[GH-ISSUE #482] Bug: UndefinedBehaviorSanitizer found with fuzz tools #377

New issue

Closed

opened 2026-05-05 12:13:32 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 12:13:32 -06:00

Owner

Originally created by @tangjm24 on GitHub (Jun 2, 2025).
Original GitHub issue: https://github.com/jmcnamara/libxlsxwriter/issues/482

Originally assigned to: @jmcnamara on GitHub.

I have found several bugs through fuzzing. To avoid cluttering the issues page, I’ve consolidated all the bugs I discovered into this single issue. I hope this is helpful to the developers.

Environment

libucl version: Latest commit [21c11a2](21c11a2052)
System: Ubuntu 22.04.5 LTS (Jammy)
Kernel/Release: 22.04

Bug Reproduction

driver code

see 

[fuzzer_v1.txt](https://github.com/user-attachments/files/20548088/fuzzer_v1.txt)

compile:

#!/bin/bash

set -e

export AFL_HOME=/path/to/your/afl

cd ..

if [ -d "libxlsxwriter-1.2.2" ]; then
    echo "Directory libxlsxwriter-1.2.2 already exists. Skipping download."
else
    if [ -f "v1.2.2.tar.gz" ]; then  
        echo "File v1.2.2.tar.gz already exists. Skipping download."
    else
        wget https://github.com/jmcnamara/libxlsxwriter/archive/refs/tags/v1.2.2.tar.gz
    fi
fi

rm -rf libxlsxwriter-1.2.2
tar -xvf v1.2.2.tar.gz
cd libxlsxwriter-1.2.2/

LIB_CONFIG_BASE_DIR=$(pwd)
INSTALL_PREFIX="${LIB_CONFIG_BASE_DIR}/libxlsxwriter_install"
echo "libxlsxwriter will be installed to: ${INSTALL_PREFIX}"
mkdir -p "${INSTALL_PREFIX}"

echo $CC

mkdir build && cd build

CC=$AFL_HOME/afl-clang \
CXX=$AFL_HOME/afl-clang++ \
CFLAGS="-g -O1 -fsanitize=address,undefined -fno-omit-frame-pointer -fno-sanitize-recover=all" \
CXXFLAGS="-g -O1 -fsanitize=address,undefined -fno-omit-frame-pointer -fno-sanitize-recover=all" \
cmake .. \
  -DENABLE_LUA=OFF \
  -DBUILD_SHARED_LIBS=OFF \

make -j$(nproc)

cd ../../libxsl_test

$AFL_HOME/afl-clang fuzzer_v1.c -g -O1 -fsanitize=address,undefined \
  -I/path/to/include/dir \
  -L/path/to/lib/dir\
  -lxlsxwriter \
  -lm\
  -lz\
  -o afl_fuzzer


chmod +x gen_corpus.py
rm -rf ./corpus
./gen_corpus.py
rm -rf IN


$AFL_HOME/afl-cmin -i ./corpus -o ./IN  -m none ./afl_fuzzer @@

$AFL_HOME/afl-fuzz -i IN -o OUT -m none ./afl_fuzzer @@

# $AFL_HOME/afl-fuzz  -i OUT_2/crashes/ -o peruvian_crashes -m none -C ./afl_fuzzer @@

crash.txt

Fix Recommondation

crash info

/data/tjm/code/fuzz/libxlsxwriter-1.2.2/src/workbook.c:740:13: runtime error: addition of unsigned offset to 0x7ffeb3fed821 overflowed to 0x7ffeb3fed820
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /data/tjm/code/fuzz/libxlsxwriter-1.2.2/src/workbook.c:740:13 in

how to fix?
change

        if (lxw_str_is_empty(tmp_str) || lxw_str_is_empty(worksheet_name))
            goto mem_error;

        /* Remove any worksheet quoting. */
        if (worksheet_name[0] == '\'')
            worksheet_name++;
        if (worksheet_name[strlen(worksheet_name) - 1] == '\'')
            worksheet_name[strlen(worksheet_name) - 1] = '\0';

        if (lxw_str_is_empty(tmp_str) || lxw_str_is_empty(worksheet_name))
            goto mem_error;

        /* Remove any worksheet quoting. */

       if (strlen(worksheet_name) == 0) return;
        if (worksheet_name[0] == '\'')
            worksheet_name++;
        if (worksheet_name[strlen(worksheet_name) - 1] == '\'')
            worksheet_name[strlen(worksheet_name) - 1] = '\0';

