You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@poi.apache.org by ce...@apache.org on 2026/10/25 18:57:06 UTC
(poi) branch trunk updated (5c44755a2a -> 6eb2a1d996)
This is an automated email from the ASF dual-hosted git repository.
centic9 pushed a change to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
from 5c44755a2a XSSFPasswordHelper: parse spinCount as an unsignedInt (#1480)
new f10567f53f ByteChunks: Limit allocation
new e4c4f502f2 Gradle add shadowJar to jenkinsLite
new f1de5a8d87 Avoid duplicate work in XSSFBFileHandler
new 6df168bab5 Fuzzing: Adjust XSSFBFuzzer
new 8bdecdac88 Fuzzing: Add script to run all fuzzers for some time
new a59a51046d Fuzzing: Fix GitHub Action to properly stop after some time
new 91865572cb Prevent OOM on overly large image dimensions in slideshows
new 6eb2a1d996 Add missing dependency for FileHandlerFuzzer
The 8 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.github/workflows/fuzzing.yml | 2 +-
build.gradle | 3 +-
poi-fuzz/README.md | 6 ++
poi-fuzz/build.gradle | 3 +
poi-fuzz/fuzzAll.sh | 83 +++++++++++++++++++++
.../java/org/apache/poi/fuzz/POIXSSFBFuzzer.java | 51 ++++++++-----
.../org/apache/poi/stress/SlideShowHandler.java | 5 ++
.../org/apache/poi/stress/XSSFBFileHandler.java | 32 ++------
.../poi/hsmf/datatypes/ByteChunkDeferred.java | 5 +-
.../hsmf/extractor/TestOutlookTextExtractor.java | 50 ++++++++++++-
test-data/poi-integration-exceptions.csv | 1 +
...ized-POIFileHandlerFuzzer-5802475696488448.ppt} | Bin 63488 -> 63119 bytes
12 files changed, 193 insertions(+), 48 deletions(-)
create mode 100755 poi-fuzz/fuzzAll.sh
copy test-data/slideshow/{bug58516.ppt => clusterfuzz-testcase-minimized-POIFileHandlerFuzzer-5802475696488448.ppt} (81%)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org
(poi) 07/08: Prevent OOM on overly large image dimensions in slideshows
Posted by ce...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
centic9 pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
commit 91865572cbeff16d55860f0d1ef1c68129fd9449
Author: Dominik Stadler <ce...@apache.org>
AuthorDate: Sun Oct 25 11:32:27 2026 +0100
Prevent OOM on overly large image dimensions in slideshows
Let's limit image sizes for rendering slides by default to 4K
to avoid OOM on extreme values in broken files.
Fixes https://issues.oss-fuzz.com/issues/490920727
---
.../java/org/apache/poi/stress/SlideShowHandler.java | 5 +++++
test-data/poi-integration-exceptions.csv | 1 +
...-minimized-POIFileHandlerFuzzer-5802475696488448.ppt | Bin 0 -> 63119 bytes
3 files changed, 6 insertions(+)
diff --git a/poi-integration/src/test/java/org/apache/poi/stress/SlideShowHandler.java b/poi-integration/src/test/java/org/apache/poi/stress/SlideShowHandler.java
index 9166094540..1e16471294 100644
--- a/poi-integration/src/test/java/org/apache/poi/stress/SlideShowHandler.java
+++ b/poi-integration/src/test/java/org/apache/poi/stress/SlideShowHandler.java
@@ -40,6 +40,7 @@ import org.apache.poi.sl.usermodel.SlideShowFactory;
import org.apache.poi.sl.usermodel.TextParagraph;
import org.apache.poi.sl.usermodel.TextRun;
import org.apache.poi.sl.usermodel.TextShape;
+import org.apache.poi.util.IOUtils;
import org.junit.platform.commons.util.ExceptionUtils;
public abstract class SlideShowHandler extends POIFSFileHandler {
@@ -129,6 +130,10 @@ public abstract class SlideShowHandler extends POIFSFileHandler {
Dimension pgSize = ss.getPageSize();
for (Slide<?,?> s : ss.getSlides()) {
+ // by default allow up to 4K UHD: 3840 × 2160
+ IOUtils.safelyAllocateCheck(pgSize.width, 3840);
+ IOUtils.safelyAllocateCheck(pgSize.height, 2160);
+
