Additionally, don't override the go.mod version for the http2/hc fuzz
case.
This fixes a handfull of build failures in the golang project.
Co-authored-by: DavidKorczynski <david@adalogics.com>
* Replace current CCs with the project maintainers.
* Add more info to the build to make errors easier to diagnose.
---------
Co-authored-by: Oliver Chang <oliverchang@users.noreply.github.com>
This PR initialises OSS-Fuzz integration for project unsafe-libyaml in
Rust, adopting the existing fuzzers from upstream repository.
Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
cc @guidovranken as I see cryptofuzz is using go1.22.7
Should fix ngolo-fuzzing build failure
https://issues.oss-fuzz.com/issues/379159151
> go tool dist: go1.22.1 does not meet the minimum bootstrap requirement
of go1.22.6 or later
Co-authored-by: DavidKorczynski <david@adalogics.com>
Issue https://issues.oss-fuzz.com/issues/42537716 is caused by a missing
lower limit which we adjust for other fuzz-targets already to adjust for
the available memory which oss-fuzz uses.
This PR applies the limit in two more places and removes a workaround
for a version-incompatibility in log4j 2.24.1 and an issue with
pom-dependencies in XMLBeans.
Fixes a build issue:
```
[1A[K[31m[1mERROR: [0m/root/.cache/bazel/_bazel_root/4e9824db8e7d11820cfa25090ed4ed10/external/com_google_absl/absl/types/BUILD.bazel:178:11: Compiling absl/types/bad_variant_access.cc [for tool] failed: undeclared inclusion(s) in rule '@@com_google_absl//absl/types:bad_variant_access':
Step #3 - "compile-honggfuzz-address-x86_64": this rule is missing dependency declarations for the following files included by 'absl/types/bad_variant_access.cc':
Step #3 - "compile-honggfuzz-address-x86_64": 'bazel-out/k8-opt-exec-ST-13d3ddad9198/bin/external/com_google_absl/absl/base/core_headers.cppmap'
Step #3 - "compile-honggfuzz-address-x86_64": 'bazel-out/k8-opt-exec-ST-13d3ddad9198/bin/external/com_google_absl/absl/base/atomic_hook.cppmap'
```
This seems to be due to an issue in bazel:
https://github.com/bazelbuild/bazel/issues/23681
The current fix follows the abseil-cpp fuzz fix:
https://github.com/google/oss-fuzz/pull/12858
Signed-off-by: Adi Suissa-Peleg <adip@google.com>
Bumps the bundler group in /docs with 1 update:
[rexml](https://github.com/ruby/rexml).
Updates `rexml` from 3.3.6 to 3.3.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/ruby/rexml/releases">rexml's
releases</a>.</em></p>
<blockquote>
<h2>REXML 3.3.9 - 2024-10-24</h2>
<h3>Improvements</h3>
<ul>
<li>Improved performance.
<ul>
<li><a
href="https://redirect.github.com/ruby/rexml/issues/210">GH-210</a></li>
<li>Patch by NAITOH Jun.</li>
</ul>
</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>
<p>Fixed a parse bug for text only invalid XML.</p>
<ul>
<li><a
href="https://redirect.github.com/ruby/rexml/issues/215">GH-215</a></li>
<li>Patch by NAITOH Jun.</li>
</ul>
</li>
<li>
<p>Fixed a parse bug that <code>&#0x...;</code> is accepted as a
character
reference.</p>
</li>
</ul>
<h3>Thanks</h3>
<ul>
<li>NAITOH Jun</li>
</ul>
<h2>REXML 3.3.8 - 2024-09-29</h2>
<h3>Improvements</h3>
<ul>
<li>SAX2: Improve parse performance.
<ul>
<li><a
href="https://redirect.github.com/ruby/rexml/issues/207">GH-207</a></li>
<li>Patch by NAITOH Jun.</li>
</ul>
</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>Fixed a bug that unexpected attribute namespace conflict error for
the predefined "xml" namespace is reported.
<ul>
<li><a
href="https://redirect.github.com/ruby/rexml/issues/208">GH-208</a></li>
<li>Patch by KITAITI Makoto</li>
</ul>
</li>
</ul>
<h3>Thanks</h3>
<ul>
<li>
<p>NAITOH Jun</p>
</li>
<li>
<p>KITAITI Makoto</p>
</li>
</ul>
<h2>REXML 3.3.7 - 2024-09-04</h2>
<h3>Improvements</h3>
<ul>
<li>Added local entity expansion limit methods
<ul>
<li><a
href="https://redirect.github.com/ruby/rexml/issues/192">GH-192</a></li>
<li><a
href="https://redirect.github.com/ruby/rexml/issues/202">GH-202</a></li>
<li>Reported by takuya kodama.</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/ruby/rexml/blob/master/NEWS.md">rexml's
changelog</a>.</em></p>
<blockquote>
<h2>3.3.9 - 2024-10-24 {#version-3-3-9}</h2>
<h3>Improvements</h3>
<ul>
<li>Improved performance.
