chore: OSS-Fuzz findings reach no maintainer and metadata is stale

Abierto
  • ¿Algo no está bien?
#241 2 comentarios 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
45/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Tranquilo
Stack tecnológico
rust
Área
security, testing

Línea de trabajo

Empieza leyendo google/oss-fuzz/projects/ttf-parser/project.yaml y el Dockerfile de OSS-Fuzz; después, inspecciona el directorio fuzz existente y #179. Confirma el contacto del maintainer y las URLs del repositorio, y entiende el orden de handoff antes de cambiar los targets vendorizados. Se considera terminado cuando los hallazgos llegan a un maintainer incluido en la lista, los metadatos usan URLs actuales y los fuzz targets autoritativos no se pierden durante la migración.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

help wanted

ttf-parser has been a live OSS-Fuzz project since google/oss-fuzz#12663 merged in January 2025, and the build is green. This repository was never told, and the project metadata has three problems. Filing so it is tracked rather than lost.

Current google/oss-fuzz/projects/ttf-parser/project.yaml:

homepage: "https://github.com/RazrFalcon/ttf-parser"
main_repo: "https://github.com/RazrFalcon/ttf-parser.git"
language: rust
sanitizers:
  - address
fuzzing_engines:
  - libfuzzer
vendor_ccs:
- "[email protected]"
- "[email protected]"
- "[email protected]"

1. No maintainer receives findings. There is no primary_contact and no auto_ccs. OSS-Fuzz bug trackers are access-restricted to listed contacts for the 90-day embargo, so no ttf-parser maintainer can read reports against a crate with 92.9M downloads. This is the item that actually matters.

2. Stale repository URLs. homepage and main_repo point at RazrFalcon/ttf-parser. The clone still works through GitHub's redirect, but a stale main_repo degrades OSS-Fuzz's commit-range bisection when it tries to attribute a regression.

3. The fuzz targets are vendored in oss-fuzz. The Dockerfile ends with COPY fuzz $SRC/ttf-parser/fuzz, which overwrites anything the clone provides. That is why #179 — which added a fuzz/ crate here — could not have taken effect, and why it was closed.

Fixing 1 and 2 is a small PR against google/oss-fuzz and needs only a maintainer email address. Fixing 3 means dropping the COPY fuzz line and the vendored tree there, then landing the targets here so this repo becomes authoritative; that ordering avoids a window where $SRC/ttf-parser/fuzz does not exist.

Related: #179 (closed), and testing-tools/ttf-fuzz, which has not compiled since 0.8.0 and should be deleted once a replacement lands.

Lenguaje dominante
Rust
Estrellas
797
Forks
94
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de harfbuzz/ttf-parser

Todos los issues de harfbuzz/ttf-parser

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.