search

google / gumbo-parser

An HTML5 parsing library in pure C99
Apache License 2.0
5.16k stars 663 forks source link

Integrating with OSS-Fuzz #419

Closed Google-Autofuzz closed 1 year ago

Google-Autofuzz commented 4 years ago

Greetings gumbo-parser developers and contributors,

We’re reaching out because your project is an important part of the open source ecosystem, and we’d like to invite you to integrate with our fuzzing service, OSS-Fuzz. OSS-Fuzz is a free fuzzing infrastructure you can use to identify security vulnerabilities and stability bugs in your project. OSS-Fuzz will:

Many widely used open source projects like OpenSSL, FFmpeg, LibreOffice, and ImageMagick are fuzzing via OSS-Fuzz, which helps them find and remediate critical issues.

Even though typical integrations can be done in < 100 LoC, we have a reward program in place which aims to recognize folks who are not just contributing to open source, but are also working hard to make it more secure.

We want to stress that anyone who meets the eligibility criteria and integrates a project with OSS-Fuzz is eligible for a reward.

If you're not interested in integrating with OSS-Fuzz, it would be helpful for us to understand why—lack of interest, lack of time, or something else—so we can better support projects like yours in the future.

If we’ve missed your question in our FAQ, feel free to reply or reach out to us at oss-fuzz-outreach@googlegroups.com.

Thanks!

Tommy OSS-Fuzz Team

intrigus-lgtm commented 4 years ago

Hi Tommy,

I was just passing by this repository and saw this issue. I'm curious, how do you determine whether a project is an important part of the open source ecosystem?

Also I'm not sure really what the point of fuzzing this library is. The last commit has been in 2016 and the library seems to be kind of unmaintained? Who would then fix any of the bugs, OSS-Fuzz finds? (Or it's just super stable and doesn't need any changes?)

Google-Autofuzz commented 4 years ago

Hi @intrigus-lgtm ,

We have a list of third_party packages internally and we find gumbo-parser on it. We found some API needed to be fuzzed. After the integration, the maintainers do take the bugs and fix them. If this package is unmaintained, then we will not be fuzzing it.

We can close this issue if this package is unmaintained or because of other reasons that the maintainers don't need this package to be integrated.

Thanks.