Skills ZICQ category：DevOps & Cloud ossfuzz

Ossfuzz

Enrolls a project in OSS-Fuzz, Google's free continuous fuzzing service for open source, and drives it locally. Covers project.yaml, Dockerfile and build.sh setup, the helper scripts, reproducing OSS-Fuzz crash reports, and the acceptance criteria. Use when setting up continuous fuzzing for an open-source project, reproducing an OSS-Fuzz bug report, or testing an OSS-Fuzz build before submitting it.

5664 installs

Official URL：skills.sh

What this skill does

Intro in this page language first. The official description stays in its original wording; we do not rewrite SKILL.md.

What it does

When to use it

setting up continuous fuzzing for an open-source project, reproducing an OSS-Fuzz bug report, or testing an OSS-Fuzz build before submitting it

How agents load it

Per Agent Skills progressive disclosure: name and description load at startup (~100 tokens); the full SKILL.md body loads when the skill activates; scripts/, references/, and assets/ load only as needed. This file's sections: OSS-Fuzz; Overview; Key Concepts; When to Apply; Quick Reference; OSS-Fuzz Project Components. It includes spec-recommended sections: step-by-step instructions.

File analysis

File analysis: instruction-only skill (SKILL.md). The agent loads the full body when activated.

OSS-FuzzOverviewKey ConceptsWhen to ApplyQuick ReferenceOSS-Fuzz Project ComponentsBug TrackerBuild Status SystemFuzz IntrospectorStep-by-Step: Running a Single HarnessStep 1: Clone OSS-FuzzStep 2: Build Project Image

Source category：skills.sh agent-skill

Sources & links

Market sources：skills.sh

Full package on GitHub

OSS Skill ranking

SKILL.md & Agent activation

Official spec ↗

name: ossfuzz
description: Enrolls a project in OSS-Fuzz, Google's free continuous fuzzing service for open source, and drives it locally. Covers project.yaml, Dockerfile and build.sh setup, the helper scripts, reproducing OSS-Fuzz crash reports, and the acceptance criteria. Use when setting up continuous fuzzing for an open-source project, reproducing an OSS-Fuzz bug report, or testing an OSS-Fuzz build before submitting it.

DiscoverThe client exposes names and descriptions to the agent.
ActivateYour request or the task context selects the skill and loads its instructions.
Load resourcesReferenced scripts, documentation and assets are used when needed.

Invocation syntax and available tools depend on your Agent client. Client integration guide ↗

Install this skill

Skills CLI ↗

Choose the target agent and installation scope, keep referenced package files, then verify the skill appears in the client's catalog.

Ask your Agent to install

Copy these instructions to a compatible agent and confirm the target directory matches your client.

Install the agent skill "ossfuzz" into my project. The full SKILL.md and official description are at https://zicq.com/en/skills/skl-2fbf2762d78fc73e-Ossfuzz.html
Save it as .cursor/skills/ossfuzz/SKILL.md or .claude/skills/ossfuzz/SKILL.md and keep the frontmatter name and description exactly as-is.

Full package on GitHub ↗

Install from the terminal · Skills CLI

Requires Node.js and npx. First inspect the repository's skill list to confirm the name.

npx skills add 'https://github.com/trailofbits/skills' --list

Target agent Installation scope

npx skills add 'https://github.com/trailofbits/skills' --skill 'ossfuzz'

The CLI lets you choose the agent interactively. The default scope is the project; use -g for user scope. Confirm package availability with the discovery command, then use npx skills list to inspect installed skills.

SKILL.md source Copy freely; the source file is unchanged

# OSS-Fuzz

[OSS-Fuzz](https://google.github.io/oss-fuzz/) is an open-source project developed by Google that provides free distributed infrastructure for continuous fuzz testing. It streamlines the fuzzing process and facilitates simpler modifications. While only select projects are accepted into OSS-Fuzz, the project's core is open-source, allowing anyone to host their own instance for private projects.

## Overview

OSS-Fuzz provides a simple CLI framework for building and starting harnesses or calculating their coverage. Additionally, OSS-Fuzz can be used as a service that hosts static web pages generated from fuzzing outputs such as coverage information.

