Add two fuzzers to integrate containerd into OSS-fuzz#4841
Add two fuzzers to integrate containerd into OSS-fuzz#4841estesp merged 1 commit intocontainerd:masterfrom AdamKorcz:fuzz1
Conversation
|
Hi @AdamKorcz. Thanks for your PR. I'm waiting for a containerd member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
Build succeeded.
|
|
Build succeeded.
|
kzys
left a comment
kzys
left a comment
There was a problem hiding this comment.
Looks good to me.
Does it make sense to at least build them on GitHub Actions? If we change the signature of Parse() methods, we may forget to update the Fuzz functions, since // +build gofuzz excludes them.
|
@kzys that is a good point, however as OSS-fuzz runs fuzzers several times per week, maintainers will get notified in case the fuzzers can't be built. |
|
@AdamKorcz If I get this right, each function/API must be wrapped in order to be tested by oss-fuzz, right? If so I'd rather prefer to have a separate package |
That is not a problem. It will work fine with OSS-fuzz. I have made the changes in the commit. |
|
can you squash commits? |
Signed-off-by: AdamKorcz <[email protected]>
|
Hereby squashed |
|
Build succeeded.
|
|
Thank you for merging this in. To finish the integration on the OSS-fuzz side we need at least one maintainers email address in the Please note that I have added my own email address on the mailing list to see the integration through to completion. This does mean that all bugs and vulnerabilities will be visible by me as all email addresses on that list will have access to these, and if you prefer me off the list, just let me know, and I will remove myself. |
7 participants
This PR adds two fuzzers to set up continuous fuzzing for containerd on the OSS-fuzz platform.
Fuzzing is a method for testing whereby pseudo-random data is passed to a target entry point in an application - which in these two fuzzers are filters.Parse and platforms.Parse respectively. The application is then observed in the hope of finding bugs and vulnerabilities.
Integrating containerd into OSS-fuzz will allow these two fuzzers to run continuously and look for harder-to-find bugs. If bugs are found maintainers get notified with emails containing a link to a detailed bug report that includes stacktrace and reproducible test case.
I have set up a draft integration PR on the OSS-fuzz side that will be updated according to the progression of this PR: google/oss-fuzz#4839. The build currently fails but I will get it up and running once the fuzzers here are integrated. In the PR on OSS-fuzz there is a
project.yamlfile which requires at least one maintainers email address.Signed-off-by: AdamKorcz [email protected]