Fuzzing integration by way of OSS-Fuzz

[DavidKorczynski]

Hi!

I was wondering if you would be interested in getting rpm fuzzed by OSS-Fuzz? Fuzzing is a technique for stress-testing applications and OSS-Fuzz is a service run by Google for fuzzing important open source projects. It would be great to get rpm integrated with OSS-Fuzz. OSS-Fuzz will run the fuzzers continuously and report back with bug reports when bugs are found. These reports will have full stack traces, input triggers and more (i.e. Sanitizer reports). If you are interested, then the only thing needed is an email(s) connected to a Google account that can be used for receiving the bugs reports, which can be put in the configuration file (project.yaml) over at the OSS-Fuzz repository.

I have set up an initial integration with OSS-Fuzz here: google/oss-fuzz#6778 which includes a simple initial fuzzer targetting headerRead. Am happy to extend with more fuzzers if you are happy to integrate.

[DemiMarie]

I have set up an initial integration with OSS-Fuzz here: google/oss-fuzz#6778 which includes a simple initial fuzzer targetting headerRead. Am happy to extend with more fuzzers if you are happy to integrate.

There are lower-level functions that should also be fuzzed, such as (IIRC) headerImport.

[DavidKorczynski]

Am happy to write such fuzzers @DemiMarie if you are happy to integrate!

[DemiMarie]

I have actually already written the fuzzers, but I need to figure out how to integrate them.

[DavidKorczynski]

Ah cool - I can help with that too. The integration on the OSS-Fuzz side is fairly simple and it should be straightforward to add more fuzzers. Let me know how you would to do this!

[teythoon]

I think pgpPrtParams(const uint8_t * pkts, size_t pktlen, unsigned int pkttype, NULL) would be a good target.

[DavidKorczynski]

I think pgpPrtParams(const uint8_t * pkts, size_t pktlen, unsigned int pkttype, NULL) would be a good target.

Am happy to do this, I just maintainer approval to integrate and also one or more emails to recipients of bug reports!

[DemiMarie]

#1559 has a fuzz harnessed I used in the past. Not sure who bug reports should go to. @Conan-Kudo suggestions?

[Conan-Kudo]

@pmatilai, @ffesti, or @dmnks are appropriate folks to receive that information.

[DavidKorczynski]

@pmatilai @ffesti @dmnks would you be interested in this? I would be happy to move forward with the OSS-Fuzz integration and add fuzzers if you're willing to receive the emails with bug reports