Fuzz testing
TDF LibreOffice Document Liberation Project Community Blogs Weblate Nextcloud Redmine Ask LibreOffice Donate
LibreOffice uses OSS-Fuzz for Fuzz testing to find possible errors in LibreOffice, so that developers can fix them.
Setup
Setup can be done via the scripts in the bin/ folder of the LibreOffice core repository. It is intended for automatic testing, rather than use by the end users and developers. The result is then published so that developers work on fixing them.
Two scripts are used for this purpose, bin/oss-fuzz-setup.sh and bin/oss-fuzz-build.sh. They pull various containers, clone LibreOffice and build it. The build is done by adding --enable-fuzzers configure option, and it links the fuzzers against the fuzzing engine that OSS-Fuzz provides.
Results
If some issues are found, they will be published and made public after ~30 days in Chromium bug tracker. As described in development frequently asked questions, you may see mentions of issues like ofz#321, which refers to OSS-Fuzz bug report number 321 on Chromium bug tracker. You may see many fixes for bugs found with OSS-Fuzz with:
$ git log --grep=ofz#Some of the bugs that can be found are:
- Out of memory (OOM)
- Memory leak
- Timeout
- Slow input
- Stack buffer overflow
- Heap buffer overflow
- Integer overflow
- Heap use-after-free
- Divide by zero
- Null-dereference READ
- Infinite Loop
- Undefined shift
- Bad cast
- Invalid enum value
- Abort crash
Documentation
You may refer to the OSS-Fuzz documentation for more information.
- OSS-Fuzz documentation main page
- OSS-Fuzz Getting started > Setting up a new project > Testing locally
More information
- LibreOffice leverages Google’s OSS-Fuzz to improve quality of office suite, LibreOffice Blog
- LibreOffice oss-fuzz, crashtesting, coverity,Caolán McNamara, LibreOffice Conference 2020.
- Coverity and oss-fuzz issue solving - Caolán McNamara, FOSDEM 2020.