### Key Concepts

| Concept | Description |
|---------|-------------|
| **helper.py** | CLI script for building images, building fuzzers, and running harnesses locally |
| **Base Images** | Hierarchical Docker images providing build dependencies and compilers |
| **project.yaml** | Configuration file defining project metadata for OSS-Fuzz enrollment |
| **Dockerfile** | Project-specific image with build dependencies |
| **build.sh** | Script that builds fuzzing harnesses for your project |
| **Criticality Score** | Metric used by OSS-Fuzz team to evaluate project acceptance |

## When to Apply

**Apply this technique when:**
- Setting up continuous fuzzing for an open-source project
- Need distributed fuzzing infrastructure without managing servers
- Want coverage reports and bug tracking integrated with fuzzing
- Testing existing OSS-Fuzz harnesses locally
- Reproducing crashes from OSS-Fuzz bug reports

**Skip this technique when:**
- Project is closed-source (unless hosting your own OSS-Fuzz instance)
- Project doesn't meet OSS-Fuzz's criticality score threshold
- Need proprietary or specialized fuzzing infrastructure
- Fuzzing simple scripts that don't warrant infrastructure

## Quick Reference

| Task | Command |
|------|---------|
| Clone OSS-Fuzz | `git clone https://github.com/google/oss-fuzz` |
| Build project image | `uv run --no-project python infra/helper.py build_image --pull <project>` |
| Build fuzzers with ASan | `uv run --no-project python infra/helper.py build_fuzzers --sanitizer=address <project>` |
| Run specific harness | `uv run --no-project python infra/helper.py run_fuzzer <project> <harness>` |
| Generate coverage report | `uv run --no-project python infra/helper.py coverage <project>` |
| Check helper.py options | `uv run --no-project python infra/helper.py --help` |

## OSS-Fuzz Project Components

OSS-Fuzz provides several publicly available tools and web interfaces:

### Bug Tracker

The [bug tracker](https://issues.oss-fuzz.com/issues?q=status:open) allows you to:
- Check bugs from specific projects (initially visible only to maintainers, later [made public](https://google.github.io/oss-fuzz/getting-started/bug-disclosure-guidelines/))
- Create new issues and comment on existing ones
- Search for similar bugs across **all projects** to understand issues

### Build Status System

The [build status system](https://oss-fuzz-build-logs.storage.googleapis.com/index.html) helps track:
- Build statuses of all included projects
- Date of last successful build
- Build failures and their duration

### Fuzz Introspector

[Fuzz Introspector](https://oss-fuzz-introspector.storage.googleapis.com/index.html) displays:
- Coverage data for projects enrolled in OSS-Fuzz
- Hit frequency for covered code
- Performance analysis and blocker identification

Read [this case study](https://github.com/ossf/fuzz-introspector/blob/main/doc/CaseStudies.md) for examples and explanations.

## Step-by-Step: Running a Single Harness

You don't need to host the whole OSS-Fuzz platform to use it. The helper script makes it easy to run individual harnesses locally.

### Step 1: Clone OSS-Fuzz

```bash
git clone https://github.com/google/oss-fuzz
cd oss-fuzz
uv run --no-project python infra/helper.py --help
```

### Step 2: Build Project Image

```bash
uv run --no-project python infra/helper.py build_image --pull <project-name>
```

This downloads and builds the base Docker image for the project.

### Step 3: Build Fuzzers with Sanitizers

```bash
uv run --no-project python infra/helper.py build_fuzzers --sanitizer=address <project-name>
```

**Sanitizer options:**
- `--sanitizer=address` for [AddressSanitizer](https://appsec.guide/docs/fuzzing/techniques/asan/) with [LeakSanitizer](https://github.com/google/sanitizers/wiki/AddressSanitizerLeakSanitizer)
- Other sanitizers available (language support varies)

**Note:** Fuzzers are built to `/build/out/<project-name>/` containing the harness executables, dictionaries, corpus, and crash files.

### Step 4: Run the Fuzzer

```bash
uv run --no-project python infra/helper.py run_fuzzer <project-name> <harness-name> [<fuzzer-args>]
```

The helper script automatically runs any missed steps if you skip them.

