Fuzzing cbor-java by way of OSS-Fuzz

[DavidKorczynski]

Hi!

I was wondering if you would be interested in getting cbor-java fuzzed by OSS-Fuzz? Fuzzing is a technique for stress-testing applications and OSS-Fuzz is a service run by Google for fuzzing important open source projects, and it would be great to get cbor-java integrated with OSS-Fuzz. OSS-Fuzz will run the fuzzers continuously and report back with bug reports when bugs are found. These reports will have full stack traces, input triggers and more. If you are interested, then the only thing needed is an email(s) connected to a Google account that can be used for receiving the bugs reports, which can be put in the configuration file (project.yaml) over at the OSS-Fuzz repository.

I have set up an initial integration with OSS-Fuzz here: google/oss-fuzz#6788 and this PR on the OSS-Fuzz repository includes a simple initial fuzzer. We can always extend with more fuzzers if you are happy to integrate. I would just need an email and then get this PR merged, following that we should be good to go and down the line we can also migrate fuzzers from OSS-Fuzz to cbor-java owns repository.

[c-rack]

@DavidKorczynski yes, that would be very appreciated!

[DavidKorczynski]

Wonderful @c-rack - the only thing needed is an email(s) connected to a Google account that can be used for receiving the bugs reports, which email can I use?

[DavidKorczynski]

@c-rack ping (on the email)?

[c-rack]

@DavidKorczynski [email protected]

[c-rack]

@DavidKorczynski Thanks! What would be the next steps? Or could this issue just closed?

[c-rack]

Integrated in https://android.googlesource.com/platform/external/cbor-java, so I'm closing this issue