[lwip-devel] [bug #64010] oss-fuzz integration

[J. Neuschäfer]

Follow-up Comment #6, bug #64010 (project lwip):

It is true, OSS-Fuzz is SaaS (and inconveniently requires using a Google
account), and thus may be undesirable for some people.

However, I think in the case of OSS-Fuzz, the dependence and vendor lock-in is
limited, since most of the interesting parts exist outside of SaaS
infrastructure and can be reused if Google disappears (or becomes hostile)
tomorrow:

- lwIP's fuzzing wrappers (lwip_fuzz etc.) live in lwip.git

- the fuzzer itself (AFL or AFL++) is free software, maintained in public git
repositories, and included in distributions such as Debian

One notable exception:

- The fuzzing corpus, the collection of files generated by the fuzzer to
produce different behavior in lwIP, primarily lives on Google servers, in the
case of OSS-Fuzz. As far as I understand it, it can be downloaded, but this
requires action on part of the lwIP maintainers. It can also be re-generated
given enough CPU time.


    _______________________________________________________

Reply to this item at:

  <https://savannah.nongnu.org/bugs/?64010>

_______________________________________________
Message sent via Savannah
https://savannah.nongnu.org/