Oliver Chang

icon company @google icon location Senior Staff SWE on Open Source Security @ Google. Founder of the OSV.dev project, co-founder of OSS-Fuzz.

Results 621 comments of Oliver Chang

Ecosystem support for tooling that is outside of the language or os specific package management system

Here are some existing curl examples in OSV (based off OSS-Fuzz automation): https://github.com/google/oss-fuzz-vulns/blob/main/vulns/curl/OSV-2022-450.yaml, https://github.com/google/oss-fuzz-vulns/blob/main/vulns/curl/OSV-2022-141.yaml

Ecosystem support for tooling that is outside of the language or os specific package management system

> Using a Github URL would work to disambiguate this curl from any others, but there's a technicality: the curl releases are almost-but-not-quite what's tagged in git, so doing so...

Ecosystem support for tooling that is outside of the language or os specific package management system

> Noting here that we're running into the same problem for projects like CPython, there is no ecosystem value for OSV that matches PURL's "generic" ecosystem. Would something like the...

OOB access in `parse_string`

Gentle ping on this issue!

[DO NOT MERGE] Test using project context from Fuzz Introspector

/gcbrun request_pr_exp.py -n test-244

c_str() / data() lifetime issues in generated targets

We can potentially detect instances of this (and potentially more general issues) by checking if the ASan-reported free stack has LLVMFuzzerTestOneInput at the top, which indicates the freeing happened in...

Try to get generated targets to null terminate where necessary.

/gcbrun exp -n oc -f

Try to get generated targets to null terminate where necessary.

/gcbrun exp -n oc

NuGet isn't strictly SemVer

> @oliverchang hey! Thank you ++ ... we are slowly but surely accumulating the warts of every versioning scheme ever produced! There are way too many schemes out there :)...

NuGet isn't strictly SemVer

> @oliverchang > > > in case this helps, our implementation for NuGet in OSV is here: https://github.com/google/osv/blob/master/lib/osv/nuget.py. It uses a bit of regex and an existing SemVer implementation. >...