6 ms·
>Woha, is this legit or some sort of scam on Google in some way?: I work on OSS-Fuzz. As far as I can tell, the author's PRs do not compromise OSS-Fuzz in any
by metzmanj 2y ago
>Woha, is this legit or some sort of scam on Google in some way?:
I work on OSS-Fuzz.
As far as I can tell, the author's PRs do not compromise OSS-Fuzz in any way.
OSS-Fuzz doesn't trust user code for this very reason.
- packetlost 2y agoIt looks more like they disabled a feature of oss-fuzz that would've caught the exploit, no?
- metzmanj 2y agoThat's what people are saying though I haven't had the chance to look into this myself. Fuzzing isn't really the best tool for catching bugs the maintainer intentionally inserted though.
- bombcar 2y agoIt's more likely that fuzzing would blow up on new code and they wanted an excuse to remove it. After all, if it hadn't had a performance regression (someone could submit a PR fixing whatever slowed it down, heh) it still wouldn't be known.