oss-fuzz

OSS-Fuzz

Contract

Inputs

Procedure

Task A: run an enrolled project locally

1. Verify docker is available and the user has permission to run containers (docker info exits 0). Done when: docker info exits 0.
2. Clone oss-fuzz if oss_fuzz_dir does not exist or is not a git repository:

   oss_fuzz_dir="${oss_fuzz_dir:-./oss-fuzz}"
   git clone https://github.com/google/oss-fuzz "$oss_fuzz_dir"
   

   Done when: the oss-fuzz repository is cloned and present at oss_fuzz_dir.
3. Change to the oss-fuzz directory:

   oss_fuzz_dir="${oss_fuzz_dir:-./oss-fuzz}"
   cd "$oss_fuzz_dir"
   

   Done when: the working directory is the oss-fuzz directory.
4. Build the project Docker image:

   project_name="${project_name:?project_name is required}"
   uv run --no-project python infra/helper.py build_image --pull "$project_name"
   

   If build_image reports the project directory does not exist under projects/, stop and return enrollment-missing. Done when: the project Docker image builds successfully or enrollment-missing is returned.
5. Build the fuzzers with AddressSanitizer:

   project_name="${project_name:?project_name is required}"
   sanitizer="${sanitizer:-address}"
   uv run --no-project python infra/helper.py build_fuzzers --sanitizer="$sanitizer" "$project_name"
   

   Capture stdout/stderr. If the build exits non-zero, return build-failed with the captured output. Done when: fuzzers compile with the configured sanitizer and stdout/stderr are captured.
6. Run the named harness:

   project_name="${project_name:?project_name is required}"
   harness_name="${harness_name:?harness_name is required}"
   fuzzer_args="${fuzzer_args:-}"
   uv run --no-project python infra/helper.py run_fuzzer "$project_name" "$harness_name" ${fuzzer_args:+"$fuzzer_args"}
   

   Observe for at least 10 seconds. If the harness exits with a sanitizer report, return crash-detected with the report path. Otherwise return harness-ran. Done when: the harness runs for at least 10 seconds and returns harness-ran or crash-detected.