Potential new projects to integrate with OSS-Fuzz

[kcc]

Let's use this issue to maintain a list of projects that we want to see on oss-fuzz.
Volunteers welcome!

• binutils, e.g. cplus_demangle (seen fuzzable bugs in the past)
• more fuzz targets from LLVM, we currently have only llvm_libcxxabi
• libstdc++ regex (e.g. https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79539)
• libexif
• PCRE (we have PCRE2, but not PCRE)
• python (https://bugs.python.org/issue29505)
• gstreamer (https://lwn.net/Articles/708196/ and also fuzz gstreamer #93)
• mysql
• http://www.gfwx.org/
• http://www.libtiff.org/
• https://sourceforge.net/projects/giflib/
• https://github.com/jrmuizel/qcms/
• imagemagick @dlemstra (fuzz imagemagick #430)
• graphviz @emdenrg (fuzz graphviz #182) (upstream not interested)
• gstreamer @bilboed (fuzz gstreamer #93)
• vim/neovim @dpelle (fuzz vim/neovim #96)
• s2n @raycoll, @alexw91, @colmmacc (add s2n to OSS-Fuzz #238)
• libelf, libdwarf (elf toolchaing fuzzers: libelf, libdwarf #64)
  (add to this list instead of creating a new comment)
• more/better fuzzing for ICU https://github.com/google/oss-fuzz/tree/master/projects/icu
• apache httpd
• https://xerces.apache.org/xerces-c/
• https://github.com/google/piex
• libidn2
• libzip
• dovecot
• Node.js
• tcpdump
• bluez
• cairo
• coreboot
• dbus
• dhcpcd
• dtc (device tree compiler)
• laptop-mode-tools
• libcamera
• libevdev
• libiio
• libpciaccess
• modemmanager
• xf86-input-synaptics
• vlc
• php-src
• bind9
• projects from Cloud Native Computing Foundation(https://www.cncf.io/projects/)

[kroeckx]

Some potential others:

• gzip
• bzip2
• xz
• lzma
• p7zip
• unzip
• libzip
• libarchive
  (I think there are plenty of others like this.)
• tar
• cpio
• ar
• rpm
• dpkg
• elfutils
• ntp
• gimp
• inkscape
• cups
• ghostscript
• postfix
• dovecot
• libidn
• poppler
• clamav
• flac
• mutt
• vim
• libpcap
• privoxy
• samba

[bilboed]

Added GStreamer : #905

[Dor1s]

• VLC: https://github.com/videolan/vlc, https://www.videolan.org/security/

[inferno-chromium]

from Dor1s,

There are few new fuzz targets in Chromium, need to add those (ideally, upstream all the targets); https://cs.chromium.org/chromium/src/third_party/zlib/contrib/tests/fuzzers/

[pwithnall]

Some suggestions:

• Wayland (specifically, its display protocol handling from clients)
• gdk-pixbuf (image loaders)
• tracker-miners (extracts data from a variety of file types)

[bshastry]

Hello,

I was wondering if adding the solidity compiler, the official "smart contract" compiler implementation, to oss-fuzz makes sense. See ethereum/solidity#5278

Thank you.

Edit:
The fact that solidity team find memory leaks low priority (see ethereum/solidity#4517) is a bit discouraging from a continuous fuzzing point of view. Also, the current harness is pretty slow (about 200 execs/s on an i7@2.9GHz).

[Dor1s]

@bshastry, yes, most likely we would accept a PR for https://github.com/ethereum/solidity.

[bshastry]

@bshastry, yes, most likely we would accept a PR for https://github.com/ethereum/solidity.

Thank you, I will initiate a PR once ethereum/solidity#5278 has been approved and merged into upstream solidity.

Edit: libFuzzer already found a compiler bug ethereum/solidity#5279 :-)

[johannkoenig]

Hello @johannkoenig and @fenner. With regards to your convo because it is not clear for me.

I'm not sure what you are referring to. I have not worked on tcpdump fuzzing.

[JulianVolodia]

Hello @johannkoenig and @fenner. With regards to your convo because it is not clear for me.

I'm not sure what you are referring to. I have not worked on tcpdump fuzzing.

hello @johannkoenig - very sorry, I messed up things and mistakenly tagged You instead of jonathanmetzman. Forgive me. Have a good day or night.

[catenacyber]

@JulianVolodia there is an open PR for tcpdump integration here : #1757 with the specific discussion about it.

And, last but not least for You and other - will it be the problem if I integrate it anyway, but (idk of possibilities) fuzzing bug reports will be send out to them only in private? What you think? Or, am I missing something from FAQ or so?

The tcpdump maintainers disagree for now and want to wait a bit longer

[DavidKorczynski]

Dovecot project added! #3502

[JulianVolodia]

Thanks @catenacyber for information with reference.

Can I know which project could be integrated next (== by me)? I had glance and see that many are still WIP or already prepared, but not referenced. Also, don't want to repeat story about TCPdump tool.

For example, other project from the list https://xerces.apache.org/xerces-c/ was initialy integrated and merged in PR #3083 . It is not 'checked' on the list above.

Because of Google's requirements from projects that can't be just random one or not prepared, I reviewed some PR and projects last day and wonder if I should look at repo and check each of them. For now it's unclear if there is some better way to pick any project to work on.

What you think? To not make more mess aka spam here and you could help me I will be very happy to read some rules of thumb (other than from docs which I read already). Thanks!

[catenacyber]

No silver bullet here.
If you do not have specific projects in mind, such as the tools you need during your work, the list above is the best thing I can think of...

But there is always the risk that someone is doing the same project already.
That happened to me for Dovecot and lzma SDK...
So, my best advice is to get a first PR quick, even if it is not complete/perfect, so that people know that you are working on it...

