Fuzz XML file filters
Background: The XML file filters are protected from casual binary fuzzing by the zip de-compression, and the XML parser - thus they get little real, hard-core testing. Morten Welinder (of gnumeric fame) has written a nice, simple perl XML fuzzer - which you can find here: http://git.gnome.org/browse/gnumeric/tree/test/fuzzxml - the idea is to get a complex, existing XML document - and to swap it about randomly into a new one, then load that inside LibreOffice, and see if it crashes - if it does; file a bug report with the file (or fix the crash). You will need to unzip, fuzz, and re-zip up an ODF file (which requires the mimetype as the first entry, and no compression ie zip -0).
Skills: shell, basic XML experience, optionally bit of debugger
Something like this ¿right?
unzip -d example example.odt
perl fuzzml example/content.xml example/newcontent.xml
mv example/newcontent.xml example/content.xml
zip -0 ../text.odt mimetype
zip -r ../test.odt .
rm -r example
Sure - that's the right idea; worth turning into a script I guess :-) Then of course, we need to re-load the file notice it crashing left and right - and try to find out why & how to patch that;
It's quite a job - as/when you find a crasher, if it's not obvious it'd be great to work together on that.
And of course, the more complex and tangled the input document - using as many weirdo features as possible ;-) the better the attack surface from fuzzing.
Deteted "Easyhack" from summary
adding LibreOffice developer list as CC to unresolved EasyHacks for better visibility.
see e.g. http://nabble.documentfoundation.org/minutes-of-ESC-call-td4076214.html for details
proposed a change to dev-tools: An implementation of easyhack bug #38841. https://gerrit.libreoffice.org/9114
Abandoned the patch; resetting assignee to default.
Migrating Whiteboard tags to Keywords: (EasyHack DifficultyBeginner SkillScript SkillDebug, TopicDebug -> TopicDebugging)
Remove skillDebug, superceded by topicDebug.
JanI is default CC for Easy Hacks (Add Jan; remove LibreOffice Dev List from CC)
is that ticket still open? Didn't you already implemented a fuzzer because of ofz?
haven't got to the xml file formats yet, but its just a matter of time I gues, couple of weeks maybe
i'm working on this bug
A polite ping, still working on this bug
I guess we can close this one as RESOLVED MOVED since we use the oss-fuzzers, and sooner or later, we will fuzz the xml there too.