Skip to content

[apache-poi] Add targeted FormulaParser fuzzer#14977

Open
vishalcoc44 wants to merge 2 commits intogoogle:masterfrom
vishalcoc44:vishal/poi-formula-parser
Open

[apache-poi] Add targeted FormulaParser fuzzer#14977
vishalcoc44 wants to merge 2 commits intogoogle:masterfrom
vishalcoc44:vishal/poi-formula-parser

Conversation

@vishalcoc44
Copy link

This PR adds a targeted fuzzer for the Apache POI FormulaParser (org.apache.poi.ss.formula.FormulaParser).

Logic Crash Identified

During local stress-testing of this fuzzer, I identified a logic flaw in the "Structured Reference" state machine.

  • The Bug: Prematurely terminated nested brackets (e.g., [[ or [[[]) cause the parser to increment its internal pointer beyond the string bounds.
  • The Result: java.lang.RuntimeException: Parsed past the end of the formula, pos: 3, length: 2, formula: [[
  • Status: Confirmed in Apache POI 5.2.3.

Implementation Details

  • Target: FormulaParser.parse() (High complexity, high value).
  • Hardening: Includes POIFuzzer.adjustLimits() and broad exception handling to ensure long-running stability.
  • Optimization: Added a dedicated .dict file containing Excel formula tokens (Structured References, standard functions) to guide the fuzzer into deeper logic branches.

Verification Plan (For Maintainers)

To verify the crash found by this fuzzer:

  1. Run the included FormulaParserFuzzer.
  2. It will immediately identify the [[ crash.
  3. Standalone reproduction: FormulaParser.parse("[[", workbook, FormulaType.CELL, -1).

@github-actions
Copy link

vishalcoc44 is a new contributor to projects/apache-poi. The PR must be approved by known contributors before it can be merged. The past contributors are: centic9, centic9-dt, arthurscchan, aschaich

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant