Re:Fuzzing open source projects with OSS-Fuzz
by a1xndr on Thursday September 02, 2021 @10:37AM
(#28392605)
I wasn't involved in the work mentioned in the post, but I worked on integrating QEMU into oss-fuzz.
Here's an example of a report from oss-fuzz, that we get by email:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29225
This lets us download the test-case and reproduce the bug, locally.
Internally, we convert this test-case into something that can be used with an unmodified build of qemu, for developers unfamiliar with oss-fuzz, and post it to our own issue tracker:
https://gitlab.com/qemu-project/qemu/-/issues/450
Re:Fuzzing open source projects with OSS-Fuzz
by wiredfool on Thursday September 02, 2021 @10:29AM
(#28392502)
Typically there's a report with a repro test case and an indication of the stack trace where it happened.
My experience is that it's generally pretty easy to nail down what's going on (assuming experience with the code base) unless it's something subtle with library dependency versions where it's not showing up under valgrind, only in their tool, in their docker container.
Internally, we convert this test-case into something that can be used with an unmodified build of qemu, for developers unfamiliar with oss-fuzz, and post it to our own issue tracker: https://gitlab.com/qemu-project/qemu/-/issues/450
My experience is that it's generally pretty easy to nail down what's going on (assuming experience with the code base) unless it's something subtle with library dependency versions where it's not showing up under valgrind, only in their tool, in their docker container.