Fuzz XML file filters Background: The XML file filters are protected from casual binary fuzzing by the zip de-compression, and the XML parser - thus they get little real, hard-core testing. Morten Welinder (of gnumeric fame) has written a nice, simple perl XML fuzzer - which you can find here: http://git.gnome.org/browse/gnumeric/tree/test/fuzzxml - the idea is to get a complex, existing XML document - and to swap it about randomly into a new one, then load that inside LibreOffice, and see if it crashes - if it does; file a bug report with the file (or fix the crash). You will need to unzip, fuzz, and re-zip up an ODF file (which requires the mimetype as the first entry, and no compression ie zip -0). Skills: shell, basic XML experience, optionally bit of debugger
Something like this ¿right? --------------------- unzip -d example example.odt perl fuzzml example/content.xml example/newcontent.xml mv example/newcontent.xml example/content.xml cd example zip -0 ../text.odt mimetype zip -r ../test.odt . cd .. rm -r example libreoffice test.odt -----------
Sure - that's the right idea; worth turning into a script I guess :-) Then of course, we need to re-load the file notice it crashing left and right - and try to find out why & how to patch that; It's quite a job - as/when you find a crasher, if it's not obvious it'd be great to work together on that. And of course, the more complex and tangled the input document - using as many weirdo features as possible ;-) the better the attack surface from fuzzing. ATB.
Deteted "Easyhack" from summary
adding LibreOffice developer list as CC to unresolved EasyHacks for better visibility. see e.g. http://nabble.documentfoundation.org/minutes-of-ESC-call-td4076214.html for details
proposed a change to dev-tools: An implementation of easyhack bug #38841. https://gerrit.libreoffice.org/9114
Abandoned the patch; resetting assignee to default.
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.