]> git.ipfire.org Git - thirdparty/git.git/commit
fuzz: port fuzz-parse-attr-line from OSS-Fuzz
authorEric Sesterhenn <eric.sesterhenn@x41-dsec.de>
Mon, 14 Oct 2024 21:04:09 +0000 (14:04 -0700)
committerTaylor Blau <me@ttaylorr.com>
Wed, 16 Oct 2024 22:14:11 +0000 (18:14 -0400)
commit72686d4e5e9a7236b9716368d86fae5bf1ae6156
tree9b2db38be18ad967656502f6bdfc952409a49a33
parent966253db757948d4e0738c5c1fac5b694f0d042d
fuzz: port fuzz-parse-attr-line from OSS-Fuzz

Git's fuzz tests are run continuously as part of OSS-Fuzz [1]. Several
additional fuzz tests have been contributed directly to OSS-Fuzz;
however, these tests are vulnerable to bitrot because they are not built
during Git's CI runs, and thus breaking changes are much less likely to
be noticed by Git contributors.

Port one of these tests back to the Git project:
fuzz-parse-attr-line

This test was originally written by Eric Sesterhenn as part of a
security audit of Git [2]. It was then contributed to the OSS-Fuzz repo
in commit c58ac4492 (Git fuzzing: uncomment the existing and add new
targets. (#11486), 2024-02-21) by Jaroslav Lobačevski. I (Josh Steadmon)
have verified with both Eric and Jaroslav that they're OK with moving
this test to the Git project.

[1] https://github.com/google/oss-fuzz
[2] https://ostif.org/wp-content/uploads/2023/01/X41-OSTIF-Gitlab-Git-Security-Audit-20230117-public.pdf

Co-authored-by: Jaroslav Lobačevski <jarlob@gmail.com>
Co-authored-by: Josh Steadmon <steadmon@google.com>
Signed-off-by: Josh Steadmon <steadmon@google.com>
Signed-off-by: Taylor Blau <me@ttaylorr.com>
Makefile
attr.c
attr.h
ci/run-build-and-minimal-fuzzers.sh
oss-fuzz/.gitignore
oss-fuzz/fuzz-parse-attr-line.c [new file with mode: 0644]