search

Stellarium / stellarium

Stellarium is a free GPL software which renders realistic skies in real time with OpenGL. It is available for Linux/Unix, Windows and macOS. With Stellarium, you really see what you can see with your eyes, binoculars or a small telescope.
https://stellarium.org
GNU General Public License v2.0
7.54k stars 813 forks source link

OSS-Fuzz integration #3419

Closed fuzzy-boiii23a closed 11 months ago

fuzzy-boiii23a commented 11 months ago

Hi all,

Just enquiring to see if there is interest with regards to integrating this project into OSS-Fuzz? this would allow continuous testing of this project in order to identify memory corruption vulnerabilities using google's infrastructure with no monetary cost to this project. Google's OSS-Fuzz has identified 10,000 vulnerabilities and 36,000 bugs in 1000 open source projects as per https://google.github.io/oss-fuzz/#trophies. The process can be seen at https://google.github.io/oss-fuzz/architecture/ and I'm willing to integrate this project into OSS-Fuzz and write harnesses to test key functionalities of this project.

If this is something that everyone would like to see could you please let me know and provide me with an email or two in order to receive new issues found via fuzzing? I'm also happy to support with writing patches for any issues found.

github-actions[bot] commented 11 months ago

Thanks for adding your first issue to Stellarium. If you have questions, please do not hesitate to contact us.

gzotti commented 11 months ago

Never seen this, but it looks interesting to have yet another test kit. @alex-w ?

alex-w commented 11 months ago

@gzotti it’s not an easy - see docs

fuzzy-boiii23a commented 11 months ago

@alex-w i have experience with this sort of thing so i'm more than happy complete all the effort required to get this successfully integrated and once integrated there should be no further work required from yourselves aside from receiving bug reports from the fuzzing itself which i am happy to help with regarding patching any issues found so if you're okay with it i can get started and cc either yourself or @gzotti on any issues found once integrated?

gzotti commented 11 months ago

If this does not require write access for you here and no further work from our side (apart from rapidly fixing newly reported bugs, or receiving your PRs with fixes), it's fine for me.

fuzzy-boiii23a commented 11 months ago

I won't require write access to the repo, thanks and I hope you have a great day :)