Skip to content

Commit b19e73b

Browse files
vishalcoc44vishalcoc44
authored
Add fuzz targets for OSS-Fuzz integration (RLE + FormulaParser) (#1020)
* Add new module "poi-fuzz" for providing fuzz-targets for oss-fuzz * Add RLE decompression fuzz target for OSS-Fuzz integration * Add FormulaParser fuzz target and dictionary for OSS-Fuzz * Moving existing fuzz-targets will be done in a separate step
1 parent 54874ae commit b19e73b

File tree

5 files changed

+208
-1
lines changed

5 files changed

+208
-1
lines changed

‎poi-fuzz/build.gradle‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
/* ====================================================================
2+
Licensed to the Apache Software Foundation (ASF) under one or more
3+
contributor license agreements. See the NOTICE file distributed with
4+
this work for additional information regarding copyright ownership.
5+
The ASF licenses this file to You under the Apache License, Version 2.0
6+
(the "License"); you may not use this file except in compliance with
7+
the License. You may obtain a copy of the License at
8+
9+
http://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
==================================================================== */
17+
18+
// Fuzz targets for OSS-Fuzz integration.
19+
// Jazzer is provided at runtime by the OSS-Fuzz build environment; we only
20+
// need the API jar at compile time.
21+
22+
dependencies {
23+
implementation project(':poi')
24+
25+
compileOnly 'com.code-intelligence:jazzer-api:0.22.0'
26+
}
27+
28+
// Fuzz targets are not standard JUnit tests; disable the test task.
29+
test.enabled = false
30+
31+
javadoc.enabled = false
32+
sourcesJar.enabled = false
33+
34+
generateMetadataFileForPOIPublication.enabled = false
35+
publishPOIPublicationToMavenLocal.enabled = false

‎poi-fuzz/src/main/java/org/apache/poi/fuzz/FormulaParserFuzzer.dict‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one or more
2+
# contributor license agreements. See the NOTICE file distributed with
3+
# this work for additional information regarding copyright ownership.
4+
# The ASF licenses this file to You under the Apache License, Version 2.0
5+
# (the "License"); you may not use this file except in compliance with
6+
# the License. You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
# Excel Formula Dictionary for FormulaParserFuzzer
17+
"SUM"
18+
"AVERAGE"
19+
"COUNT"
20+
"IF"
21+
"VLOOKUP"
22+
"Table1"
23+
"["
24+
"]"
25+
"[["
26+
"]]"
27+
"#"
28+
"#All"
29+
"#Headers"
30+
"#Data"
31+
"#Totals"
32+
"#This Row"
33+
"'"
34+
"!"
35+
":"
36+
","
37+
"("
38+
")"
39+
"\""
40+
"+"
41+
"-"
42+
"*"
43+
"/"
44+
"^"
45+
"&"
46+
"="
47+
"<"
48+
">"
49+
"<="
50+
">="
51+
"<>"
52+
"$"
53+
"."
54+
" "
55+
"@"
56+
"A1"
57+
"B2"
58+
"C3"
59+
"Sheet1"
60+
"Sheet2"
61+
"NamedRange"
62+
"Column1"
63+
"Column2"

