Continuous fuzzing with OSS-Fuzz?
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
Research direction
The proposal names the parser, cbor_value_validate, CBOR-to-JSON conversion, json2cbor, the encoder, a new fuzz/ folder, and OSS-Fuzz build files. First review the TinyCBOR API and OSS-Fuzz integration requirements, then build and run the proposed libFuzzer harnesses with ASan/UBSan. Done means the harnesses cover those APIs and the project is configured for continuous fuzzing; a maintainer contact for private reports is also needed.
Written by the indexing model from the issue text.
Description
Hi! I'd like to help set up continuous fuzzing in OSS-Fuzz for TinyCBOR. Memory-safety bugs keep being reported here (e.g. #258, #259, #318, #328), often found by people running their own private fuzzers: with OSS-Fuzz they would be found early and reported privately to you.
I know Qt bundles a copy of TinyCBOR and Qt is in OSS-Fuzz, but that only covers the paths Qt uses, on Qt's copy. I'd write libFuzzer harnesses for TinyCBOR's own API: the parser and cbor_value_validate, the CBOR-to-JSON conversion, json2cbor and the encoder (in a fuzz/ folder here), plus the OSS-Fuzz build files.
The only thing needed from you is a maintainer listed as the contact for the private bug reports. Would that be welcome? If you'd prefer something lighter, I could set up ClusterFuzzLite in your CI instead.
I'd write the harnesses with the help of Claude Code, but I'll review and test everything myself (with ASan/UBSan) and can explain any part of it.
- Dominant language
- C
- Stars
- 640
- Forks
- 222
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 4
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from intel/tinycbor
-
Signed overflow in cbor_value_get_int64() / cbor_value_get_int() for out-of-range negative integersPossibly taken @thiagomacieira claimed this 1 day ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
CborValidateTagUse rejects valid tag 1 (epoch) with a floating-point value, and restricts tags 21-23 too muchPossibly taken @thiagomacieira claimed this 25 days ago. Open
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
Similar issues
-
documentation
Difficulty 1/5 1-3 hours Newbie friendliness 91/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 83/100
Maintainers usually reply within 1 day
-
enhancement ui
Difficulty 1/5 Under an hour Newbie friendliness 72/100
ChupathingyCE/chupathingyce#485 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 82/100
eclipse-paho/paho.mqtt.c#1727 ·
Maintainers usually reply within 6 days