* [util-linux] cover mnt_table_parse_stream
Waiting for https://github.com/karelzak/util-linux/pull/1068
* temporarily point OSS-Fuzz to evverx/util-linux
* make sure it can be built with sanitizer=coverage
* added draco integration files
* wrote build file and Dockerfile for Draco
* split security-research-pocs fuzzer into four
* added project build to build.sh
* added more fuzzers
* fixed sanitizer flags
* removed commented code, combined fuzzers, fized build script
* changed to singular filenames, converted usage of random int to enum, changed buffer name, and fixed build script
* placed test files in memory instead of on disk, added asserts
Integrating the first cloud function i implemented which syncs the project list from github and uploads the list to cloud datastore, which will be used by another cloud function to request builds.
Co-authored-by: Kabeer Seth <kabeerseth@google.com>
* [libxml2] Two new fuzz targets
Enable HTML and XML Schema fuzzers.
* [libxml2] Compile missing source files
* [libxml2] Don't forget to build seed corpora
* added draco integration files
* wrote build file and Dockerfile for Draco
* added Apache 2 license header
* changed project maintainer, cleaned up draco_decoder_fuzzer, and set working directory in Dockerfile
* added a couple of fuzzers
* two more targets
* merged from upstream
* build point cloud encoding fuzzer, renamed quantization fuzzers
* added more fuzzers
* moved fuzzers and build script to https://github.com/google/draco, made the build script here execute the new one
Co-authored-by: Ravi Jotwani <rjotwani@google.com>
* QEMU: Add fuzz target build scripts
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
* QEMU: Disable AFL and MSan in project.yaml
We can't link against OSS-Fuzz' afl driver as it is not compiled with
-fPIC. Additionally, it appears that we trigger some false-positives
with MemorySanitizer, since we don't instrument all of the libraries.
Disable AFL and MemorySanitizer, for now.
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
* [opus] Build with -D_FORTIFY_SOURCE=0 to avoid msan false positives
Without this, a silk_memcpy call could resolve to __memcpy_chk,
which does not have an msan intercept, leading to false use-of-uninitialized-value errors.
* [opus] Consolidate cflags
* [opus] Fix typo
Temporary fix for sanitizer validation.
Our sanitizer validation is hacky and isn't using pyyaml to actually
parse the project.yaml file. Temporarily work around #3996 by not
validating sanitizers if no sanitizers are specified in project.yaml.
* Link against `libc++` with proper config in `.bazelrc`
* Add support for `undefined` build, link against proper `clang_rt` library
* Don't rsync in verbose mode.
* Support `undefined` and `memory` sanitizers
* Support more fuzzers than just `libfuzzer`.
The oss-fuzz documentation states that listing supported sanitizers in a project's yaml [is optional](https://google.github.io/oss-fuzz/getting-started/new-project-guide/#sanitizers). It appears that CIFuzz requires supported sanitizers to be included in this file ([ref](26e8d7c772/infra/cifuzz/cifuzz.py (L508-L529))). I believe this causes the CIFuzz Github Action to fail for projects that have not listed support for address sanitizer explicitly in their respective project YAML.
This PR explicitly defines support for asan and ubsan with a goal of fixing h2o's CIFuzz build
This got a bit messy as a change, but it's basically all that topic. I
had to go squint at python3-libraries to figure out the modern
incantation for getting python3 to build under the fuzzer, but victory
is mine and this is probably substantially cleaner.
* Need to manually install numpy now as it is used in the toolchain
* Handle review
* Remove bazel install since we install bazelisk
* Force symlink python3 -> python
* Refactor build script
* Remove `-stdlib=libc++` as that causes link errors
* Remove `identity_fuzz` as it results in a huge fuzzer. Will work on reducing size and then enable back
* Copy fuzzer to `$OUT`, not move
* Handle coverage support
* Added new fuzzer to xpdf.
* Updated sanitizers.
* Limit sanitizer to address as this is the only one that allows us to fuzz the pdf core parser.
* Disable logging and go further into the API.
binaryFate