### Step 5: Coverage Analysis (Optional)

First, [install gsutil](https://cloud.google.com/storage/docs/gsutil_install) (skip gcloud initialization).

```bash
uv run --no-project python infra/helper.py build_fuzzers --sanitizer=coverage <project-name>
uv run --no-project python infra/helper.py coverage <project-name>
```

Use `--no-corpus-download` to use only local corpus. The command generates and hosts a coverage report locally.

See [official OSS-Fuzz documentation](https://google.github.io/oss-fuzz/advanced-topics/code-coverage/) for details.

## Common Patterns

### Pattern: Running irssi Example

**Use Case:** Testing OSS-Fuzz setup with a simple enrolled project

```bash
# Clone and navigate to OSS-Fuzz
git clone https://github.com/google/oss-fuzz
cd oss-fuzz

# Build and run irssi fuzzer
uv run --no-project python infra/helper.py build_image --pull irssi
uv run --no-project python infra/helper.py build_fuzzers --sanitizer=address irssi
uv run --no-project python infra/helper.py run_fuzzer irssi irssi-fuzz
```

**Expected Output:**
```
INFO:__main__:Running: docker run --rm --privileged --shm-size=2g --platform linux/amd64 -i -e FUZZING_ENGINE=libfuzzer -e SANITIZER=address -e RUN_FUZZER_MODE=interactive -e HELPER=True -v /private/tmp/oss-fuzz/build/out/irssi:/out -t gcr.io/oss-fuzz-base/base-runner run_fuzzer irssi-fuzz.
Using seed corpus: irssi-fuzz_seed_corpus.zip
/out/irssi-fuzz -rss_limit_mb=2560 -timeout=25 /tmp/irssi-fuzz_corpus -max_len=2048 < /dev/null
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 1531341664
INFO: Loaded 1 modules   (95687 inline 8-bit counters): 95687 [0x1096c80, 0x10ae247),
INFO: Loaded 1 PC tables (95687 PCs): 95687 [0x10ae248,0x1223eb8),
INFO:      719 files found in /tmp/irssi-fuzz_corpus
INFO: seed corpus: files: 719 min: 1b max: 170106b total: 367969b rss: 48Mb
#720        INITED cov: 409 ft: 1738 corp: 640/163Kb exec/s: 0 rss: 62Mb
#762        REDUCE cov: 409 ft: 1738 corp: 640/163Kb lim: 2048 exec/s: 0 rss: 63Mb L: 236/2048 MS: 2 ShuffleBytes-EraseBytes-
```

### Pattern: Enrolling a New Project

**Use Case:** Adding your project to OSS-Fuzz (or private instance)

Create three files in `projects/<your-project>/`:

**1. project.yaml** - Project metadata:
```yaml
homepage: "https://github.com/yourorg/yourproject"
language: c++
primary_contact: "your-email@example.com"
main_repo: "https://github.com/yourorg/yourproject"
fuzzing_engines:
  - libfuzzer
sanitizers:
  - address
  - undefined
```

**2. Dockerfile** - Build dependencies:
```dockerfile
FROM gcr.io/oss-fuzz-base/base-builder
RUN apt-get update && apt-get install -y \
    autoconf \
    automake \
    libtool \
    pkg-config
RUN git clone --depth 1 https://github.com/yourorg/yourproject
WORKDIR yourproject
COPY build.sh $SRC/
```

**3. build.sh** - Build harnesses:
```bash
#!/bin/bash -eu
./autogen.sh
./configure --disable-shared
make -j$(nproc)

# Build harnesses
$CXX $CXXFLAGS -std=c++11 -I. \
    $SRC/yourproject/fuzz/harness.cc -o $OUT/harness \
    $LIB_FUZZING_ENGINE ./libyourproject.a

# Copy corpus and dictionary if available
cp $SRC/yourproject/fuzz/corpus.zip $OUT/harness_seed_corpus.zip
cp $SRC/yourproject/fuzz/dictionary.dict $OUT/harness.dict
```

## Docker Images in OSS-Fuzz

Harnesses are built and executed in Docker containers. All projects share a runner image, but each project has its own build image.

