$(call gb_Helper_abbreviate_dirs, $(fuzzer_PYTHONCOMMAND) $(SRCDIR)/solenv/bin/native-code.py -g core -g draw -g writer) > $@
 
 # vim: set noet sw=4 ts=4:
diff --git a/vcl/Executable_rtffuzzer.mk b/vcl/Executable_rtffuzzer.mk
new file mode 100644
index 000000000000..38b64a179f27
--- /dev/null
+++ b/vcl/Executable_rtffuzzer.mk
@@ -0,0 +1,47 @@
+# -*- Mode: makefile-gmake; tab-width: 4; indent-tabs-mode: t -*-
+#
+#
+# This file is part of the LibreOffice project.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+
+include $(SRCDIR)/vcl/commonfuzzer.mk
+
+$(eval $(call gb_Executable_Executable,rtffuzzer))
+
+$(eval $(call gb_Executable_use_api,rtffuzzer,\
+    offapi \
+    udkapi \
+))
+
+$(eval $(call gb_Executable_use_externals,rtffuzzer,\
+	$(fuzzer_externals) \
+))
+
+$(eval $(call gb_Executable_set_include,rtffuzzer,\
+    $$(INCLUDE) \
+    -I$(SRCDIR)/vcl/inc \
+))
+
+$(eval $(call gb_Executable_use_libraries,rtffuzzer,\
+	$(fuzzer_libraries) \
+))
+
+$(eval $(call gb_Executable_use_static_libraries,rtffuzzer,\
+    findsofficepath \
+    ulingu \
+    fuzzer \
+))
+
+$(eval $(call gb_Executable_add_exception_objects,rtffuzzer,\
+	vcl/workben/rtffuzzer \
+))
+
+$(eval $(call gb_Executable_add_libs,rtffuzzer,\
+	-lFuzzingEngine \
+))
+
+# vim: set noet sw=4 ts=4:
diff --git a/vcl/Module_vcl.mk b/vcl/Module_vcl.mk
index 52f93e060551..c70c07a0d2c7 100644
--- a/vcl/Module_vcl.mk
+++ b/vcl/Module_vcl.mk
@@ -129,7 +129,8 @@ $(eval $(call gb_Module_add_targets,vcl,\
     Executable_602fuzzer \
     Executable_lwpfuzzer \
     Executable_olefuzzer \
-	Executable_pptfuzzer \
+    Executable_pptfuzzer \
+    Executable_rtffuzzer \
 ))
 endif
 
diff --git a/vcl/commonfuzzer.mk b/vcl/commonfuzzer.mk
index 8892b86c015a..fa1320913563 100644
--- a/vcl/commonfuzzer.mk
+++ b/vcl/commonfuzzer.mk
@@ -38,6 +38,11 @@ fuzzer_externals = \
     zlib \
 
 fuzzer_libraries = \
+    msword \
+    sw \
+    swd \
+    writerfilter \
+    textfd \
     sdfilt \
     sd \
     sdd \
diff --git a/vcl/workben/fftester.cxx b/vcl/workben/fftester.cxx
index 1dc51e2bdafd..3b7a1619d45e 100644
--- a/vcl/workben/fftester.cxx
+++ b/vcl/workben/fftester.cxx
@@ -67,7 +67,6 @@ extern "C" { static void SAL_CALL thisModule() {} }
 #endif
 
 typedef bool (*WFilterCall)(const OUString &rUrl, const OUString &rFlt);
-typedef bool (*HFilterCall)(const OUString &rUrl);
 typedef bool (*FFilterCall)(SvStream &rStream);
 
 /* This constant specifies the number of inputs to process before restarting.
@@ -349,16 +348,17 @@ try_again:
             }
             else if (strcmp(argv[2], "rtf") == 0)
             {
-                static HFilterCall pfnImport(nullptr);
+                static FFilterCall pfnImport(nullptr);
                 if (!pfnImport)
                 {
                     osl::Module aLibrary;
                     aLibrary.loadRelative(&thisModule, "libmswordlo.so", SAL_LOADMODULE_LAZY);
-                    pfnImport = reinterpret_cast<HFilterCall>(
+                    pfnImport = reinterpret_cast<FFilterCall>(
                         aLibrary.getFunctionSymbol("TestImportRTF"));
                     aLibrary.release();
                 }
-                ret = (int) (*pfnImport)(out);
+                SvFileStream aFileStream(out, StreamMode::READ);
+                ret = (int) (*pfnImport)(aFileStream);
             }
             else if ( (strcmp(argv[2], "xls") == 0) ||
                       (strcmp(argv[2], "wb2") == 0) )
diff --git a/vcl/workben/rtffuzzer.cxx b/vcl/workben/rtffuzzer.cxx
new file mode 100644
index 000000000000..88f9b48c8c80
--- /dev/null
+++ b/vcl/workben/rtffuzzer.cxx
@@ -0,0 +1,33 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/*
+ * This file is part of the LibreOffice project.
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+#include <tools/stream.hxx>
+#include <vcl/FilterConfigItem.hxx>
+#include "commonfuzzer.hxx"
+
+extern "C" bool TestImportRTF(SvStream &rStream);
+
+extern "C" int LLVMFuzzerInitialize(int *argc, char ***argv)
+{
+    TypicalFuzzerInitialize(argc, argv);
+    return 0;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+    SvMemoryStream aStream(const_cast<uint8_t*>(data), size, StreamMode::READ);
+    (void)TestImportRTF(aStream);
+    //fontconfigs alloc mechanism is too complicated for lsan/valgrind so
+    //force the fontconfig options to be released now, they are demand loaded
+    //so will be recreated if necessary
+    SvpSalGraphics::getPlatformGlyphCache().ClearFontOptions();
+    return 0;
+}
+
+/* vim:set shiftwidth=4 softtabstop=4 expandtab: */