Originally created by @tangjm24 on GitHub (Jun 2, 2025). Original GitHub issue: https://github.com/jmcnamara/libxlsxwriter/issues/482 Originally assigned to: @jmcnamara on GitHub. I have found several bugs through fuzzing. To avoid cluttering the issues page, I’ve consolidated all the bugs I discovered into this single issue. I hope this is helpful to the developers. ## Environment libucl version: Latest commit [[21c11a2](https://github.com/jmcnamara/libxlsxwriter/commit/21c11a2052162b24c121b766e4373b081ea07ff6)](https://github.com/jmcnamara/libxlsxwriter/commit/21c11a2052162b24c121b766e4373b081ea07ff6) System: Ubuntu 22.04.5 LTS (Jammy) Kernel/Release: 22.04 --- ## Bug Reproduction driver code ```c++ see [fuzzer_v1.txt](https://github.com/user-attachments/files/20548088/fuzzer_v1.txt) ``` compile: ```shell #!/bin/bash set -e export AFL_HOME=/path/to/your/afl cd .. if [ -d "libxlsxwriter-1.2.2" ]; then echo "Directory libxlsxwriter-1.2.2 already exists. Skipping download." else if [ -f "v1.2.2.tar.gz" ]; then echo "File v1.2.2.tar.gz already exists. Skipping download." else wget https://github.com/jmcnamara/libxlsxwriter/archive/refs/tags/v1.2.2.tar.gz fi fi rm -rf libxlsxwriter-1.2.2 tar -xvf v1.2.2.tar.gz cd libxlsxwriter-1.2.2/ LIB_CONFIG_BASE_DIR=$(pwd) INSTALL_PREFIX="${LIB_CONFIG_BASE_DIR}/libxlsxwriter_install" echo "libxlsxwriter will be installed to: ${INSTALL_PREFIX}" mkdir -p "${INSTALL_PREFIX}" echo $CC mkdir build && cd build CC=$AFL_HOME/afl-clang \ CXX=$AFL_HOME/afl-clang++ \ CFLAGS="-g -O1 -fsanitize=address,undefined -fno-omit-frame-pointer -fno-sanitize-recover=all" \ CXXFLAGS="-g -O1 -fsanitize=address,undefined -fno-omit-frame-pointer -fno-sanitize-recover=all" \ cmake .. \ -DENABLE_LUA=OFF \ -DBUILD_SHARED_LIBS=OFF \ make -j$(nproc) cd ../../libxsl_test $AFL_HOME/afl-clang fuzzer_v1.c -g -O1 -fsanitize=address,undefined \ -I/path/to/include/dir \ -L/path/to/lib/dir\ -lxlsxwriter \ -lm\ -lz\ -o afl_fuzzer chmod +x gen_corpus.py rm -rf ./corpus ./gen_corpus.py rm -rf IN $AFL_HOME/afl-cmin -i ./corpus -o ./IN -m none ./afl_fuzzer @@ $AFL_HOME/afl-fuzz -i IN -o OUT -m none ./afl_fuzzer @@ # $AFL_HOME/afl-fuzz -i OUT_2/crashes/ -o peruvian_crashes -m none -C ./afl_fuzzer @@ ``` [crash.txt](https://github.com/user-attachments/files/20548081/crash.txt) --- ## Fix Recommondation crash info ```txt /data/tjm/code/fuzz/libxlsxwriter-1.2.2/src/workbook.c:740:13: runtime error: addition of unsigned offset to 0x7ffeb3fed821 overflowed to 0x7ffeb3fed820 SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /data/tjm/code/fuzz/libxlsxwriter-1.2.2/src/workbook.c:740:13 in ``` how to fix? change ```c++ if (lxw_str_is_empty(tmp_str) || lxw_str_is_empty(worksheet_name)) goto mem_error; /* Remove any worksheet quoting. */ if (worksheet_name[0] == '\'') worksheet_name++; if (worksheet_name[strlen(worksheet_name) - 1] == '\'') worksheet_name[strlen(worksheet_name) - 1] = '\0'; ``` to ```c++ if (lxw_str_is_empty(tmp_str) || lxw_str_is_empty(worksheet_name)) goto mem_error; /* Remove any worksheet quoting. */ if (strlen(worksheet_name) == 0) return; if (worksheet_name[0] == '\'') worksheet_name++; if (worksheet_name[strlen(worksheet_name) - 1] == '\'') worksheet_name[strlen(worksheet_name) - 1] = '\0'; ```

gitea-mirror

2026-05-05 12:13:32 -06:00

closed this issue
added the
bug

in progress

awaiting user feedback
labels

gitea-mirror commented

2026-05-05 12:13:39 -06:00

Author

Owner

@jmcnamara commented on GitHub (Jun 2, 2025):

$AFL_HOME/afl-clang fuzzer_v1.c

Please attach the fuzzer_v1.c file.

chmod +x gen_corpus.py

Please include this as well, if required.

I hope this is helpful to the developers.

I appreciate that you are trying to be helpful but a simple reproducible test case would be better. Or even the API and string that causes the crash.

how to fix?

if (strlen(worksheet_name) == 0) return;

That check is already in place 2 lines previously.

From the context I'd guess that the crash occurs with a defined name like '!name so that the second strlen(worksheet_name) is zero when checked. That looks like an issue regardless of the fuzzer so I'll push a fix for that.

@jmcnamara commented on GitHub (Jun 2, 2025): > $AFL_HOME/afl-clang fuzzer_v1.c Please attach the `fuzzer_v1.c` file. > chmod +x gen_corpus.py Please include this as well, if required. > I hope this is helpful to the developers. I appreciate that you are trying to be helpful but a simple reproducible test case would be better. Or even the API and string that causes the crash. > how to fix? > > if (strlen(worksheet_name) == 0) return; That check is already in place 2 lines previously. From the context I'd guess that the crash occurs with a defined name like `'!name` so that the second `strlen(worksheet_name)` is zero when checked. That looks like an issue regardless of the fuzzer so I'll push a fix for that.

gitea-mirror commented

2026-05-05 12:13:40 -06:00

Author

Owner

@jmcnamara commented on GitHub (Jun 30, 2025):

Fixed in v1.2.3.

@jmcnamara commented on GitHub (Jun 30, 2025): Fixed in v1.2.3.