Integrating with OSS-Fuzz

[Google-Autofuzz]

Greetings openexr developers and contributors,

We’re reaching out because your project is an important part of the open source ecosystem, and we’d like to invite you to integrate with our fuzzing service, OSS-Fuzz. OSS-Fuzz is a free fuzzing infrastructure you can use to identify security vulnerabilities and stability bugs in your project, like those ones. OSS-Fuzz will:
Continuously run all the fuzzers you write.
Alert you when it finds issues.
Automatically close issues after they’ve been fixed by a commit.

Many widely used open source projects like OpenSSL, FFmpeg, LibreOffice, and ImageMagick are fuzzing via OSS-Fuzz, which helps them find and remediate critical issues.

Even though typical integrations can be done in < 100 LoC, we have a reward program in place which aims to recognize folks who are not just contributing to open source, but are also working hard to make it more secure.

We want to stress that anyone who meets the eligibility criteria and integrates a project with OSS-Fuzz is eligible for a reward.

If you're not interested in integrating with OSS-Fuzz, it would be helpful for us to understand why—lack of interest, lack of time, or something else—so we can better support projects like yours in the future.

If we’ve missed your question in our FAQ, feel free to reply or reach out to us at oss-fuzz-outreach@googlegroups.com.

Thanks!

Julien,
OSS-Fuzz Team

[cary-ilm]

We're interesting in finding out more information about the service. We'll contact you directly via email.

[cary-ilm]

After discussing it further with the OpenEXR Technical Steering Committee, we've decided to rely on our own fuzz testing infrastructure rather than integrating with OSS-Fuzz.

[Google-Autofuzz]

How is your fuzzing going?

We still have around two dozen crashes reproducing our the current master, and Samuel Groß from project zero found 8 exploitable issues in two weeks of fuzzing.

It seems that you refused OS-Fuzz integration because "we take security seriously and have invested in a fuzz test that we’d prefer to keep investing in".

I'm not sure I understand your position: you have some fuzzers, yet you don't want Google to run them for you?