Skip to content

Conversation

@ranok
Copy link
Contributor

@ranok ranok commented Jan 21, 2026

This PR revitalizes the ntp fuzzer build process.

The patch that adds the fuzzer was re-targeted for the 2+ years of updates where it was failing. I switched from ld.gold to lld to fix the issues identified in #10425 (comment)

Both address and undefined fuzzers build and check_build comes back as successful.

@github-actions
Copy link

ranok is a new contributor to projects/ntp. The PR must be approved by known contributors before it can be merged. The past contributors are: joycebrum, cvediver, Dor1s, catenacyber (unverified)

ranok and others added 21 commits January 23, 2026 09:41
This PR fixes the strongswan build to disable debug log that crash new
fuzzers.

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
This PR fixes the build script for libcoap to enable oscore server for
the new fuzzer.

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
## Summary
Enhance assimp fuzzing infrastructure with format-specific fuzzers for
better coverage.

## Changes
- Add 7 format-specific fuzzers (generic, OBJ, glTF, GLB, FBX, Collada,
STL)
- Add seed corpus from test models for each format
- Add fuzzing dictionary with format-specific tokens
- Enable Memory Sanitizer (previously disabled due to google#6294)
- Update build script with helper function for building multiple fuzzers
- Add zip dependency to Dockerfile for corpus creation

## Testing
Tested locally:
```
python infra/helper.py build_image assimp  # PASSED
python infra/helper.py build_fuzzers assimp  # PASSED - all 7 fuzzers built
python infra/helper.py run_fuzzer assimp assimp_fuzzer_stl -- -max_total_time=30  # PASSED
```

## Fuzzers
| Fuzzer | Target Format | Corpus Size |
|--------|---------------|-------------|
| assimp_fuzzer | All formats | 87MB |
| assimp_fuzzer_obj | OBJ | 390KB |
| assimp_fuzzer_gltf | glTF (text) | 17MB |
| assimp_fuzzer_glb | GLB (binary) | 11MB |
| assimp_fuzzer_fbx | FBX | 2MB |
| assimp_fuzzer_collada | Collada | 3MB |
| assimp_fuzzer_stl | STL | 157KB |

## Related
- Upstream assimp PR (merged):
assimp/assimp#6429
Installs poppler-data package and copies encoding files to
`$OUT/poppler-data` for runtime access.

**Why:** Poppler's GlobalParams requires CMap and encoding data for CJK
text and character mapping operations. Currently unavailable in OSS-Fuzz
environment.

**Changes:**
- Dockerfile: Install poppler-data package
- build.sh: Copy `/usr/share/poppler` to `$OUT/poppler-data`

**Coordination:**
- Poppler MR:
https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2008
- Issue: https://gitlab.freedesktop.org/poppler/poppler/-/issues/1656

cc: @tsdgeos

---------

Signed-off-by: ADITYA TIWARI <adityatiwari342005@gmail.com>
Co-authored-by: Carlo Lemos <55899543+vitaliset@users.noreply.github.com>
Co-authored-by: Carlo Lemos <55899543+vitaliset@users.noreply.github.com>
Depends on
https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2068

Co-authored-by: Carlo Lemos <55899543+vitaliset@users.noreply.github.com>
A historical change last month turned out to break the build of our
fuzzers due to new build requirements (wasm blobs built during the
fuzzer build), so this adds the corresponding Rust targets to fix the
build.
Otherwise we lose all of our configure results and build artifacts.
Adds the new Hypothesis fuzz tests to the `python3-libraries` project.
To support the new
[Hypothesis](python/library-fuzzers#3) [property
tests](python/library-fuzzers#4), Hypothesis
needs to be installed during the build step.
… vvenc, x264 and OpenJPH wh… (google#14807)

graphicsmagick Dockerfile fixes/additions.

Clone default branch for aom. Clone vvdec, vvenc, x264 and OpenJPH which
are used by libheif
in generated code

Recent changes in libssh introduced some generated code that violates
the `declaration-after-statement` requirement and that is breaking
today's build. This is an attempt to fix it

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Adds run_tests.sh for the spotify-json glog libarchive project.

run_tests.sh is used as part of Chronos with cached builds:

https://github.com/google/oss-fuzz/tree/master/infra/chronos#chronos-feature--running-tests-of-a-project

---------

Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
…14444)

This enables centipede and any future sanitizer additions. It also fixes
the repository path and pulls the libprotobuf-mutator build into the
Dockerfile rather than being done in the script in the external
repository. I believe this should improve caching.
These two changes update the settings for Apache POI to recent changes
in the project and add a new fuzz-target with hopefully covers more code
by using the existing integration-test framework of Apache POI itself.
This hopefully also makes it easier to increase code-coverage in the
future as it can be added to Apache POI directly.

## Adjust for some changes to the project
Use latest Maven, Java 11, Jazzer, log4j
Remove Java 8 as latest Apache POI sources only support JDK 11 or higher
Target LTS-version JDK 17 in pom.xml

Exclude some more files from shaded jar
To remove some warnings during building

Add dependency for zstd
Locally fuzzing failed with ClassNotFoundError if this
dependency is not added manually. Apache POI should usually
not need this, but some broken documents can trigger it.

It seems commons-compress does not automatically include this
dependency.

Add libpng16.so.16 and libfreetype.so.6

Apache POI uses the OS font-system for computing font-sizes,
it seems in some cases this requires libfreetype6 or libpng
in addition to the libs already installed here.

Add another custom setting to avoid OOM

This should avoid OOMs like in
https://issues.oss-fuzz.com/issues/391709145
as memory settings during fuzzing are too small for the default limits

## Add a fuzz-target which uses the existing integration-tests of Apache
POI
This should trigger much more code-areas and allows to enhance testing
over time by adding more functionality directly in the
integration-tests.
- Removed fluffy pony
- Added Jeffro
- Added Selsta
- Added Jberman
- [x] ~~Depends on google#13929~~
- [x] ~~Depends on ligurio/luzer#74
- [x] ~~Depends on ligurio/luzer#76
- [x] ~~Depends on ligurio/luzer#78
- [x] ~~Depends on ligurio/lunapark#163
- [x] Depends on tarantool/tarantool#12097
Co-authored-by: Carlo Lemos <55899543+vitaliset@users.noreply.github.com>
@ranok ranok closed this Jan 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.