Every story and comment from the Hacker News API, in a layout borrowed from 2001.
A comment on Google's OSS-Fuzz expands fuzz-reward program to $30000. Parent comment
> Strangely, these bugs were found by the CI of ClickHouse, and not by any of the hundreds of other products using these libraries.
A lot of software projects that have "OSS Fuzz integration" have very naive or superficial fuzz harnesses that couldn't ever get thorough coverage.
If the code is never executed by the fuzzer, bugs won't be found by fuzzing.
In your case, fuzzing your application code, you likely end up executing code in those dependencies that their own fuzzers miss.
There are no comments on this comment yet.
> Strangely, these bugs were found by the CI of ClickHouse, and not by any of the hundreds of other products using these libraries.
A lot of software projects that have "OSS Fuzz integration" have very naive or superficial fuzz harnesses that couldn't ever get thorough coverage.
If the code is never executed by the fuzzer, bugs won't be found by fuzzing.
In your case, fuzzing your application code, you likely end up executing code in those dependencies that their own fuzzers miss.