[JulianVolodia]

Thanks @catenacyber for your reply. I see, and understand. That is both sad (that you can't do it) and good (because oss-fuzz is alive and prosper) at one time. I hope you will get interesting projects soon. I wish best to you and will follow your advice.

(0) But, getting any project from repo which is integrated, but for example could have more fuzzers or sth will be the case here?
Ofc there is other reasons than improving security and gaining skills by practice, but I rather want to focus on that one mentioned for some time first.

(1) Could I get any project outside of repo not choosen by Google to integrate in OSS fuzzing?

I started to check projects one by one here: https://github.com/google/oss-fuzz/tree/master/projects if they have fuzzers (in their repo or here), and I assume only integrated are merged.

Upon the time, I going through items mentioned on 1st comment and PRs applying to them. Mention there this issue to show (like last mention about #3500 for binutils, e.g. cplus_demangle (seen fuzzable bugs in the past) ) item on list to be more easy to master the list.

Last but not least, (2) Could improvement to integration of projects be the case here? In example new harness files.

I saw also, that there is some ideas to new ways of fuzzing out there, i.e. #1632 with data flow. Could I research on some?

Does fuzzing open source kernels would be the case to fuzz? Reference: https://github.com/fgsect/unicorefuzz
Some kernels out there:

• Phoenix RT OS
  http://github.com/phoenix-rtos.com/phoenix-rtos-kernel
  http://phoenix-rtos.com/documentation/kernel
• SerenityOS
  https://github.com/SerenityOS/serenity
  http://serenityos.org/

I know that probably writing own harness and run it on own machine would be good but I highly believe in synergy and brainstorm before doing something.
Sorry If my questions are dumb or too lame here.

Best regards, and sorry for long messages (maybe I should have open another thread/issue for that discussion). Thanks for reading.

[DavidKorczynski]

The cpp_demangle in binutils has been added (#3487). However, please follow here (#3500) since the project is not part of binutils as written above, but rather gcc.

[Dor1s]

@JulianVolodia please see some answers below:

(0) But, getting any project from repo which is integrated, but for example could have more fuzzers or sth will be the case here?

yes, improving fuzzing coverage for projects that are already integrated is appreciated and rewarded (as an incremental ideal integration improvement)

(1) Could I get any project outside of repo not choosen by Google to integrate in OSS fuzzing?

Yes, go ahead an upload a quick pull request with only project.yaml to find out whether the project of your choice will be accepted into OSS-Fuzz or not.

Last but not least, (2) Could improvement to integration of projects be the case here? In example new harness files.

Yes!

I saw also, that there is some ideas to new ways of fuzzing out there, i.e. #1632 with data flow. Could I research on some?

That's not so doable for an external contributor. Take a look at https://github.com/google/fuzzbench repo for ideas in this direction.

Does fuzzing open source kernels would be the case to fuzz? Reference: https://github.com/fgsect/unicorefuzz

If it can be fuzzed in the user land, then it may be accepted into OSS-Fuzz. We don't do kernel fuzzing as of now.

[JulianVolodia]

Thank You @Dor1s for your descriptive answers! Really appreciate.

Btw. do You want some reminders/summaries if I do some issues brief read to forward summary update of whole, or it not wanted? Was said about abandon of entry "binutils cplus_demangle" in #3500. (which is not binutils but was written as it)

[Dor1s]

No need for any reminders / summaries. As you finish improving one project, go ahead and submit this form choosing OSS-Fuzz Ideal Integration and providing all the details about the work you've done.

Also make sure to check out https://security.googleblog.com/2017/05/oss-fuzz-five-months-later-and.html to better understand the rules and expectations.

[catenacyber]

What about openvpn ?
It is listed in this page https://www.google.com/about/appsecurity/patch-rewards/

[Dor1s]

What about openvpn ?
It is listed in this page https://www.google.com/about/appsecurity/patch-rewards/

@catenacyber I don't see a reason why not :)

[TheCrott]

If I found security bug in one of libraries integrated with oss-fuzz, am I eligible for bounty?

yes, improving fuzzing coverage for projects that are already integrated is appreciated and rewarded (as an incremental ideal integration improvement)

For "improving fuzzing coverage " Is it include adding more seeds?

[inferno-chromium]

If I found security bug in one of libraries integrated with oss-fuzz, am I eligible for bounty?

No, only if you add fuzzers that can find that security bug and other interesting ones. We want continuous fuzzing to find existing bugs and new ones.

yes, improving fuzzing coverage for projects that are already integrated is appreciated and rewarded (as an incremental ideal integration improvement)

For "improving fuzzing coverage " Is it include adding more seeds?

Sure, we will consider this on a case-by-case basis. More significant coverage improvements are preferred.

[TheCrott]

@inferno-chromium After an integration finished, can I get bounty if I:

1. A contributor to that project
2. Not a contributor

[Dor1s]

@TheCrott yes in both cases

[TheCrott]

@TheCrott yes in both cases

So how you distribute the bounty?

[JulianVolodia]

@TheCrott I asked about it some comments above. Thanks.

No need for any reminders / summaries. As you finish improving one project, go ahead and submit this form choosing OSS-Fuzz Ideal Integration and providing all the details about the work you've done.

[ToSeven]

Hi everyone! I have written a fuzz target for the libyuv, my code has been reviewed by the maintainer. #4363. If I modified my code and merged it to the OSS-Fuzz, Would I get a $1,000 bonus for the initial integration?

[Dor1s]

@ToSeven we can't promise anything here in the comments. The only way to find out is to make your contribution and submit the integration reward form after that for the OSS-Fuzz reward panel to review.