BufferedImage img = new BufferedImage(pgSize.width, pgSize.height, BufferedImage.TYPE_INT_ARGB);
Graphics2D graphics = img.createGraphics();
diff --git a/test-data/poi-integration-exceptions.csv b/test-data/poi-integration-exceptions.csv
index 85c383a630..f6d2ec5076 100644
--- a/test-data/poi-integration-exceptions.csv
+++ b/test-data/poi-integration-exceptions.csv
@@ -398,3 +398,4 @@ spreadsheet/LIBRE_OFFICE-116306-0.xlsx,extract,"XSSF,OPC",,org.apache.poi.util.R
spreadsheet/LIBRE_OFFICE-116306-0.xlsx,handle,XSSF,,org.apache.poi.util.RecordFormatException,Tried to allocate an array
spreadsheet/clusterfuzz-testcase-minimized-POIFileHandlerFuzzer-5318384433823744.emf,"handle,extract",HEMF,,org.apache.poi.util.RecordFormatException,Invalid value for undefinedSpace2
spreadsheet/clusterfuzz-testcase-minimized-FormulaParserFuzzer-6709334927802368.dat,handle,HMEF,,java.lang.IllegalArgumentException,TNEF signature not detected in file
+slideshow/clusterfuzz-testcase-minimized-POIFileHandlerFuzzer-5802475696488448.ppt,handle,HSLF,,org.apache.poi.util.RecordFormatException,Tried to allocate an array of length
\ No newline at end of file
diff --git a/test-data/slideshow/clusterfuzz-testcase-minimized-POIFileHandlerFuzzer-5802475696488448.ppt b/test-data/slideshow/clusterfuzz-testcase-minimized-POIFileHandlerFuzzer-5802475696488448.ppt
new file mode 100644
index 0000000000..b955346e47
Binary files /dev/null and b/test-data/slideshow/clusterfuzz-testcase-minimized-POIFileHandlerFuzzer-5802475696488448.ppt differ
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org
(poi) 03/08: Avoid duplicate work in XSSFBFileHandler
Posted by ce...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
centic9 pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
commit f1de5a8d87217f70b1f71af75ea57213a51036a9
Author: Dominik Stadler <ce...@apache.org>
AuthorDate: Sun Oct 25 08:59:03 2026 +0100
Avoid duplicate work in XSSFBFileHandler
handleFile() and handleExtracting() are both called for each
file during integration-testing, so they should not both
perform the same actions.
---
.../org/apache/poi/stress/XSSFBFileHandler.java | 32 +++++-----------------
1 file changed, 7 insertions(+), 25 deletions(-)
diff --git a/poi-integration/src/test/java/org/apache/poi/stress/XSSFBFileHandler.java b/poi-integration/src/test/java/org/apache/poi/stress/XSSFBFileHandler.java
index 190ec6ea3a..806d098797 100644
--- a/poi-integration/src/test/java/org/apache/poi/stress/XSSFBFileHandler.java
+++ b/poi-integration/src/test/java/org/apache/poi/stress/XSSFBFileHandler.java
@@ -42,37 +42,19 @@ public class XSSFBFileHandler extends AbstractFileHandler {
byte[] bytes = IOUtils.toByteArray(stream);
try (OPCPackage opcPackage = OPCPackage.open(UnsynchronizedByteArrayInputStream.builder().setByteArray(bytes).get())) {
- testOne(opcPackage);
- }
-
- try (OPCPackage opcPackage = OPCPackage.open(UnsynchronizedByteArrayInputStream.builder().setByteArray(bytes).get())) {
- testNotHandledByWorkbookException(opcPackage);
- }
- }
-
- private void testNotHandledByWorkbookException(OPCPackage pkg) throws IOException {
- try {
- new XSSFWorkbook(pkg).close();
- } catch (XLSBUnsupportedException e) {
- //this is what we'd expect
- //swallow
+ try {
+ new XSSFWorkbook(opcPackage).close();
+ } catch (XLSBUnsupportedException e) {
+ //this is what we'd expect
+ //swallow
+ }
}
}
@Override
public void handleExtracting(File file) throws Exception {
- OPCPackage pkg = OPCPackage.open(file, PackageAccess.READ);
- try {
+ try (OPCPackage pkg = OPCPackage.open(file, PackageAccess.READ)) {
testOne(pkg);
- } finally {
- pkg.close();
- }
-
