| commit | 0ab119d1a1feeac5c06d8e62d5f1ab74b45599f0 | [log] [tgz] |
|---|---|---|
| author | Alex Gaynor <alex.gaynor@gmail.com> | Thu Dec 01 21:06:48 2016 -0500 |
| committer | inferno-chromium <inferno@chromium.org> | Thu Dec 01 18:06:48 2016 -0800 |
| tree | 903bf5fe719a2bccb3398e7b97d3af5793721275 | |
| parent | cb2ecc10a9f29f1ef06c97eca115f939b4a4c35c [diff] |
Add the libyaml fuzzer (#115) * libyaml fuzzer * Update for new modern conventions * added seed corpus * added a dictionary * mark myself as the primary contact * Rename * --depth on git clone * rename * consistency * Other URL is better
Status: Beta. We are preparing the project for public release soon.
FAQ | Ideal Fuzzing Integration | New Project Guide | Reproducing Bugs | Projects | Projects Issue Tracker | Glossary
Create New Issue for questions or feedback about OSS-Fuzz.
Fuzz testing is a well-known technique for uncovering various kinds of programming errors in software. Many of these detectable errors (e.g. buffer overflow) can have serious security implications.
We successfully deployed guided in-process fuzzing of Chrome components and found hundreds of security vulnerabilities and stability bugs. We now want to share the experience and the service with the open source community.
In cooperation with the Core Infrastructure Initiative, OSS-Fuzz aims to make common open source software more secure and stable by combining modern fuzzing techniques and scalable distributed execution.
At the first stage of the project we use libFuzzer with Sanitizers. More fuzzing engines will be added later. ClusterFuzz provides distributed fuzzer execution environment and reporting.
The following process is used for projects in OSS-Fuzz:
To be accepted to OSS-Fuzz, an open-source project must have a significant user base and/or be critical to the global IT infrastructure. To submit a new project:
projects/<project_name>/project.yaml file (example) giving at least the following information:project_name can only contain alphanumeric characters, underscores(_) or dashes(-).Following Google's standard disclosure policy OSS-Fuzz will adhere to following disclosure principles:
This page gives the latest build logs for each project.
This page gives a list of publically viewable fixed bugs found by OSS-Fuzz.