### Image Hierarchy

Images build on each other in this sequence:

1. **[base_image](https://github.com/google/oss-fuzz/blob/master/infra/base-images/base-image/Dockerfile)** - Specific Ubuntu version
2. **[base_clang](https://github.com/google/oss-fuzz/tree/master/infra/base-images/base-clang)** - Clang compiler; based on `base_image`
3. **[base_builder](https://github.com/google/oss-fuzz/tree/master/infra/base-images/base-builder)** - Build dependencies; based on `base_clang`
   - Language-specific variants: [`base_builder_go`](https://github.com/google/oss-fuzz/tree/master/infra/base-images/base-builder-go), etc.
   - See [/oss-fuzz/infra/base-images/](https://github.com/google/oss-fuzz/tree/master/infra/base-images) for full list
4. **Your project Docker image** - Project-specific dependencies; based on `base_builder` or language variant

### Runner Images (Used Separately)

- **[base_runner](https://github.com/google/oss-fuzz/tree/master/infra/base-images/base-runner)** - Executes harnesses; based on `base_clang`
- **[base_runner_debug](https://github.com/google/oss-fuzz/tree/master/infra/base-images/base-runner-debug)** - With debug tools; based on `base_runner`

## Advanced Usage

### Tips and Tricks

| Tip | Why It Helps |
|-----|--------------|
| **Don't manually copy source code** | Project Dockerfile likely already pulls latest version |
| **Check existing projects** | Browse [oss-fuzz/projects](https://github.com/google/oss-fuzz/tree/master/projects) for examples |
| **Keep harnesses in separate repo** | Like [curl-fuzzer](https://github.com/curl/curl-fuzzer) - cleaner organization |
| **Use specific compiler versions** | Base images provide consistent build environment |
| **Install dependencies in Dockerfile** | May require approval for OSS-Fuzz enrollment |

### Criticality Score

OSS-Fuzz uses a [criticality score](https://github.com/ossf/criticality_score) to evaluate project acceptance. See [this example](https://github.com/google/oss-fuzz/pull/11444#issuecomment-1875907472) for how scoring works.

Projects with lower scores may still be added to private OSS-Fuzz instances.

### Hosting Your Own Instance

Since OSS-Fuzz is open-source, you can host your own instance for:
- Private projects not eligible for public OSS-Fuzz
- Projects with lower criticality scores
- Custom fuzzing infrastructure needs

## Anti-Patterns

| Anti-Pattern | Problem | Correct Approach |
|--------------|---------|------------------|
| **Manually pulling source in build.sh** | Doesn't use latest version | Let Dockerfile handle git clone |
| **Copying code to OSS-Fuzz repo** | Hard to maintain, violates separation | Reference external harness repo |
| **Ignoring base image versions** | Build inconsistencies | Use provided base images and compilers |
| **Skipping local testing** | Wastes CI resources | Use helper.py locally before PR |
| **Not checking build status** | Unnoticed build failures | Monitor build status page regularly |

## Tool-Specific Guidance

### libFuzzer

OSS-Fuzz primarily uses libFuzzer as the fuzzing engine for C/C++ projects.

**Harness signature:**
```c++
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    // Your fuzzing logic
    return 0;
}
```

**Build in build.sh:**
```bash
$CXX $CXXFLAGS -std=c++11 -I. \
    harness.cc -o $OUT/harness \
    $LIB_FUZZING_ENGINE ./libproject.a
```

**Integration tips:**
- Use `$LIB_FUZZING_ENGINE` variable provided by OSS-Fuzz
- Include `-fsanitize=fuzzer` is handled automatically
- Link against static libraries when possible

### AFL++

OSS-Fuzz supports AFL++ as an alternative fuzzing engine.

**Enable in project.yaml:**
```yaml
fuzzing_engines:
  - afl
  - libfuzzer
```

**Integration tips:**
- AFL++ harnesses work alongside libFuzzer harnesses
- Use persistent mode for better performance
- OSS-Fuzz handles engine-specific compilation flags

### Atheris (Python)

For Python projects with C extensions.

