fuzz: move fuzz_target from oss-fuzz

pelletier / go-toml

Go library for the TOML file format

https://github.com/pelletier/go-toml

Other

1.72k stars 209 forks source link

fuzz: move fuzz_target from oss-fuzz #861

Closed manunio closed 1 year ago

manunio commented 1 year ago

This pr attempts to move fuzz_toml fuzz_target from oss-fuzz to go-toml.
Its recommended by oss-fuzz to move fuzz-target upstream as this eases maintenance of fuzz_target.
It also include check against too large input.
Skips fuzz from coverage report.
Adds a new ossfuzz package

manunio commented 1 year ago

fuzzing check: It will be fixed at oss-fuzz as soon as this pr lands.

manunio commented 1 year ago

Friendly Ping :)

pelletier commented 1 year ago

Sorry for the delay!

I think I know what's going on. When the code is in oss_fuzz.go, the coverage assumes it's part of the codebase. When it's part of the _test.go file, Go expects all Fuzz* functions to have a specific signature for the built-in fuzzing mechanism.

I just realized that the current proposal would add FuzzToml to the public API of go-toml, which I'd like to avoid. Is there a way to either put it in a new /ossfuzz directory (if you need to call the function directly) or /cmd/ossfuzz if you'd rather use a binary.

manunio commented 1 year ago

Sorry for the delay!

I think I know what's going on. When the code is in oss_fuzz.go, the coverage assumes it's part of the codebase. When it's part of the _test.go file, Go expects all Fuzz* functions to have a specific signature for the built-in fuzzing mechanism.

I just realized that the current proposal would add FuzzToml to the public API of go-toml, which I'd like to avoid. Is there a way to either put it in a new /ossfuzz directory (if you need to call the function directly) or /cmd/ossfuzz if you'd rather use a binary.

Hi, Thanks for the feedback, I have made changes as per your request :)

pelletier commented 1 year ago

Thank you!