‎poi-fuzz/src/main/java/org/apache/poi/fuzz/FormulaParserFuzzer.java‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
/* ====================================================================
2+
Licensed to the Apache Software Foundation (ASF) under one or more
3+
contributor license agreements. See the NOTICE file distributed with
4+
this work for additional information regarding copyright ownership.
5+
The ASF licenses this file to You under the Apache License, Version 2.0
6+
(the "License"); you may not use this file except in compliance with
7+
the License. You may obtain a copy of the License at
8+
9+
http://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
==================================================================== */
17+
18+
package org.apache.poi.fuzz;
19+
20+
import com.code_intelligence.jazzer.api.FuzzedDataProvider;
21+
import org.apache.poi.hssf.usermodel.HSSFEvaluationWorkbook;
22+
import org.apache.poi.hssf.usermodel.HSSFWorkbook;
23+
import org.apache.poi.ss.formula.FormulaParser;
24+
import org.apache.poi.ss.formula.FormulaType;
25+
import org.apache.poi.ss.formula.FormulaParseException;
26+
import org.apache.poi.util.RecordFormatException;
27+
28+
import java.nio.BufferUnderflowException;
29+
import java.util.NoSuchElementException;
30+
31+
/**
32+
* Fuzz target for the Apache POI Formula Parser.
33+
* Used by Google's OSS-Fuzz for continuous security testing.
34+
*/
35+
public class FormulaParserFuzzer {
36+
private static HSSFWorkbook workbook;
37+
private static HSSFEvaluationWorkbook evalWorkbook;
38+
39+
public static void fuzzerInitialize() {
40+
workbook = new HSSFWorkbook();
41+
evalWorkbook = HSSFEvaluationWorkbook.create(workbook);
42+
}
43+
44+
public static void fuzzerTestOneInput(FuzzedDataProvider data) {
45+
try {
46+
FormulaType formulaType = data.pickValue(FormulaType.values());
47+
int sheetIndex = data.consumeInt(-1, 10);
48+
String formula = data.consumeRemainingAsString();
49+
50+
if (formula == null || formula.isEmpty()) {
51+
return;
52+
}
53+
54+
FormulaParser.parse(formula, evalWorkbook, formulaType, sheetIndex);
55+
56+
} catch (FormulaParseException | IllegalArgumentException | IllegalStateException |
57+
IndexOutOfBoundsException | ArithmeticException | NegativeArraySizeException |
58+
RecordFormatException | BufferUnderflowException |
59+
UnsupportedOperationException | NoSuchElementException e) {
60+
// Expected exceptions on malformed formula syntax
61+
}
62+
}
63+
}

‎poi-fuzz/src/main/java/org/apache/poi/fuzz/POIRleFuzzer.java‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
/* ====================================================================
2+
Licensed to the Apache Software Foundation (ASF) under one or more
3+
contributor license agreements. See the NOTICE file distributed with
4+
this work for additional information regarding copyright ownership.
5+
The ASF licenses this file to You under the Apache License, Version 2.0
6+
(the "License"); you may not use this file except in compliance with
7+
the License. You may obtain a copy of the License at
8+
9+
http://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
==================================================================== */
17+
18+
package org.apache.poi.fuzz;
19+
20+
import org.apache.poi.util.RLEDecompressingInputStream;
21+
22+
import java.io.ByteArrayInputStream;
23+
import java.io.IOException;
24+
25+
/**
26+
* Fuzz target for RLEDecompressingInputStream.
27+
* Used by Google's OSS-Fuzz for continuous security testing.
28+
*/
29+
public class POIRleFuzzer {
30+
public static void fuzzerInitialize() {
31+
}
32+
33+
public static void fuzzerTestOneInput(byte[] input) {
34+
try (RLEDecompressingInputStream rleStream =
35+
new RLEDecompressingInputStream(new ByteArrayInputStream(input))) {
36+
37+
byte[] buffer = new byte[1024];
38+
while (rleStream.read(buffer) != -1) {
39+
// Trigger decompression logic
40+
}
41+
} catch (IOException | IllegalArgumentException | IllegalStateException | IndexOutOfBoundsException e) {
42+
// Expected exceptions on malformed input
43+
}
44+
}
45+
}

‎settings.gradle‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
rootProject.name = 'poi'
22

33
include 'poi', 'poi-ooxml-full', 'poi-ooxml-lite-agent', 'poi-scratchpad',
4-
'poi-ooxml', 'poi-excelant', 'poi-examples', 'poi-integration' , 'poi-ooxml-lite'
4+
'poi-ooxml', 'poi-excelant', 'poi-examples', 'poi-integration', 'poi-ooxml-lite',
5+
'poi-fuzz'

0 commit comments

Comments
 (0)