Lz4: Integrating with OSS-Fuzz

[Google-Autofuzz]

Greetings lz4 developers and contributors,

We’re reaching out because your project is an important part of the open source ecosystem, and we’d like to invite you to integrate with our fuzzing service, OSS-Fuzz. OSS-Fuzz is a free fuzzing infrastructure you can use to identify security vulnerabilities and stability bugs in your project. OSS-Fuzz will:

• Continuously run all the fuzzers you write.
• Alert you when it finds issues.
• Automatically close issues after they’ve been fixed by a commit.

Many widely used open source projects like OpenSSL, FFmpeg, LibreOffice, and ImageMagick, ZSTD are fuzzing via OSS-Fuzz, which helps them find and remediate critical issues.

Even though typical integrations can be done in < 100 LoC, we have a reward program in place which aims to recognize folks who are not just contributing to open source, but are also working hard to make it more secure.

We want to stress that anyone who meets the eligibility criteria and integrates a project with OSS-Fuzz is eligible for a reward.

We have a sample fuzz target that you are welcome to use directly or modify, that can be used as a starting point.

If you're not interested in integrating with OSS-Fuzz, it would be helpful for us to understand why—lack of interest, lack of time, or something else—so we can better support projects like yours in the future.

If we’ve missed your question in our FAQ, feel free to reply or reach out to us at [email protected].

Thanks!
The OSS-Fuzz Team

[Google-Autofuzz]

Hi,

Here is a sample fuzz target that you are welcome to modify and use.

Thanks!

Tommy,
The OSS-Fuzz Team

[Cyan4973]

I'm favorable to this action, and thank you for the helper.

Now, the issue is more to find time to do it ...

[Google-Autofuzz]

If you want, we are gladly to help you to integrate OSS-Fuzz for LZ4 :)

[cmeister2]

If you're interested I am currently working on an integration here. I have some experience doing this for curl :smile:

[cmeister2]

@Cyan4973: I've got a branch available for the above work that's currently compiling and generating a valid fuzz target (though at the moment it's all pointing at my forks). Let me know if you want to take this forwards. If so, the next steps are probably to:

• configure this on oss-fuzz (I have a branch for that too)
• submit a PR for here

After that you can start making as many fuzz targets as you can think of.

[Cyan4973]

Sounds great @cmeister2 !

[Google-Autofuzz]

@cmeister2 Please let me know if you need help with integrating with oss-fuzz!