summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--Repository.mk1
-rwxr-xr-xbin/oss-fuzz-setup.sh1
-rw-r--r--sc/source/filter/xml/xmlimprt.cxx76
-rw-r--r--vcl/Executable_fods2xlsfuzzer.mk50
-rw-r--r--vcl/Module_vcl.mk1
-rw-r--r--vcl/workben/fftester.cxx10
-rw-r--r--vcl/workben/fods2xlsfuzzer.cxx96
-rw-r--r--vcl/workben/fods2xlsfuzzer.options3
8 files changed, 238 insertions, 0 deletions
diff --git a/Repository.mk b/Repository.mk
index c0d86f868971..aa740fae6860 100644
--- a/Repository.mk
+++ b/Repository.mk
@@ -146,6 +146,7 @@ $(eval $(call gb_Helper_register_executables_for_install,OOO,brand, \
$(call gb_Helper_optional,FUZZERS,slkfuzzer) \
$(call gb_Helper_optional,FUZZERS,fodtfuzzer) \
$(call gb_Helper_optional,FUZZERS,fodt2pdffuzzer) \
+ $(call gb_Helper_optional,FUZZERS,fods2xlsfuzzer) \
$(call gb_Helper_optional,FUZZERS,fodsfuzzer) \
$(call gb_Helper_optional,FUZZERS,fodpfuzzer) \
$(call gb_Helper_optional,FUZZERS,xlsfuzzer) \
diff --git a/bin/oss-fuzz-setup.sh b/bin/oss-fuzz-setup.sh
index 5e7452640799..d8ad9f44f262 100755
--- a/bin/oss-fuzz-setup.sh
+++ b/bin/oss-fuzz-setup.sh
@@ -166,5 +166,6 @@ curl --no-progress-meter -S \
-C - -O https://dev-www.libreoffice.org/corpus/htmlfuzzer_seed_corpus.zip \
-C - -O https://dev-www.libreoffice.org/corpus/zipfuzzer_seed_corpus.zip
cp fodtfuzzer_seed_corpus.zip fodt2pdffuzzer_seed_corpus.zip
+cp fodsfuzzer_seed_corpus.zip fods2xlsfuzzer_seed_corpus.zip
echo end downloading dependencies at `date -u`
diff --git a/sc/source/filter/xml/xmlimprt.cxx b/sc/source/filter/xml/xmlimprt.cxx
index b94d1d44d8fa..dcd8229c77ad 100644
--- a/sc/source/filter/xml/xmlimprt.cxx
+++ b/sc/source/filter/xml/xmlimprt.cxx
@@ -29,6 +29,7 @@
#include <xmloff/xmlmetai.hxx>
#include <sfx2/objsh.hxx>
#include <unotools/streamwrap.hxx>
+#include <unotools/tempfile.hxx>
#include <xmloff/xmlscripti.hxx>
#include <xmloff/XMLFontStylesContext.hxx>
#include <xmloff/DocumentSettingsContext.hxx>
@@ -83,6 +84,7 @@
#include <comphelper/processfactory.hxx>
#include <com/sun/star/document/XDocumentPropertiesSupplier.hpp>
+#include <com/sun/star/document/XExporter.hpp>
#include <com/sun/star/frame/XModel.hpp>
#include <com/sun/star/io/IOException.hpp>
#include <com/sun/star/lang/WrappedTargetRuntimeException.hpp>
@@ -1722,6 +1724,80 @@ extern "C" SAL_DLLPUBLIC_EXPORT bool TestImportFODS(SvStream &rStream)
return ret;
}
+extern "C" SAL_DLLPUBLIC_EXPORT bool TestFODSExportXLS(SvStream &rStream)
+{
+ ScDLL::Init();
+
+ SfxObjectShellLock xDocSh(new ScDocShell);
+ xDocSh->DoInitNew();
+ uno::Reference<frame::XModel> xModel(xDocSh->GetModel());
+
