diff options
| author | Eric Sesterhenn <eric.sesterhenn@x41-dsec.de> | 2024-10-14 23:04:10 +0200 |
|---|---|---|
| committer | Taylor Blau <me@ttaylorr.com> | 2024-10-17 00:14:11 +0200 |
| commit | 751d063f27a1d3c77ef092d4737524c55c65d972 (patch) | |
| tree | 8392d58000bae4a01a62faab7d09188f7820db99 /ci | |
| parent | fuzz: port fuzz-parse-attr-line from OSS-Fuzz (diff) | |
| download | git-751d063f27a1d3c77ef092d4737524c55c65d972.tar.xz git-751d063f27a1d3c77ef092d4737524c55c65d972.zip | |
fuzz: port fuzz-url-decode-mem from OSS-Fuzz
Git's fuzz tests are run continuously as part of OSS-Fuzz [1]. Several
additional fuzz tests have been contributed directly to OSS-Fuzz;
however, these tests are vulnerable to bitrot because they are not built
during Git's CI runs, and thus breaking changes are much less likely to
be noticed by Git contributors.
Port one of these tests back to the Git project:
fuzz-url-decode-mem
This test was originally written by Eric Sesterhenn as part of a
security audit of Git [2]. It was then contributed to the OSS-Fuzz repo
in commit c58ac4492 (Git fuzzing: uncomment the existing and add new
targets. (#11486), 2024-02-21) by Jaroslav Lobačevski. I (Josh Steadmon)
have verified with both Eric and Jaroslav that they're OK with moving
this test to the Git project.
[1] https://github.com/google/oss-fuzz
[2] https://ostif.org/wp-content/uploads/2023/01/X41-OSTIF-Gitlab-Git-Security-Audit-20230117-public.pdf
Co-authored-by: Jaroslav Lobačevski <jarlob@gmail.com>
Co-authored-by: Josh Steadmon <steadmon@google.com>
Signed-off-by: Josh Steadmon <steadmon@google.com>
Signed-off-by: Taylor Blau <me@ttaylorr.com>
Diffstat (limited to 'ci')
| -rwxr-xr-x | ci/run-build-and-minimal-fuzzers.sh | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/ci/run-build-and-minimal-fuzzers.sh b/ci/run-build-and-minimal-fuzzers.sh index 13c85320d6..e7b97952e7 100755 --- a/ci/run-build-and-minimal-fuzzers.sh +++ b/ci/run-build-and-minimal-fuzzers.sh @@ -21,6 +21,7 @@ date pack-headers pack-idx parse-attr-line +url-decode-mem " for fuzzer in $fuzzers; do |