Intigration with Oss-Fuzz
Closed this issue · 5 comments
Hi @agalakhov and @application-developer-DA, I would like to help integrate this project into OSS-Fuzz.
OSS-Fuzz is a free service run by Google that performs continuous fuzzing of important open-source projects.
As tungstenite-rs is already cargo-fuzz based fuzzed, this makes it easily compatible with oss-fuzz out of box.
If you would like to integrate, the only thing I need is a list of email(s), it must be associated with a google account like
gmail (why?). by doing that, the provided email(s) will get access to the data produced by OSS-Fuzz, such as bug reports, coverage reports and more stats.
As an alternative, if you don't have a google/gmail id, but still wish to integrate. I can add my mail id for time being and monitor bug/crashes.
Notice the email(s) affiliated with the project will be public in the OSS-Fuzz repo, as they will be part of a configuration file.
I personally have found many bugs with other open-source repositories.
@agalakhov Any thoughts?
Hey @code-terror, I'll try to substitute @agalakhov then 🙂 (Daniel here, I've renamed my @application-developer-DA handle since it confused people)
Are there any advantages of OSS-Fuzz over cargo-fuzz? - I have not compared them, but it looks like for generic fuzzing logic cargo-fuzz is just fine and covers almost all use cases we would love to cover.
Hey @daniel-abramov , OSS-Fuzz is a free continuous fuzzing service provided by google. The project will be fuzzed by cargo-fuzz only but will be continuously fuzzed by oss-fuzz. They provide the infrastructure and have long runtimes to discover issues frequently. The code base of the project will still stay the same.
Personally, many important bugs were found by oss-fuzz in the projects I was involved.
This sounds good, but I somehow don't get it how is it different from e.g. cargo-fuzz 🙂 Both cargo-fuzz and OSS-Fuzz perform fuzzing. Is OSS-Fuzz fuzzes things in some different way that makes it better at discovering bugs than cargo-fuzz?
It feels to me as it's like adding the support of OSS-Fuzz will essentially introduce another tool for doing the same job that cargo-fuzz does. I might be wrong though, that's why I'm trying to figure it out 😉