- pkg = OPCPackage.open(file, PackageAccess.READ);
- try {
- testNotHandledByWorkbookException(pkg);
- } finally {
- pkg.close();
}
}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org
(poi) 01/08: ByteChunks: Limit allocation
Posted by ce...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
centic9 pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
commit f10567f53f05827837c8eff2fec0c1942082f0af
Author: Dominik Stadler <ce...@apache.org>
AuthorDate: Sat Oct 24 17:34:17 2026 +0200
ByteChunks: Limit allocation
To avoid OOM on input with invalid size-fields
---
.../poi/hsmf/datatypes/ByteChunkDeferred.java | 5 ++-
.../hsmf/extractor/TestOutlookTextExtractor.java | 50 +++++++++++++++++++++-
2 files changed, 53 insertions(+), 2 deletions(-)
diff --git a/poi-scratchpad/src/main/java/org/apache/poi/hsmf/datatypes/ByteChunkDeferred.java b/poi-scratchpad/src/main/java/org/apache/poi/hsmf/datatypes/ByteChunkDeferred.java
index ce977b83b1..4f819313ee 100644
--- a/poi-scratchpad/src/main/java/org/apache/poi/hsmf/datatypes/ByteChunkDeferred.java
+++ b/poi-scratchpad/src/main/java/org/apache/poi/hsmf/datatypes/ByteChunkDeferred.java
@@ -32,6 +32,9 @@ import org.apache.poi.util.IOUtils;
* lazy loads its binary data from the document (if linked with a node via {@link #readValue(DocumentNode)}).
*/
public class ByteChunkDeferred extends ByteChunk {
+ // maximum size that is allowed by default, can be extended via IOUtils.setByteArrayMaxOverride()
+ // can be set higher if normal documents exceed this size
+ private static final int MAX_CHUNK_SIZE = 10 * 1024 * 1024;
private DocumentNode node;
@@ -77,7 +80,7 @@ public class ByteChunkDeferred extends ByteChunk {
}
try (DocumentInputStream dis = createDocumentInputStream()) {
- return IOUtils.toByteArray(dis, node.getSize());
+ return IOUtils.toByteArray(dis, node.getSize(), MAX_CHUNK_SIZE);
} catch (IOException e) {
return null;
}
diff --git a/poi-scratchpad/src/test/java/org/apache/poi/hsmf/extractor/TestOutlookTextExtractor.java b/poi-scratchpad/src/test/java/org/apache/poi/hsmf/extractor/TestOutlookTextExtractor.java
index b90cf7cb00..16023cc6dc 100644
--- a/poi-scratchpad/src/test/java/org/apache/poi/hsmf/extractor/TestOutlookTextExtractor.java
+++ b/poi-scratchpad/src/test/java/org/apache/poi/hsmf/extractor/TestOutlookTextExtractor.java
@@ -18,10 +18,12 @@
package org.apache.poi.hsmf.extractor;
import static org.apache.poi.POITestCase.assertContains;
-import static org.apache.poi.POITestCase.assertNotContains;
import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.fail;
+import java.io.ByteArrayInputStream;
import java.io.FileInputStream;
+import java.io.IOException;
import java.text.SimpleDateFormat;
import java.util.Calendar;
import java.util.Locale;
@@ -29,9 +31,13 @@ import java.util.TimeZone;
import org.apache.poi.POIDataSamples;
import org.apache.poi.POITestCase;
+import org.apache.poi.extractor.ExtractorFactory;
+import org.apache.poi.extractor.POIOLE2TextExtractor;
+import org.apache.poi.extractor.POITextExtractor;
import org.apache.poi.hsmf.MAPIMessage;
import org.apache.poi.poifs.filesystem.POIFSFileSystem;
import org.apache.poi.util.LocaleUtil;
+import org.apache.poi.util.RecordFormatException;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.Test;
@@ -252,4 +258,46 @@ public final class TestOutlookTextExtractor {
assertContains(text, "( MSG \u683c\u5f0f\u6e2c\u8a66 )");
}
}
+
+ @Test
+ void testOOM() throws IOException {
+ final String base64Bytes = "0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAABAAAAAQAAAAAAAAAAEAAAAgAAAAEAAAD+////AAAAAAAAAAD///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// [...]
