Continuous fuzzing with OSS-Fuzz?
还没有人认领这个 Issue。
评估
调研方向
The proposal names the parser, cbor_value_validate, CBOR-to-JSON conversion, json2cbor, the encoder, a new fuzz/ folder, and OSS-Fuzz build files. First review the TinyCBOR API and OSS-Fuzz integration requirements, then build and run the proposed libFuzzer harnesses with ASan/UBSan. Done means the harnesses cover those APIs and the project is configured for continuous fuzzing; a maintainer contact for private reports is also needed.
由索引模型根据 Issue 内容生成。
描述
Hi! I'd like to help set up continuous fuzzing in OSS-Fuzz for TinyCBOR. Memory-safety bugs keep being reported here (e.g. #258, #259, #318, #328), often found by people running their own private fuzzers: with OSS-Fuzz they would be found early and reported privately to you.
I know Qt bundles a copy of TinyCBOR and Qt is in OSS-Fuzz, but that only covers the paths Qt uses, on Qt's copy. I'd write libFuzzer harnesses for TinyCBOR's own API: the parser and cbor_value_validate, the CBOR-to-JSON conversion, json2cbor and the encoder (in a fuzz/ folder here), plus the OSS-Fuzz build files.
The only thing needed from you is a maintainer listed as the contact for the private bug reports. Would that be welcome? If you'd prefer something lighter, I could set up ClusterFuzzLite in your CI instead.
I'd write the harnesses with the help of Claude Code, but I'll review and test everything myself (with ASan/UBSan) and can explain any part of it.
- 主要语言
- C
- 星标
- 640
- 派生
- 222
- 平均合并
- 2 天 3 小时
- 30 天内合并 PR
- 4
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
intel/tinycbor 的其他 Issue
-
Signed overflow in cbor_value_get_int64() / cbor_value_get_int() for out-of-range negative integers可能已有人在做 @thiagomacieira 于 1 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
-
CborValidateTagUse rejects valid tag 1 (epoch) with a floating-point value, and restricts tags 21-23 too much可能已有人在做 @thiagomacieira 于 25 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 86/100
-
难度 4/5 3-5 天 新手友好度 45/100
-
难度 3/5 1-2 天 新手友好度 35/100
-
难度 4/5 3-5 天 新手友好度 35/100
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 74/100
维护者通常 1 天内回复
-
area:buffer good first issue type:documentation
难度 2/5 1-3 小时 新手友好度 86/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
sudo-project/sudo#586 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 2 天内回复
-
Abort (SIGABRT) when stderr is a closed pipe: uncaught fmt::system_error in ccache_main's catch可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 3 天内回复