[0/3] fuzz: port OSS-Fuzz tests back to Git

Message

Josh Steadmon Oct. 10, 2024, 9:11 p.m. UTC

Git's fuzz tests are run continuously as part of OSS-Fuzz [1]. Several
additional fuzz tests have been contributed directly to OSS-Fuzz;
however, these tests are vulnerable to bitrot because they are not built
during Git's CI runs, and thus breaking changes are much less likely to
be noticed by Git contributors.

OSS-Fuzz's recommended setup is for tests to live in the repository of
the code they test and to be built along with other tests [1].

Port some of these tests back to the Git project, so that they can be
built and tested during our normal development workflow and CI, and as
such avoid future bitrot.

[1] https://google.github.io/oss-fuzz/advanced-topics/ideal-integration/


Eric Sesterhenn (3):
  fuzz: port fuzz-credential-from-url-gently from OSS-Fuzz
  fuzz: port fuzz-parse-attr-line from OSS-Fuzz
  fuzz: port fuzz-url-decode-mem from OSS-Fuzz

 Makefile                                   |  3 ++
 attr.c                                     | 38 +------------------
 attr.h                                     | 43 ++++++++++++++++++++++
 ci/run-build-and-minimal-fuzzers.sh        | 15 +++++++-
 oss-fuzz/.gitignore                        |  3 ++
 oss-fuzz/fuzz-credential-from-url-gently.c | 32 ++++++++++++++++
 oss-fuzz/fuzz-parse-attr-line.c            | 39 ++++++++++++++++++++
 oss-fuzz/fuzz-url-decode-mem.c             | 43 ++++++++++++++++++++++
 8 files changed, 177 insertions(+), 39 deletions(-)
 create mode 100644 oss-fuzz/fuzz-credential-from-url-gently.c
 create mode 100644 oss-fuzz/fuzz-parse-attr-line.c
 create mode 100644 oss-fuzz/fuzz-url-decode-mem.c


base-commit: 159f2d50e75c17382c9f4eb7cbda671a6fa612d1

Comments

Junio C Hamano Oct. 10, 2024, 9:34 p.m. UTC | #1

Josh Steadmon <[e-mail]> writes:

> Git's fuzz tests are run continuously as part of OSS-Fuzz [1]. Several
> additional fuzz tests have been contributed directly to OSS-Fuzz;
> however, these tests are vulnerable to bitrot because they are not built
> during Git's CI runs, and thus breaking changes are much less likely to
> be noticed by Git contributors.
>
> OSS-Fuzz's recommended setup is for tests to live in the repository of
> the code they test and to be built along with other tests [1].
>
> Port some of these tests back to the Git project, so that they can be
> built and tested during our normal development workflow and CI, and as
> such avoid future bitrot.
>
> [1] https://google.github.io/oss-fuzz/advanced-topics/ideal-integration/

Thanks!  Very much appreciated.

> Eric Sesterhenn (3):
>   fuzz: port fuzz-credential-from-url-gently from OSS-Fuzz
>   fuzz: port fuzz-parse-attr-line from OSS-Fuzz
>   fuzz: port fuzz-url-decode-mem from OSS-Fuzz
>
>  Makefile                                   |  3 ++
>  attr.c                                     | 38 +------------------
>  attr.h                                     | 43 ++++++++++++++++++++++
>  ci/run-build-and-minimal-fuzzers.sh        | 15 +++++++-
>  oss-fuzz/.gitignore                        |  3 ++
>  oss-fuzz/fuzz-credential-from-url-gently.c | 32 ++++++++++++++++
>  oss-fuzz/fuzz-parse-attr-line.c            | 39 ++++++++++++++++++++
>  oss-fuzz/fuzz-url-decode-mem.c             | 43 ++++++++++++++++++++++
>  8 files changed, 177 insertions(+), 39 deletions(-)
>  create mode 100644 oss-fuzz/fuzz-credential-from-url-gently.c
>  create mode 100644 oss-fuzz/fuzz-parse-attr-line.c
>  create mode 100644 oss-fuzz/fuzz-url-decode-mem.c
>
>
> base-commit: 159f2d50e75c17382c9f4eb7cbda671a6fa612d1