Repository.mk | 1 bin/oss-fuzz-setup.sh | 1 vcl/Executable_fodt2pdffuzzer.mk | 50 ++++++++++++++++++++++++++++++ vcl/Module_vcl.mk | 1 vcl/workben/fodt2pdffuzzer.cxx | 61 +++++++++++++++++++++++++++++++++++++ vcl/workben/fodt2pdffuzzer.options | 3 + 6 files changed, 117 insertions(+)
New commits: commit 2f1860199ace72973a0092493c5b1c6bc1a077be Author: Caolán McNamara <[email protected]> AuthorDate: Fri Apr 28 20:28:41 2023 +0100 Commit: Caolán McNamara <[email protected]> CommitDate: Sat Apr 29 20:42:59 2023 +0200 reject fodt input that doesn't load and so doesn't exercise pdf export Change-Id: Ie8596618f62d245f35cb56e128c529464bc7cc25 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151177 Tested-by: Jenkins Reviewed-by: Caolán McNamara <[email protected]> diff --git a/vcl/workben/fodt2pdffuzzer.cxx b/vcl/workben/fodt2pdffuzzer.cxx index a80d24dd25a7..cc73b895d640 100644 --- a/vcl/workben/fodt2pdffuzzer.cxx +++ b/vcl/workben/fodt2pdffuzzer.cxx @@ -52,8 +52,10 @@ extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { SvMemoryStream aStream(const_cast<uint8_t*>(data), size, StreamMode::READ); - (void)TestPDFExportFODT(aStream); - return 0; + bool bFODTLoaded = TestPDFExportFODT(aStream); + // if the fodt didn't load then reject so that input will not be added to the corpus + // we're not interested in input that doesn't go on to exercise the pdf export + return bFODTLoaded ? 0 : -1; } /* vim:set shiftwidth=4 softtabstop=4 expandtab: */ commit 6c3f27c794b90e2877edd72689d7d8284fecff00 Author: Caolán McNamara <[email protected]> AuthorDate: Thu Apr 27 20:13:37 2023 +0100 Commit: Caolán McNamara <[email protected]> CommitDate: Sat Apr 29 20:42:51 2023 +0200 add a fodt to pdf fuzzer Initially give it a fairly tiny input size limit. Change-Id: Iabc2611174e88f1f6050edb21da4f28694bac4a8 Reviewed-on: https://gerrit.libreoffice.org/c/core/+/151151 Tested-by: Jenkins Reviewed-by: Caolán McNamara <[email protected]> diff --git a/Repository.mk b/Repository.mk index 1b2664c76e5d..bf576683389a 100644 --- a/Repository.mk +++ b/Repository.mk @@ -144,6 +144,7 @@ $(eval $(call gb_Helper_register_executables_for_install,OOO,brand, \ $(call gb_Helper_optional,FUZZERS,qpwfuzzer) \ $(call gb_Helper_optional,FUZZERS,slkfuzzer) \ $(call gb_Helper_optional,FUZZERS,fodtfuzzer) \ + $(call gb_Helper_optional,FUZZERS,fodt2pdffuzzer) \ $(call gb_Helper_optional,FUZZERS,fodsfuzzer) \ $(call gb_Helper_optional,FUZZERS,fodpfuzzer) \ $(call gb_Helper_optional,FUZZERS,xlsfuzzer) \ diff --git a/bin/oss-fuzz-setup.sh b/bin/oss-fuzz-setup.sh index 9268e39c4b06..3e27957d8d91 100755 --- a/bin/oss-fuzz-setup.sh +++ b/bin/oss-fuzz-setup.sh @@ -153,5 +153,6 @@ curl --no-progress-meter -S \ -C - -O https://dev-www.libreoffice.org/corpus/mtpfuzzer_seed_corpus.zip \ -C - -O https://dev-www.libreoffice.org/corpus/htmlfuzzer_seed_corpus.zip \ -C - -O https://dev-www.libreoffice.org/corpus/zipfuzzer_seed_corpus.zip +cp fodtfuzzer_seed_corpus.zip fodt2pdffuzzer_seed_corpus.zip echo end downloading dependencies at `date -u` diff --git a/vcl/Executable_fodt2pdffuzzer.mk b/vcl/Executable_fodt2pdffuzzer.mk new file mode 100644 index 000000000000..d4ba9f666519 --- /dev/null +++ b/vcl/Executable_fodt2pdffuzzer.mk @@ -0,0 +1,50 @@ +# -*- Mode: makefile-gmake; tab-width: 4; indent-tabs-mode: t -*- +# +# +# This file is part of the LibreOffice project. +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. +# + +include $(SRCDIR)/vcl/commonfuzzer.mk + +$(eval $(call gb_Executable_Executable,fodt2pdffuzzer)) + +$(eval $(call gb_Executable_use_api,fodt2pdffuzzer,\ + offapi \ + udkapi \ +)) + +$(eval $(call gb_Executable_use_externals,fodt2pdffuzzer,\ + $(fuzzer_externals) \ + epubgen \ + revenge \ +)) + +$(eval $(call gb_Executable_set_include,fodt2pdffuzzer,\ + $$(INCLUDE) \ + -I$(SRCDIR)/vcl/inc \ +)) + +$(eval $(call gb_Executable_use_libraries,fodt2pdffuzzer,\ + $(fuzzer_writer_libraries) \ + $(fuzzer_core_libraries) \ + pdffilter \ +)) + +$(eval $(call gb_Executable_use_static_libraries,fodt2pdffuzzer,\ + $(fuzzer_statics) \ + fuzzer_writer \ +)) + +$(eval $(call gb_Executable_add_exception_objects,fodt2pdffuzzer,\ + vcl/workben/fodt2pdffuzzer \ +)) + +$(eval $(call gb_Executable_add_libs,fodt2pdffuzzer,\ + $(LIB_FUZZING_ENGINE) \ +)) + +# vim: set noet sw=4 ts=4: diff --git a/vcl/Module_vcl.mk b/vcl/Module_vcl.mk index b8728a8529e4..5265cd951243 100644 --- a/vcl/Module_vcl.mk +++ b/vcl/Module_vcl.mk @@ -177,6 +177,7 @@ $(eval $(call gb_Module_add_targets,vcl,\ Executable_qpwfuzzer \ Executable_slkfuzzer \ Executable_fodtfuzzer \ + Executable_fodt2pdffuzzer \ Executable_fodsfuzzer \ Executable_fodpfuzzer \ Executable_xlsfuzzer \ diff --git a/vcl/workben/fodt2pdffuzzer.cxx b/vcl/workben/fodt2pdffuzzer.cxx new file mode 100644 index 000000000000..a80d24dd25a7 --- /dev/null +++ b/vcl/workben/fodt2pdffuzzer.cxx @@ -0,0 +1,59 @@ +/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ +/* + * This file is part of the LibreOffice project. + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. + */ + +#include <tools/stream.hxx> +#include <vcl/FilterConfigItem.hxx> +#include <com/sun/star/awt/XToolkit.hpp> +#include <com/sun/star/ucb/XContentProvider.hpp> +#include <com/sun/star/ucb/XUniversalContentBroker.hpp> +#include "commonfuzzer.hxx" + +extern "C" void* SwCreateDialogFactory() { return nullptr; } + +extern "C" bool TestPDFExportFODT(SvStream& rStream); + +extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) +{ + if (__lsan_disable) + __lsan_disable(); + + CommonInitialize(argc, argv); + + // initialise unconfigured UCB: + css::uno::Reference<css::ucb::XUniversalContentBroker> xUcb( + comphelper::getProcessServiceFactory()->createInstance( + "com.sun.star.ucb.UniversalContentBroker"), + css::uno::UNO_QUERY_THROW); + css::uno::Sequence<css::uno::Any> aArgs{ css::uno::Any(OUString("NoConfig")) }; + css::uno::Reference<css::ucb::XContentProvider> xFileProvider( + comphelper::getProcessServiceFactory()->createInstanceWithArguments( + "com.sun.star.ucb.FileContentProvider", aArgs), + css::uno::UNO_QUERY_THROW); + xUcb->registerContentProvider(xFileProvider, "file", true); + + // create and hold a reference to XToolkit here to avoid the lsan warning about its leak + // due to getting created in the unusual case of no vcl main loop + static css::uno::Reference<awt::XToolkit> xTk( + comphelper::getProcessServiceFactory()->createInstance("com.sun.star.awt.Toolkit"), + css::uno::UNO_QUERY_THROW); + + if (__lsan_enable) + __lsan_enable(); + + return 0; +} + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) +{ + SvMemoryStream aStream(const_cast<uint8_t*>(data), size, StreamMode::READ); + (void)TestPDFExportFODT(aStream); + return 0; +} + +/* vim:set shiftwidth=4 softtabstop=4 expandtab: */ diff --git a/vcl/workben/fodt2pdffuzzer.options b/vcl/workben/fodt2pdffuzzer.options new file mode 100644 index 000000000000..1ae5aaff4b14 --- /dev/null +++ b/vcl/workben/fodt2pdffuzzer.options @@ -0,0 +1,3 @@ +[libfuzzer] +max_len = 2048 +dict = xml.dict