+
+ byte[] input = java.util.Base64.getDecoder().decode(base64Bytes);
+ try (POITextExtractor extractor = ExtractorFactory.createExtractor(new ByteArrayInputStream(input))) {
+ checkExtractor(extractor);
+
+ fail("Should throw an exception because of too large allocations");
+ } catch (RecordFormatException e) {
+ // expected here
+ }
+ }
+
+ @SuppressWarnings("DuplicatedCode")
+ public static void checkExtractor(POITextExtractor extractor) throws IOException {
+ extractor.getDocument();
+ extractor.getFilesystem();
+ try {
+ extractor.getMetadataTextExtractor();
+ } catch (IllegalStateException e) {
+ // can happen here
+ }
+ extractor.getText();
+
+ if (extractor instanceof POIOLE2TextExtractor ole2Extractor) {
+ ole2Extractor.getRoot();
+ ole2Extractor.getSummaryInformation();
+ ole2Extractor.getDocSummaryInformation();
+
+ POITextExtractor[] embedded = ExtractorFactory.getEmbeddedDocsTextExtractors(ole2Extractor);
+ for (POITextExtractor poiTextExtractor : embedded) {
+ poiTextExtractor.getText();
+ poiTextExtractor.getDocument();
+ poiTextExtractor.getFilesystem();
+ POITextExtractor metaData = poiTextExtractor.getMetadataTextExtractor();
+ metaData.getFilesystem();
+ metaData.getText();
+ }
+ }
+ }
}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org
(poi) 04/08: Fuzzing: Adjust XSSFBFuzzer
Posted by ce...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
centic9 pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
commit 6df168bab549d9402bb6960d1f2d7922bfd45858
Author: Dominik Stadler <ce...@apache.org>
AuthorDate: Sun Oct 25 09:33:59 2026 +0100
Fuzzing: Adjust XSSFBFuzzer
Add fuzzing XSSFWorkbook()
Adjust expected exceptions
---
.../java/org/apache/poi/fuzz/POIXSSFBFuzzer.java | 51 ++++++++++++++--------
1 file changed, 32 insertions(+), 19 deletions(-)
diff --git a/poi-fuzz/src/main/java/org/apache/poi/fuzz/POIXSSFBFuzzer.java b/poi-fuzz/src/main/java/org/apache/poi/fuzz/POIXSSFBFuzzer.java
index 89d8fccc1d..dcb05b98b2 100644
--- a/poi-fuzz/src/main/java/org/apache/poi/fuzz/POIXSSFBFuzzer.java
+++ b/poi-fuzz/src/main/java/org/apache/poi/fuzz/POIXSSFBFuzzer.java
@@ -17,13 +17,16 @@
package org.apache.poi.fuzz;
-import org.apache.commons.lang3.exception.ExceptionUtils;
import org.apache.poi.ooxml.POIXMLException;
+import org.apache.poi.openxml4j.exceptions.InvalidFormatException;
+import org.apache.poi.openxml4j.exceptions.NotOfficeXmlFileException;
import org.apache.poi.openxml4j.exceptions.OpenXML4JException;
+import org.apache.poi.openxml4j.exceptions.PartAlreadyExistsException;
import org.apache.poi.openxml4j.opc.OPCPackage;
import org.apache.poi.util.RecordFormatException;
import org.apache.poi.xssf.binary.XSSFBParseException;
import org.apache.poi.xssf.extractor.XSSFBEventBasedExcelExtractor;
+import org.apache.poi.xssf.usermodel.XSSFWorkbook;
import org.apache.xmlbeans.XmlException;
import java.io.ByteArrayInputStream;
@@ -40,24 +43,34 @@ public class POIXSSFBFuzzer {
}