<ul>
<li><a
href="https://redirect.github.com/ruby/rexml/issues/210">GH-210</a></li>
<li>Patch by NAITOH Jun.</li>
</ul>
</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>
<p>Fixed a parse bug for text only invalid XML.</p>
<ul>
<li><a
href="https://redirect.github.com/ruby/rexml/issues/215">GH-215</a></li>
<li>Patch by NAITOH Jun.</li>
</ul>
</li>
<li>
<p>Fixed a parse bug that <code>&#0x...;</code> is accepted as a
character
reference.</p>
</li>
</ul>
<h3>Thanks</h3>
<ul>
<li>NAITOH Jun</li>
</ul>
<h2>3.3.8 - 2024-09-29 {#version-3-3-8}</h2>
<h3>Improvements</h3>
<ul>
<li>SAX2: Improve parse performance.
<ul>
<li><a
href="https://redirect.github.com/ruby/rexml/issues/207">GH-207</a></li>
<li>Patch by NAITOH Jun.</li>
</ul>
</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>Fixed a bug that unexpected attribute namespace conflict error for
the predefined "xml" namespace is reported.
<ul>
<li><a
href="https://redirect.github.com/ruby/rexml/issues/208">GH-208</a></li>
<li>Patch by KITAITI Makoto</li>
</ul>
</li>
</ul>
<h3>Thanks</h3>
<ul>
<li>
<p>NAITOH Jun</p>
</li>
<li>
<p>KITAITI Makoto</p>
</li>
</ul>
<h2>3.3.7 - 2024-09-04 {#version-3-3-7}</h2>
<h3>Improvements</h3>
<ul>
<li>Added local entity expansion limit methods
<ul>
<li><a
href="https://redirect.github.com/ruby/rexml/issues/192">GH-192</a></li>
<li><a
href="https://redirect.github.com/ruby/rexml/issues/202">GH-202</a></li>
<li>Reported by takuya kodama.</li>
</ul>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="38eaa86ac7"><code>38eaa86</code></a>
Add 3.3.9 entry</li>
<li><a
href="ce59f2eb1a"><code>ce59f2e</code></a>
parser: fix a bug that &#0x...; is accepted as a character
reference</li>
<li><a
href="a09646d395"><code>a09646d</code></a>
test: fix indent</li>
<li><a
href="cf0fb9c9ca"><code>cf0fb9c</code></a>
Fix <code>IOSource#readline</code> for <code>@pending_buffer</code> (<a
href="https://redirect.github.com/ruby/rexml/issues/215">#215</a>)</li>
<li><a
href="1d0c362526"><code>1d0c362</code></a>
Optimize <code>IOSource#read_until</code> method (<a
href="https://redirect.github.com/ruby/rexml/issues/210">#210</a>)</li>
<li><a
href="622011f25a"><code>622011f</code></a>
Bump version</li>
<li><a
href="036d50851c"><code>036d508</code></a>
test: avoid using needless non ASCII characters</li>
<li><a
href="4197054a19"><code>4197054</code></a>
Add 3.3.8 entry</li>
<li><a
href="78f8712dcc"><code>78f8712</code></a>
Fix handling with "xml:" prefixed namespace (<a
href="https://redirect.github.com/ruby/rexml/issues/208">#208</a>)</li>
<li><a
href="2e1cd64f2f"><code>2e1cd64</code></a>
Optimize SAX2Parser#get_namespace (<a
href="https://redirect.github.com/ruby/rexml/issues/207">#207</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/ruby/rexml/compare/v3.3.6...v3.3.9">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/google/oss-fuzz/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Update JDK 8 and 11 to latest patch-levels
* Add temporary work around for invalid dependency on log4j-bom
introduced via recent XmlBeans
* Fix presubmit-checks for Apache POI
* Print out which file fails checks in presubmit.py to aid in finding
the culprit
This pull requests integrates the Dockerfile needed to build the fuzzers
for zip, as merged into upstream
[here](https://github.com/kuba--/zip/pull/365).
Commit e17999e "fixed" the settings_fuzzer.c test by cleaning up memory,
but did not pass in the correct variable. It would reinterpret a pointer
to memory as a `loader_layer_list` struct, which is all sorts of wrong.
It doesn't help that I forcibly cast the memory pointer to the
loader_layer_list struct type, causing any warnings to be surpressed.
@DavidKorczynski
2nd tries the charm hopefully.
The fuzzer would leak the settings layer list if it successfully found
the layers. This creates memory leaks that aren't directly the fault of
the Vulkan-Loader project.
Co-authored-by: DavidKorczynski <david@adalogics.com>
Robin Freyler