**Example from [cbor2 integration](https://github.com/google/oss-fuzz/pull/11444):**

**Harness:**
```python
import atheris
import sys
import cbor2

@atheris.instrument_func
def TestOneInput(data):
    fdp = atheris.FuzzedDataProvider(data)
    try:
        cbor2.loads(data)
    except (cbor2.CBORDecodeError, ValueError):
        pass

def main():
    atheris.Setup(sys.argv, TestOneInput)
    atheris.Fuzz()

if __name__ == "__main__":
    main()
```

**Build in build.sh:**
```bash
# allow-legacy-python: build.sh runs inside the oss-fuzz container, where the shims are absent.
pip3 install .
for fuzzer in $(find $SRC -name 'fuzz_*.py'); do
  compile_python_fuzzer $fuzzer
done
```

**Integration tips:**
- Use `compile_python_fuzzer` helper provided by OSS-Fuzz
- See [Continuously Fuzzing Python C Extensions](https://blog.trailofbits.com/2024/02/23/continuously-fuzzing-python-c-extensions/) blog post

### Rust Projects

**Enable in project.yaml:**
```yaml
language: rust
fuzzing_engines:
  - libfuzzer
sanitizers:
  - address  # Only AddressSanitizer supported for Rust
```

**Build in build.sh:**
```bash
cargo fuzz build -O --debug-assertions
cp fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_target_1 $OUT/
```

**Integration tips:**
- [Rust supports only AddressSanitizer with libfuzzer](https://google.github.io/oss-fuzz/getting-started/new-project-guide/rust-lang/#projectyaml)
- Use cargo-fuzz for local development
- OSS-Fuzz handles Rust-specific compilation

## Troubleshooting

| Issue | Cause | Solution |
|-------|-------|----------|
| **Build fails with missing dependencies** | Dependencies not in Dockerfile | Add `apt-get install` or equivalent in Dockerfile |
| **Harness crashes immediately** | Missing input validation | Add size checks in harness |
| **Coverage is 0%** | Harness not reaching target code | Verify harness actually calls target functions |
| **Build timeout** | Complex build process | Optimize build.sh, consider parallel builds |
| **Sanitizer errors in build** | Incompatible flags | Use flags provided by OSS-Fuzz environment variables |
| **Cannot find source code** | Wrong working directory in Dockerfile | Set WORKDIR or use absolute paths |

## Related Skills

### Tools That Use This Technique

| Skill | How It Applies |
|-------|----------------|
| **libfuzzer** | Primary fuzzing engine used by OSS-Fuzz |
| **aflpp** | Alternative fuzzing engine supported by OSS-Fuzz |
| **atheris** | Used for fuzzing Python projects in OSS-Fuzz |
| **cargo-fuzz** | Used for Rust projects in OSS-Fuzz |

### Related Techniques

| Skill | Relationship |
|-------|--------------|
| **coverage-analysis** | OSS-Fuzz generates coverage reports via helper.py |
| **address-sanitizer** | Default sanitizer for OSS-Fuzz projects |
| **fuzz-harness-writing** | Essential for enrolling projects in OSS-Fuzz |
| **corpus-management** | OSS-Fuzz maintains corpus for enrolled projects |

## Resources

### Key External Resources

**[OSS-Fuzz Official Documentation](https://google.github.io/oss-fuzz/)**
Comprehensive documentation covering enrollment, harness writing, and troubleshooting for the OSS-Fuzz platform.

**[Getting Started Guide](https://google.github.io/oss-fuzz/getting-started/accepting-new-projects/)**
Step-by-step process for enrolling new projects into OSS-Fuzz, including requirements and approval process.

**[cbor2 OSS-Fuzz Integration PR](https://github.com/google/oss-fuzz/pull/11444)**
Real-world example of enrolling a Python project with C extensions into OSS-Fuzz. Shows:
- Initial proposal and project introduction
- Criticality score evaluation
- Complete implementation (project.yaml, Dockerfile, build.sh, harnesses)

**[Fuzz Introspector Case Studies](https://github.com/ossf/fuzz-introspector/blob/main/doc/CaseStudies.md)**
Examples and explanations of using Fuzz Introspector to analyze coverage and identify fuzzing blockers.