try (OPCPackage pkg = OPCPackage.open(new ByteArrayInputStream(input), true)) {
- XSSFBEventBasedExcelExtractor ex = new XSSFBEventBasedExcelExtractor(pkg);
- ex.getText();
-
- /* Not supported:
- ex.setFormulasNotResults(true);
- ex.getText();*/
-
- ex.setHandleHyperlinksInCells(true);
- ex.getText();
- } catch (IOException | XmlException | OpenXML4JException | POIXMLException |
- RecordFormatException | IndexOutOfBoundsException | IllegalArgumentException |
- IllegalStateException | ArithmeticException | XSSFBParseException ex) {
- // expected
- } catch (NullPointerException e) {
- // can be removed when commons-compress is > 1.28.0 and changes from COMPRESS-598 are applied
- if (!ExceptionUtils.getStackTrace(e).contains("org.apache.commons.compress.archivers.zip.ZipArchiveInputStream.read")) {
- throw e;
- }
+ // use separate try-catch to try both things even if the first one fails
+ try {
+ new XSSFWorkbook(pkg).close();
+ } catch (IOException | POIXMLException |
+ RecordFormatException | IndexOutOfBoundsException | IllegalArgumentException |
+ IllegalStateException | ArithmeticException | XSSFBParseException |
+ PartAlreadyExistsException e) {
+ // expected
+ }
+
+ try {
+ XSSFBEventBasedExcelExtractor ex = new XSSFBEventBasedExcelExtractor(pkg);
+ ex.getText();
+
+ /* Not supported:
+ ex.setFormulasNotResults(true);
+ ex.getText();*/
+
+ ex.setHandleHyperlinksInCells(true);
+ ex.getText();
+ } catch (IOException | XmlException | OpenXML4JException | POIXMLException |
+ RecordFormatException | IndexOutOfBoundsException | IllegalArgumentException |
+ IllegalStateException | ArithmeticException | XSSFBParseException e) {
+ // expected
+ }
+ } catch (IOException | InvalidFormatException | NotOfficeXmlFileException |
+ RecordFormatException ex) {
+ // expected
}
}
}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org
(poi) 05/08: Fuzzing: Add script to run all fuzzers for some time
Posted by ce...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
centic9 pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
commit 8bdecdac889e261936eca890b77d4f85a04a45b2
Author: Dominik Stadler <ce...@apache.org>
AuthorDate: Sun Oct 25 10:40:15 2026 +0100
Fuzzing: Add script to run all fuzzers for some time
This allows to run fuzzing on all targets locally
to verify for newly introduced crashes even before
committing changes
---
poi-fuzz/fuzzAll.sh | 83 +++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 83 insertions(+)
diff --git a/poi-fuzz/fuzzAll.sh b/poi-fuzz/fuzzAll.sh
new file mode 100755
index 0000000000..d0cbec10b5
--- /dev/null
+++ b/poi-fuzz/fuzzAll.sh
@@ -0,0 +1,83 @@
+#!/bin/bash
+
+set -eu
+
+../gradlew shadowJar
+
+for i in src/main/java/org/apache/poi/fuzz/*Fuzzer.java;do
+ CLASS=`basename $i | sed -e 's/.java//g'`
+ CORPUS=corpus`echo ${CLASS} | sed -e 's/Fuzzer//g' | sed -e 's/POI//g'`
+
+ # no separate corpus for this one
+ if [ "${CLASS}" == "XLSX2CSVFuzzer" ]; then
+ CORPUS=corpusXSSF
