Continuous fuzzing by way of Google's OSS-Fuzz

[DavidKorczynski]

Hi,

I was wondering if you would like to integrate continuous fuzzing by way of OSS-Fuzz? Fuzzing is a way to automate test-case generation and has been heavily used for memory unsafe languages. Recently efforts have been put into fuzzing memory safe languages and Python is one of the languages where it would be great to use fuzzing.

In this google/oss-fuzz#8192 I did an initial integration into OSS-Fuzz. OSS-Fuzz is a free service run by Google that performs continuous fuzzing of important open source projects. Since this is also a Google project you should be able to reach out internally e.g. to the Google Open Source Security team (GOSST) if you have any questions.

If you would like to integrate, the only thing I need is a list of email(s) that will get access to the data produced by OSS-Fuzz, such as bug reports, coverage reports and more stats. Notice the emails affiliated with the project will be public in the OSS-Fuzz repo, as they will be part of a configuration file.

[ace-n]

Hi @DavidKorczynski,

Thanks for the idea. Can you point to any bugs or previous security issues with this repo where this would have helped?

(We unfortunately don't have time to "implement fuzzing for fuzzing's sake", per se.)

[parthea]

I'm going to transfer this issue to the google-cloud-python repository as we are preparing to move the code for google-cloud-tasks to that repository in the next 1-2 weeks.

[parthea]

Closing as duplicate of #11069