vishalcoc44 opened a new pull request, #1025: URL: https://github.com/apache/poi/pull/1025
### Summary This PR adds a context-aware fuzz target for the Apache POI `WorkbookEvaluator` engine to the `poi-fuzz` module. This fuzzer was developed as part of Google's OSS-Fuzz integration (see google/oss-fuzz#14987) and is being upstreamed ### Technical Approach - **Context-Aware Strategy**: Pre-populates a **20×20 Excel data grid** with a diverse mix of numbers, negative values, strings, booleans, and error codes so that referential formulas (SUM, VLOOKUP, INDEX, MATCH, etc.) exercise real evaluation paths instead of fast-failing on empty references. - **Guided Input Generation**: Uses a dictionary of **60 complex Excel function signatures** to steer the fuzzer toward deep calculation branches in the `WorkbookEvaluator`. - **Coverage Impact**: In local testing, this increased code coverage within the `WorkbookEvaluator` from **19 lines** to over **2,200 lines** (~11,700% increase). - **Security Alignment**: Expected exceptions (`FormulaParseException`, `NotImplementedException`, etc.) are suppressed while internal logic flaws (NPE, OOB) bubble up as findings. ### Placement File added to `poi-fuzz/src/main/java/org/apache/poi/fuzz/WorkbookEvaluatorFuzzer.java` ### Related - OSS-Fuzz integration PR: https://github.com/google/oss-fuzz/pull/14987 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