+ elif [ "${CLASS}" == "POIFileHandlerFuzzer" ]; then
+ CORPUS=corpus
+ fi
+
+ echo Running ${CLASS} with corpus ${CORPUS}
+
+ mkdir -p ${CORPUS}
+
+ case "${CLASS}" in
+ POIFuzzer)
+ cp -a ../test-data corpus
+ ;;
+ POIHDGFFuzzer)
+ cp corpus/diagram/*.vsd corpusHDGF/
+ ;;
+ POIHMEFFuzzer)
+ cp -a corpus/hmef/* corpusHMEF/
+ ;;
+ POIHPBFFuzzer)
+ cp -a corpus/publisher/* corpusHPBF/
+ ;;
+ POIHPSFFuzzer)
+ cp corpus/hpsf/* corpusHPSF/
+ ;;
+ POIHSLFFuzzer)
+ cp corpus/slideshow/*.ppt corpusHSLF/
+ ;;
+ POIHSMFFuzzer)
+ cp -a corpus/hsmf/* corpusHSMF/
+ ;;
+ POIHSSFFuzzer)
+ cp corpus/spreadsheet/*.xls corpusHSSF/
+ ;;
+ POIHWPFFuzzer)
+ cp corpus/document/*.doc corpus/document/*.DOC corpusHWPF/
+ ;;
+ POIOldExcelFuzzer)
+ cp corpus/spreadsheet/*.xls corpus/spreadsheet/*.bin corpusOldExcel/
+ ;;
+ POIRleFuzzer)
+ ;;
+ POIVisioFuzzer)
+ cp corpus/diagram/* corpusVisio/
+ ;;
+ POIXSLFFuzzer)
+ cp corpus/slideshow/* corpus/integration/*.pptx corpusXSLF/
+ ;;
+ POIXSSFBFuzzer)
+ cp corpus/spreadsheet/*.xlsb corpusXSSFB/
+ ;;
+ POIXSSFFuzzer)
+ cp corpus/spreadsheet/* corpus/integration/*.xlsx corpusXSSF/
+ ;;
+ POIXWPFFuzzer)
+ cp corpus/document/* corpus/integration/*.docx corpusXWPF/
+ ;;
+ XLSX2CSVFuzzer)
+ cp corpus/spreadsheet/* corpusXSSF/
+ ;;
+ esac
+
+ nice -n 19 ./jazzer \
+ --cp=build/libs/poi-fuzz-all.jar \
+ "--instrumentation_includes=org.apache.poi.**:org.apache.xmlbeans.**" \
+ --target_class=org.apache.poi.fuzz.${CLASS} \
+ -rss_limit_mb=2560 \
+ -timeout=600 \
+ -max_total_time=600 \
+ ${CORPUS}
+done
\ No newline at end of file
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org
(poi) 02/08: Gradle add shadowJar to jenkinsLite
Posted by ce...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
centic9 pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
commit e4c4f502f2622008c1520485793f937d841a5ae4
Author: Dominik Stadler <ce...@apache.org>
AuthorDate: Sat Oct 24 18:04:44 2026 +0200
Gradle add shadowJar to jenkinsLite
---
build.gradle | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/build.gradle b/build.gradle
index 5f07dd0982..bd4ede659b 100644
--- a/build.gradle
+++ b/build.gradle
@@ -819,7 +819,8 @@ task jenkins(dependsOn: [
task jenkinsLite(dependsOn: [
'replaceVersion',
subprojects.build,
- subprojects.test
+ subprojects.test,
+ ":poi-fuzz:shadowJar"
]) {}
/*task downloadJarsToLibs() {
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org
(poi) 08/08: Add missing dependency for FileHandlerFuzzer
Posted by ce...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
centic9 pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
commit 6eb2a1d996a37caefb0e1a269f7e628e9609daa6
Author: Dominik Stadler <ce...@apache.org>
AuthorDate: Sun Oct 25 12:59:56 2026 +0100
Add missing dependency for FileHandlerFuzzer
---
poi-fuzz/README.md | 6 ++++++
poi-fuzz/build.gradle | 3 +++
2 files changed, 9 insertions(+)
diff --git a/poi-fuzz/README.md b/poi-fuzz/README.md
index 16d916ce96..e9d2cbf0e9 100644
--- a/poi-fuzz/README.md
+++ b/poi-fuzz/README.md
@@ -167,6 +167,12 @@ Can re-use XSSF-corpus as the same files are processed here
mkdir corpusFormulaParser
../gradlew shadowJar && ./jazzer --cp=build/libs/poi-fuzz-all.jar "--instrumentation_includes=org.apache.poi.**:org.apache.xmlbeans.**" --target_class=org.apache.poi.fuzz.FormulaParserFuzzer -rss_limit_mb=2560 corpusFormulaParser
+## FileHandler
+
+Reuses main corpus
+
+ ../gradlew shadowJar && ./jazzer --cp=build/libs/poi-fuzz-all.jar "--instrumentation_includes=org.apache.poi.**:org.apache.xmlbeans.**" --target_class=org.apache.poi.fuzz.POIFileHandlerFuzzer -rss_limit_mb=2560 corpus
+
# Detected issues
* Many of the exceptions are not declared as being thrown in the JavaDoc of Apache POI,
diff --git a/poi-fuzz/build.gradle b/poi-fuzz/build.gradle
index a4f6ba8b20..8815205fd1 100644
--- a/poi-fuzz/build.gradle
+++ b/poi-fuzz/build.gradle
@@ -36,6 +36,9 @@ dependencies {
implementation 'org.opentest4j:opentest4j:1.3.0'
implementation 'com.code-intelligence:jazzer-api:0.30.0'
+ // POIFileHandlerFuzzer includes some code from JUnit
+ implementation 'org.junit.jupiter:junit-jupiter-api:6.1.3'
+
testImplementation "org.junit.jupiter:junit-jupiter-api:${junitVersion}"
testRuntimeOnly "org.junit.jupiter:junit-jupiter-engine:${junitVersion}"
testRuntimeOnly "org.apiguardian:apiguardian-api:${apiGuardianVersion}"
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org
(poi) 06/08: Fuzzing: Fix GitHub Action to properly stop after some time
Posted by ce...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
centic9 pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/poi.git
commit a59a51046d160fef0ddafbe6759bedda81519656
Author: Dominik Stadler <ce...@apache.org>
AuthorDate: Sun Oct 25 11:08:10 2026 +0100
Fuzzing: Fix GitHub Action to properly stop after some time
---
.github/workflows/fuzzing.yml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/.github/workflows/fuzzing.yml b/.github/workflows/fuzzing.yml
index d0c55d7328..d06d22ad45 100644
--- a/.github/workflows/fuzzing.yml
+++ b/.github/workflows/fuzzing.yml
@@ -128,7 +128,7 @@ jobs:
run: ./jazzer --cp=build/libs/poi-fuzz-all.jar "--instrumentation_includes=org.apache.poi.**:org.apache.xmlbeans.**" --target_class=org.apache.poi.fuzz.FormulaParserFuzzer -rss_limit_mb=4096 -timeout=120 -max_total_time=120 corpusFormulaParser
- name: Run Fuzzing - POIFuzzer
- run: ./jazzer --cp=build/libs/poi-fuzz-all.jar --instrumentation_includes=org.apache.poi.**:org.apache.xmlbeans.** --target_class=org.apache.poi.fuzz.POIFuzzer -rss_limit_mb=4096 -timeout=600 -timeout=600 corpus
+ run: ./jazzer --cp=build/libs/poi-fuzz-all.jar --instrumentation_includes=org.apache.poi.**:org.apache.xmlbeans.** --target_class=org.apache.poi.fuzz.POIFuzzer -rss_limit_mb=4096 -timeout=600 -max_total_time=600 corpus
- name: Upload reproducers
uses: actions/upload-artifact@v7
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org