Created attachment 104001 [details]
mathfuns.xls (fuzzed)

Created attachment 104002 [details] [review]
potential patch

Fixed somewhat differently, but in a more robust way.  We need to verify
that we have the right number of bytes in the record.

(head+stable)

For the record, how are you running zzuf tool?

Right now, I'm using a crude shell script to corrupt the files from gnumeric/samples:

# * to pick up the sc samples
for file in *
 do
  for a in 0 1 2 3 4 5 6 7 8 9
   do
    for b in 0 1 2 3 4 5 6 7 8 9 
     do
      echo :"$file""$a""$b" >> fuzzlog

      # this script will fuzz 0.0% (-r.000) - 9.9% (-r.099) of the file's bytes
      ~/local/bin/zzuf -b2000- -r.0"$a""$b" < "$file" > "$file""$a""$b"
      ~/local/bin/ssconvert "$file""$a""$b" "$file""$a""$b".xls >> fuzzlog 2>&1
      # note: the fuzzed files are not cleaned up
     done
   done
 done


There are a number of ways this testing can be improved:

- Export the fuzzed files to every format, not just xls.
- Experiment with different header offsets for each file format by using the -b switch, which allows you to ignore certain byte ranges (-b2000- was just a guess).
- Fuzz the file headers.
- Use -P and -R to blacklist/whitelist certain characters to make the corruption more realistic.
- Reduce the rate of fuzzing to corrupt the files more subtly.
- See if different fuzzing modes (-f switch) produce more bugs.


I don't know much about spreadsheet formats, so my testing isn't very smart yet :).  If you have any suggestions, I'd be happy to hear them.