Skip to content

Add WorkbookEvaluator context-aware fuzz target#1025

Open
vishalcoc44 wants to merge 6 commits intoapache:trunkfrom
vishalcoc44:add-workbook-evaluator-fuzzer
Open

Add WorkbookEvaluator context-aware fuzz target#1025
vishalcoc44 wants to merge 6 commits intoapache:trunkfrom
vishalcoc44:add-workbook-evaluator-fuzzer

Conversation

@vishalcoc44
Copy link
Contributor

@vishalcoc44 vishalcoc44 commented Mar 5, 2026 •
edited
Loading

This PR adds a context-aware fuzz target for the Apache POI WorkbookEvaluator engine to the poi-fuzz module.

Technical Approach

  • Context-Aware Strategy: Pre-populates a 20×20 Excel data grid with a diverse mix of numbers, negative values, strings, booleans, and error codes so that referential formulas (SUM, VLOOKUP, INDEX, MATCH, etc.) exercise real evaluation paths instead of fast-failing on empty references.
  • Guided Input Generation: Uses a dictionary of 60 complex Excel function signatures to steer the fuzzer toward deep calculation branches in the WorkbookEvaluator.
  • Coverage Impact: In local testing, this increased code coverage within the WorkbookEvaluator from 19 lines to over 2,200 lines (~11,700% increase).
  • Security Alignment: Expected exceptions (FormulaParseException, NotImplementedException, etc.) are suppressed while internal logic flaws (NPE, OOB) bubble up as findings.
  1. PPTX2PNG (Slideshow Rendering Fuzzing)
  • Target: Exercises the java.awt drawing subsystem by rendering slides into a BufferedImage.
  • Rationale: The rendering pipeline is a high-complexity path prone to Resource Exhaustion (CPU/Memory) that was previously untested in OSS-Fuzz.
  • Resiliency: Per feedback from Apache POI developers regarding the threat model ("Expect any type of Exception"), this fuzzer broadly catches and ignores Exception and Error types. This ensures the fuzzer remains focused strictly on identifying inputs that lead to memory or CPU exhaustion.

Placement

poi-fuzz/src/main/java/org/apache/poi/fuzz/WorkbookEvaluatorFuzzer.java
poi-fuzz/src/main/java/org/apache/poi/fuzz/POIPPTX2PNGFuzzer.java

@vishalcoc44
Copy link
Contributor Author

vishalcoc44 commented Mar 8, 2026

@centic9

@vishalcoc44
Copy link
Contributor Author

vishalcoc44 commented Mar 10, 2026

@centic9

@vishalcoc44 vishalcoc44 requested a review from centic9 March 12, 2026 06:56
@centic9-dt
Copy link
Contributor

centic9-dt commented Mar 12, 2026

FYI, I am working on Apache POI in my free time without payment and thus will usually not respond immediately on PR-updates. Please do not ping me repeatedly on PRs.

In general we should try to NOT add more and more fuzz-targets as oss-fuzz has quite some overhead per fuzz-target, e.g. fuzz-introspection runs for a very long time and each new target increases runtime considerably, leading to timeouts and failed runs.

We will need to actually look at ways to combine some fuzzers or somehow else speed up fuzz-introspection runs at oss-fuzz considerably.

Maybe we can get first rid of the POI(H|X)...Fuzzer classes as POIFileHandlerFuzzer already covers all formats in one go? Downside is that more specific fuzzing is still more effective... ?!?

@vishalcoc44
Copy link
Contributor Author

vishalcoc44 commented Mar 13, 2026

FYI, I am working on Apache POI in my free time without payment and thus will usually not respond immediately on PR-updates. Please do not ping me repeatedly on PRs.

In general we should try to NOT add more and more fuzz-targets as oss-fuzz has quite some overhead per fuzz-target, e.g. fuzz-introspection runs for a very long time and each new target increases runtime considerably, leading to timeouts and failed runs.

We will need to actually look at ways to combine some fuzzers or somehow else speed up fuzz-introspection runs at oss-fuzz considerably.

Maybe we can get first rid of the POI(H|X)...Fuzzer classes as POIFileHandlerFuzzer already covers all formats in one go? Downside is that more specific fuzzing is still more effective... ?!?

Reduced overhead by removing 15 format-specific fuzzers that are already covered by POIFileHandlerFuzzer. Keep only essential fuzzers:

  • POIFileHandlerFuzzer (handles all formats)
  • POIFuzzer
  • WorkbookEvaluatorFuzzer
  • FormulaParserFuzzer
  • POIRleFuzzer
  • EncryptDecryptFuzzer
  • FuzzerRunner (new base class)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@centic9 centic9 Awaiting requested review from centic9

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@vishalcoc44 @centic9-dt @centic9