+ uno::Reference<lang::XMultiServiceFactory> xMultiServiceFactory(comphelper::getProcessServiceFactory());
+ uno::Reference<io::XInputStream> xStream(new ::utl::OSeekableInputStreamWrapper(rStream));
+ uno::Reference<uno::XInterface> xInterface(xMultiServiceFactory->createInstance("com.sun.star.comp.Writer.XmlFilterAdaptor"), uno::UNO_SET_THROW);
+
+ css::uno::Sequence<OUString> aUserData
+ {
+ "com.sun.star.comp.filter.OdfFlatXml",
+ "",
+ "com.sun.star.comp.Calc.XMLOasisImporter",
+ "com.sun.star.comp.Calc.XMLOasisExporter",
+ "",
+ "",
+ "true"
+ };
+ uno::Sequence<beans::PropertyValue> aAdaptorArgs(comphelper::InitPropertySequence(
+ {
+ { "UserData", uno::Any(aUserData) },
+ }));
+ css::uno::Sequence<uno::Any> aOuterArgs{ uno::Any(aAdaptorArgs) };
+
+ uno::Reference<lang::XInitialization> xInit(xInterface, uno::UNO_QUERY_THROW);
+ xInit->initialize(aOuterArgs);
+
+ uno::Reference<document::XImporter> xImporter(xInterface, uno::UNO_QUERY_THROW);
+ uno::Sequence<beans::PropertyValue> aArgs(comphelper::InitPropertySequence(
+ {
+ { "InputStream", uno::Any(xStream) },
+ { "URL", uno::Any(OUString("private:stream")) },
+ }));
+ xImporter->setTargetDocument(xModel);
+
+ uno::Reference<document::XFilter> xFilter(xInterface, uno::UNO_QUERY_THROW);
+ //SetLoading hack because the document properties will be re-initted
+ //by the xml filter and during the init, while it's considered uninitialized,
+ //setting a property will inform the document it's modified, which attempts
+ //to update the properties, which throws cause the properties are uninitialized
+ xDocSh->SetLoading(SfxLoadedFlags::NONE);
+ bool ret = xFilter->filter(aArgs);
+ xDocSh->SetLoading(SfxLoadedFlags::ALL);
+
+ if (ret)
+ {
+ utl::TempFileFast aTempFile;
+
+ uno::Reference<document::XFilter> xXLSFilter(
+ xMultiServiceFactory->createInstance("com.sun.star.comp.oox.xls.ExcelFilter"), uno::UNO_QUERY);
+ uno::Reference<document::XExporter> xExporter(xXLSFilter, uno::UNO_QUERY);
+ xExporter->setSourceDocument(xModel);
+
+ uno::Reference<io::XOutputStream> xOutputStream(new utl::OStreamWrapper(*aTempFile.GetStream(StreamMode::READWRITE)));
+
+ uno::Sequence<beans::PropertyValue> aFilterData(comphelper::InitPropertySequence({
+ }));
+ uno::Sequence<beans::PropertyValue> aDescriptor(comphelper::InitPropertySequence({
+ { "FilterName", uno::Any(u"Excel 2007–365"_ustr) },
+ { "OutputStream", uno::Any(xOutputStream) },
+ { "FilterData", uno::Any(aFilterData) }
+ }));
+ xXLSFilter->filter(aDescriptor);
+ }
+
+ xDocSh->DoClose();
+
+ return ret;
+}
+
extern "C" SAL_DLLPUBLIC_EXPORT bool TestImportXLSX(SvStream &rStream)
{
ScDLL::Init();
