You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@poi.apache.org by bu...@apache.org on 2023/01/16 10:54:54 UTC
[Bug 66425] New: Initial Integration of poi into oss-fuzz
https://bz.apache.org/bugzilla/show_bug.cgi?id=66425
Bug ID: 66425
Summary: Initial Integration of poi into oss-fuzz
Product: POI
Version: unspecified
Hardware: All
OS: All
Status: NEW
Severity: minor
Priority: P2
Component: POI Overall
Assignee: dev@poi.apache.org
Reporter: schaich@code-intelligence.com
Target Milestone: ---
Hi all,
we have prepared the Initial
Integration(https://github.com/CodeIntelligenceTesting/oss-fuzz/tree/apache-poi/projects/apache-poi)
of axis2 into Google OSS-Fuzz(https://github.com/google/oss-fuzz) which will
provide more security for your project.
Why do you need Fuzzing?
The Code Intelligence JVM fuzzer
Jazzer(https://github.com/CodeIntelligenceTesting/jazzer) has already found
hundreds of bugs in open source projects including for example OpenJDK,
Protobuf or jsoup. Fuzzing proved to be very effective having no false
positives. It provides a crashing input which helps you to reproduce and debug
any finding easily. The integration of your project into the OSS-Fuzz platform
will enable continuous fuzzing of your project by Jazzer.
What do you need to do?
The integration requires the maintainer or one established project commiter to
deal with the bug reports.
You need to create or provide one email address that is associated with a
google account as per here. When a bug is found, you will receive an email that
will provide you with access to ClusterFuzz, crash reports, code coverage
reports and fuzzer statistics. More than 1 person can be included.
How Code Intelligence can support?
We will continue to add more fuzz targets to improve code coverage over time.
Furthermore, we are permanently enhancing fuzzing technologies by developing
new fuzzers and more bug detectors.
Please let me know if you have any questions regarding fuzzing or the OSS-Fuzz
integration.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 66425] Initial Integration of poi into oss-fuzz
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66425
Dominik Stadler <do...@gmx.at> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEEDINFO |NEW
--- Comment #4 from Dominik Stadler <do...@gmx.at> ---
Update: Over the last 2 weeks, the fuzzing was improved a lot:
* Fix various issues which broke oss-fuzz of Apache POI
* More fuzz-targets to cover many more of the various formats
* Apply some fixes to Apache POI for found cases
Fuzzing is now quite effective with interesting new cases being reported
frequently now.
See the following for latest state:
* Overview: https://introspector.oss-fuzz.com/projects-overview
* Indexing state: https://introspector.oss-fuzz.com/indexing-overview
* Found isses (open ones are hidden!):
https://bugs.chromium.org/p/oss-fuzz/issues/list?q=label%3AProj-apache-poi&can=1
Currently coverage reporting is still quite bad is it includes all transitive
dependencies, hopefully this can be adjusted somehow, hints welcome!
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 66425] Initial Integration of poi into oss-fuzz
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66425
Dominik Stadler <do...@gmx.at> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
--- Comment #2 from Dominik Stadler <do...@gmx.at> ---
Furthermore it is strange that you convert a string to bytes in the current
fuzzer for XLSX2CSV as the input is actually a binary format (Zip-archive of
XML-Files), so I am not sure if that leads to any useful fuzzing at all.
A better approach may be:
public static void fuzzerTestOneInput(byte[] input) {
InputStream in = new ByteArrayInputStream(input);
try {
OPCPackage p = OPCPackage.open(in);
XLSX2CSV xlsx2csv = new XLSX2CSV(p, new
NullPrintStream(), 5);
xlsx2csv.process();
} catch (IOException | OpenXML4JException | SAXException |
POIXMLException | RecordFormatException |
IllegalStateException |
IllegalArgumentException e) {
// expected here
}
}
BTW, we currently would like to not throw any RuntimeException or
NullPointerException directly, but only derived ones.
Also the library should never allocate endless amounts of memory, but rather
fail with a useful exception if input would cause excessive memory allocation.
Currently Apache POI 5.2.3 will still throw RuntimeException and
NullPointerException and maybe report OOMs.
All known cases should be fixed in the next release.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 66425] Initial Integration of poi into oss-fuzz
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66425
--- Comment #1 from Dominik Stadler <do...@gmx.at> ---
Thanks for the note, great news!
We already use fuzzing via Jazzer heavily to uncover unexpected failures, it
will be very interesting how much more a large-scale run on oss-fuzz will
provide.
FYI, there is a separate standalone project for fuzzing Apache POI at
https://github.com/centic9/poi-fuzz which shows which exceptions we currently
expect and which code-areas we visit for fuzzing.
Maybe you want to simply re-use many more of the fuzz-targets from there to
greatly increase coverage of the fuzzing. But note that those fuzz targets
expect a version of Apache POI from latest sources, not a released version.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 66425] Initial Integration of poi into oss-fuzz
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66425
Dominik Stadler <do...@gmx.at> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |FIXED
--- Comment #5 from Dominik Stadler <do...@gmx.at> ---
Fuzzin Apache POI via oss-fuzz is now done on a regular basis.
See https://introspector.oss-fuzz.com/project-profile?project=apache-poi for an
overview and
https://storage.googleapis.com/oss-fuzz-introspector/apache-poi/inspector-report/20241015/fuzz_report.html
for detailed insight into the performed fuzzing.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org
[Bug 66425] Initial Integration of poi into oss-fuzz
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=66425
--- Comment #3 from schaich <sc...@code-intelligence.com> ---
(In reply to Dominik Stadler from comment #1)
> Thanks for the note, great news!
>
>
> We already use fuzzing via Jazzer heavily to uncover unexpected failures, it
> will be very interesting how much more a large-scale run on oss-fuzz will
> provide.
>
> FYI, there is a separate standalone project for fuzzing Apache POI at
> https://github.com/centic9/poi-fuzz which shows which exceptions we
> currently expect and which code-areas we visit for fuzzing.
>
> Maybe you want to simply re-use many more of the fuzz-targets from there to
> greatly increase coverage of the fuzzing. But note that those fuzz targets
> expect a version of Apache POI from latest sources, not a released version.
Hi
thanks for your feedback. I wasn't aware there's already a fuzz project for
poi, I'll try to get those fuzzers onboarded.
We're using the git default branch of the library rather then any releases,
unless the development branch tends to be broken.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@poi.apache.org
For additional commands, e-mail: dev-help@poi.apache.org