LibreOffice Fuzz Testing and OSS-Fuzz Integration

LibreOffice maintains a rigorous security posture by integrating automated fuzz testing directly into its continuous development lifecycle. Through deep integration with Google’s OSS-Fuzz platform, along with native fuzzing engines and automated document crash testing, the project continuously evaluates hundreds of file format parsers and import filters to identify and resolve memory corruption vulnerabilities, unhandled exceptions, and edge-case crashes before they reach end users.

Google OSS-Fuzz Integration

LibreOffice was integrated into Google’s OSS-Fuzz service in 2017 to enable continuous, automated fuzz testing at scale. OSS-Fuzz automatically builds LibreOffice’s codebase with various sanitizers—including AddressSanitizer (ASan), UndefinedBehaviorSanitizer (UBSan), and MemorySanitizer (MSan)—against the latest Git commits.

Whenever OSS-Fuzz generates inputs that trigger a crash, memory leak, or undefined behavior, it automatically files an issue with reproducible test cases in the project’s tracking system. This automated pipeline allows developers to identify and patch complex security flaws shortly after new code is committed.

In-Tree Fuzzing Harnesses (libFuzzer and AFL)

LibreOffice includes native fuzzing targets directly within its source tree under the vcl and desktop modules. These harnesses are designed to work seamlessly with modern coverage-guided fuzzing engines, primarily libFuzzer and American Fuzzy Lop (AFL).

The primary focus of these in-tree harnesses is parsing untrusted data, specifically targeting: * Office Document Formats: OpenDocument Format (ODF), Microsoft Office legacy binary formats (DOC, XLS, PPT), and Office Open XML (DOCX, XLSX, PPTX). * Multimedia and Graphic Filters: Parsers for formats like SVG, TIFF, JPEG, BMP, and PDF. * Complex Data Engines: Calc formula parsers, XML parsers, and typography/font shaping engines.

Fuzzing the Document Liberation Project Libraries

LibreOffice relies heavily on external, standalone libraries developed under the Document Liberation Project to support legacy and proprietary formats (such as WordPerfect, Visio, Apple Keynote, and CorelDRAW).

These individual libraries (e.g., libwps, libvisio, libetonyek, libcdr, libmwaw, and libwpd) maintain their own dedicated OSS-Fuzz targets. By fuzzing these libraries independently upstream, vulnerabilities in file import filters are remediated before updated library versions are pulled into LibreOffice core builds.

Automated Tinderbox Crash Testing

In addition to guided mutation fuzzing from OSS-Fuzz, LibreOffice operates a dedicated automated crash-testing framework known as the CrashTest tinderbox.

This system continuously tests LibreOffice against a vast corpus of over one million real-world documents collected from public sources. The test harness imports and exports each document, verifying that the parsers handle malformed structures gracefully without crashing or hanging, complementing algorithmic fuzzing with real-world regression testing.