diff --git a/vcl/Executable_fods2xlsfuzzer.mk b/vcl/Executable_fods2xlsfuzzer.mk
new file mode 100644
index 000000000000..2c11d5d23e95
--- /dev/null
+++ b/vcl/Executable_fods2xlsfuzzer.mk
@@ -0,0 +1,50 @@
+# -*- Mode: makefile-gmake; tab-width: 4; indent-tabs-mode: t -*-
+#
+#
+# This file is part of the LibreOffice project.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+
+include $(SRCDIR)/vcl/commonfuzzer.mk
+
+$(eval $(call gb_Executable_Executable,fods2xlsfuzzer))
+
+$(eval $(call gb_Executable_use_api,fods2xlsfuzzer,\
+ offapi \
+ udkapi \
+))
+
+$(eval $(call gb_Executable_use_externals,fods2xlsfuzzer,\
+ $(fuzzer_externals) \
+ epubgen \
+ revenge \
+))
+
+$(eval $(call gb_Executable_set_include,fods2xlsfuzzer,\
+ $$(INCLUDE) \
+ -I$(SRCDIR)/vcl/inc \
+))
+
+$(eval $(call gb_Executable_use_libraries,fods2xlsfuzzer,\
+ $(fuzzer_calc_libraries) \
+ $(fuzzer_core_libraries) \
+ pdffilter \
+))
+
+$(eval $(call gb_Executable_use_static_libraries,fods2xlsfuzzer,\
+ $(fuzzer_statics) \
+ fuzzer_calc \
+))
+
+$(eval $(call gb_Executable_add_exception_objects,fods2xlsfuzzer,\
+ vcl/workben/fods2xlsfuzzer \
+))
+
+$(eval $(call gb_Executable_add_libs,fods2xlsfuzzer,\
+ $(LIB_FUZZING_ENGINE) \
+))
+
+# vim: set noet sw=4 ts=4:
diff --git a/vcl/Module_vcl.mk b/vcl/Module_vcl.mk
index 31d751a6e332..c0729d78209b 100644
--- a/vcl/Module_vcl.mk
+++ b/vcl/Module_vcl.mk
@@ -191,6 +191,7 @@ $(eval $(call gb_Module_add_targets,vcl,\
Executable_slkfuzzer \
Executable_fodtfuzzer \
Executable_fodt2pdffuzzer \
+ Executable_fods2xlsfuzzer \
Executable_fodsfuzzer \
Executable_fodpfuzzer \
Executable_xlsfuzzer \
diff --git a/vcl/workben/fftester.cxx b/vcl/workben/fftester.cxx
index 753c59e2653c..587b26fd2495 100644
--- a/vcl/workben/fftester.cxx
+++ b/vcl/workben/fftester.cxx
@@ -332,6 +332,16 @@ SAL_IMPLEMENT_MAIN_WITH_ARGS(argc, argv)
SvFileStream aFileStream(out, StreamMode::READ);
ret = static_cast<int>((*pfnImport)(aFileStream));
}
+ else if (strcmp(argv[2], "fods2xls") == 0)
+ {
+ static FFilterCall pfnImport(nullptr);
+ if (!pfnImport)
+ {
+ pfnImport = load(u"libsclo.so", "TestFODSExportXLS");
+ }
+ SvFileStream aFileStream(out, StreamMode::READ);
+ ret = static_cast<int>((*pfnImport)(aFileStream));
+ }
else if (strcmp(argv[2], "docx") == 0)
{
static FFilterCall pfnImport(nullptr);
diff --git a/vcl/workben/fods2xlsfuzzer.cxx b/vcl/workben/fods2xlsfuzzer.cxx
new file mode 100644
index 000000000000..9436a4403e3d
--- /dev/null
+++ b/vcl/workben/fods2xlsfuzzer.cxx
@@ -0,0 +1,96 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/*
+ * This file is part of the LibreOffice project.
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+#include <tools/stream.hxx>
+#include <vcl/FilterConfigItem.hxx>
+#include <com/sun/star/awt/XToolkit.hpp>
+#include <com/sun/star/ucb/XContentProvider.hpp>
+#include <com/sun/star/ucb/XUniversalContentBroker.hpp>
+#include <libxml/parser.h>
+#include "commonfuzzer.hxx"
+
+extern "C" void* ScCreateDialogFactory() { return nullptr; }
+
+extern "C" bool TestFODSExportXLS(SvStream& rStream);
+
+static void silent_error_func(void*, const char* /*format*/, ...) {}
+
+extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv)
+{
+ if (__lsan_disable)
+ __lsan_disable();
+
+ CommonInitialize(argc, argv);
+
+ // initialise unconfigured UCB:
+ css::uno::Reference<css::ucb::XUniversalContentBroker> xUcb(
+ comphelper::getProcessServiceFactory()->createInstance(
+ "com.sun.star.ucb.UniversalContentBroker"),
+ css::uno::UNO_QUERY_THROW);
+ css::uno::Sequence<css::uno::Any> aArgs{ css::uno::Any(OUString("NoConfig")) };
+ css::uno::Reference<css::ucb::XContentProvider> xFileProvider(
+ comphelper::getProcessServiceFactory()->createInstanceWithArguments(
+ "com.sun.star.ucb.FileContentProvider", aArgs),
+ css::uno::UNO_QUERY_THROW);
+ xUcb->registerContentProvider(xFileProvider, "file", true);
+
+ // create and hold a reference to XToolkit here to avoid the lsan warning about its leak
+ // due to getting created in the unusual case of no vcl main loop
+ static css::uno::Reference<css::awt::XToolkit> xTk(
+ comphelper::getProcessServiceFactory()->createInstance("com.sun.star.awt.Toolkit"),
+ css::uno::UNO_QUERY_THROW);
+
+ if (__lsan_enable)
+ __lsan_enable();
+
+ xmlInitParser();
+ xmlSetGenericErrorFunc(nullptr, silent_error_func);
+
+ return 0;
+}
+
+extern "C" size_t LLVMFuzzerMutate(uint8_t* Data, size_t Size, size_t MaxSize);
+
+extern "C" {
+__attribute__((weak)) void __msan_unpoison(const volatile void*, size_t) {}
+}
+
+extern "C" size_t LLVMFuzzerCustomMutator(uint8_t* Data, size_t Size, size_t MaxSize,
+ unsigned int /*Seed*/)
+{
+ size_t Ret = LLVMFuzzerMutate(Data, Size, MaxSize);
+
+ __msan_unpoison(Data, Ret);
+
+ // an effort to only generate valid xml, in this fuzzer we only really care
+ // about the deeper levels of turning valid input into calc layout and
+ // xls export
+
+ xmlParserCtxtPtr ctxt = xmlNewParserCtxt();
+ xmlDocPtr Doc = xmlCtxtReadMemory(ctxt, reinterpret_cast<const char*>(Data), Ret, nullptr,
+ nullptr, XML_PARSE_NONET);
+ if (Doc == nullptr)
+ Ret = 0;
+ else
+ xmlFreeDoc(Doc);
+ xmlFreeParserCtxt(ctxt);
+ xmlResetLastError();
+ return Ret;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size)
+{
+ SvMemoryStream aStream(const_cast<uint8_t*>(data), size, StreamMode::READ);
+ bool bFODTLoaded = TestFODSExportXLS(aStream);
+ // if the fodt didn't load then reject so that input will not be added to the corpus
+ // we're not interested in input that doesn't go on to exercise the xls export
+ return bFODTLoaded ? 0 : -1;
+}
+
+/* vim:set shiftwidth=4 softtabstop=4 expandtab: */
diff --git a/vcl/workben/fods2xlsfuzzer.options b/vcl/workben/fods2xlsfuzzer.options
new file mode 100644
index 000000000000..b75fa1aff355
--- /dev/null
+++ b/vcl/workben/fods2xlsfuzzer.options
@@ -0,0 +1,3 @@
+[libfuzzer]
+max_len = 32768
+dict = odf.dict
generated by cgit (git 2.34.1) at 2024-12-23 05:31:43 +0000