### Video Resources

Check OSS-Fuzz documentation for workshop recordings and tutorials on enrollment and harness development.

Found this skill helpful?

🚀 Share a Work Built With It

Readable layout

--- name: ossfuzz type: technique description: "Enrolls a project in OSS-Fuzz, Google's free continuous fuzzing service for open source, and drives it locally. Covers project.yaml, Dockerfile and build.sh setup, the helper scripts, reproducing OSS-Fuzz crash reports, and the acceptance criteria. Use when setting up continuous fuzzing for an open-source project, reproducing an OSS-Fuzz bug report, or testing an OSS-Fuzz build before submitting it." --- # OSS-Fuzz [OSS-Fuzz](https://google.github.io/oss-fuzz/) is an open-source project developed by Google that provides free distributed infrastructure for continuous fuzz testing. It streamlines the fuzzing process and facilitates simpler modifications. While only select projects are accepted into OSS-Fuzz, the project's core is open-source, allowing anyone to host their own instance for private projects. ## Overview OSS-Fuzz provides a simple CLI framework for building and starting harnesses or calculating their coverage. Additionally, OSS-Fuzz can be used as a service that hosts static web pages generated from fuzzing outputs such as coverage information. ### Key Concepts | Concept | Description | |---------|-------------| | **helper.py** | CLI script for building images, building fuzzers, and running harnesses locally | | **Base Images** | Hierarchical Docker images providing build dependencies and compilers | | **project.yaml** | Configuration file defining project metadata for OSS-Fuzz enrollment | | **Dockerfile** | Project-specific image with build dependencies | | **build.sh** | Script that builds fuzzing harnesses for your project | | **Criticality Score** | Metric used by OSS-Fuzz team to evaluate project acceptance | ## When to Apply **Apply this technique when:** - Setting up continuous fuzzing for an open-source project - Need distributed fuzzing infrastructure without managing servers - Want coverage reports and bug tracking integrated with fuzzing - Testing existing OSS-Fuzz harnesses locally - Reproducing crashes from OSS-Fuzz bug reports **Skip this technique when:** - Project is closed-source (unless hosting your own OSS-Fuzz instance) - Project doesn't meet OSS-Fuzz's criticality score threshold - Need proprietary or specialized fuzzing infrastructure - Fuzzing simple scripts that don't warrant infrastructure ## Quick Reference | Task | Command | |------|---------| | Clone OSS-Fuzz | `git clone https://github.com/google/oss-fuzz` | | Build project image | `uv run --no-project python infra/helper.py build_image --pull ` | | Build fuzzers with ASan | `uv run --no-project python infra/helper.py build_fuzzers --sanitizer=address ` | | Run specific harness | `uv run --no-project python infra/helper.py run_fuzzer ` | | Generate coverage report | `uv run --no-project python infra/helper.py coverage ` | | Check helper.py options | `uv run --no-project python infra/helper.py --help` | ## OSS-Fuzz Project Components OSS-Fuzz provides several publicly available tools and web interfaces: ### Bug Tracker The [bug tracker](https://issues.oss-fuzz.com/issues?q=status:open) allows you to: - Check bugs from specific projects (initially visible only to maintainers, later [made public](https://google.github.io/oss-fuzz/getting-started/bug-disclosure-guidelines/)) - Create new issues and comment on existing ones - Search for similar bugs across **all projects** to understand issues ### Build Status System The [build status system](https://oss-fuzz-build-logs.storage.googleapis.com/index.html) helps track: - Build statuses of all included projects - Date of last successful build - Build failures and their duration ### Fuzz Introspector [Fuzz Introspector](https://oss-fuzz-introspector.storage.googleapis.com/index.html) displays: - Coverage data for projects enrolled in OSS-Fuzz - Hit frequency for covered code - Performance analysis and blocker identification Read [this case study](https://github.com/ossf/fuzz-introspector/blob/main/doc/CaseStudies.md) for examples and explanations. ## Step-by-Step: Running a Single Harness You don't need to host the whole OSS-Fuzz platform to use it. The helper script makes it easy to run individual harnesses locally. ### Step 1: Clone OSS-Fuzz ```bash git clone https://github.com/google/oss-fuzz cd oss-fuzz uv run --no-project python infra/helper.py --help ``` ### Step 2: Build Project Image ```bash uv run --no-project python infra/helper.py build_image --pull ``` This downloads and builds the base Docker image for the project. ### Step 3: Build Fuzzers with Sanitizers ```bash uv run --no-project python infra/helper.py build_fuzzers --sanitizer=address ``` **Sanitizer options:** - `--sanitizer=address` for [AddressSanitizer](https://appsec.guide/docs/fuzzing/techniques/asan/) with [LeakSanitizer](https://github.com/google/sanitizers/wiki/AddressSanitizerLeakSanitizer) - Other sanitizers available (language support varies) **Note:** Fuzzers are built to `/build/out//` containing the harness executables, dictionaries, corpus, and crash files. ### Step 4: Run the Fuzzer ```bash uv run --no-project python infra/helper.py run_fuzzer [] ``` The helper script automatically runs any missed steps if you skip them. ### Step 5: Coverage Analysis (Optional) First, [install gsutil](https://cloud.google.com/storage/docs/gsutil_install) (skip gcloud initialization). ```bash uv run --no-project python infra/helper.py build_fuzzers --sanitizer=coverage uv run --no-project python infra/helper.py coverage ``` Use `--no-corpus-download` to use only local corpus. The command generates and hosts a coverage report locally. See [official OSS-Fuzz documentation](https://google.github.io/oss-fuzz/advanced-topics/code-coverage/) for details. ## Common Patterns ### Pattern: Running irssi Example **Use Case:** Testing OSS-Fuzz setup with a simple enrolled project ```bash # Clone and navigate to OSS-Fuzz git clone https://github.com/google/oss-fuzz cd oss-fuzz # Build and run irssi fuzzer uv run --no-project python infra/helper.py build_image --pull irssi uv run --no-project python infra/helper.py build_fuzzers --sanitizer=address irssi uv run --no-project python infra/helper.py run_fuzzer irssi irssi-fuzz ``` **Expected Output:** ``` INFO:__main__:Running: docker run --rm --privileged --shm-size=2g --platform linux/amd64 -i -e FUZZING_ENGINE=libfuzzer -e SANITIZER=address -e RUN_FUZZER_MODE=interactive -e HELPER=True -v /private/tmp/oss-fuzz/build/out/irssi:/out -t gcr.io/oss-fuzz-base/base-runner run_fuzzer irssi-fuzz. Using seed corpus: irssi-fuzz_seed_corpus.zip /out/irssi-fuzz -rss_limit_mb=2560 -timeout=25 /tmp/irssi-fuzz_corpus -max_len=2048 < /dev/null INFO: Running with entropic power schedule (0xFF, 100). INFO: Seed: 1531341664 INFO: Loaded 1 modules (95687 inline 8-bit counters): 95687 [0x1096c80, 0x10ae247), INFO: Loaded 1 PC tables (95687 PCs): 95687 [0x10ae248,0x1223eb8), INFO: 719 files found in /tmp/irssi-fuzz_corpus INFO: seed corpus: files: 719 min: 1b max: 170106b total: 367969b rss: 48Mb #720 INITED cov: 409 ft: 1738 corp: 640/163Kb exec/s: 0 rss: 62Mb #762 REDUCE cov: 409 ft: 1738 corp: 640/163Kb lim: 2048 exec/s: 0 rss: 63Mb L: 236/2048 MS: 2 ShuffleBytes-EraseBytes- ``` ### Pattern: Enrolling a New Project **Use Case:** Adding your project to OSS-Fuzz (or private instance) Create three files in `projects//`: **1. project.yaml** - Project metadata: ```yaml homepage: "https://github.com/yourorg/yourproject" language: c++ primary_contact: "[email protected]" main_repo: "https://github.com/yourorg/yourproject" fuzzing_engines: - libfuzzer sanitizers: - address - undefined ``` **2. Dockerfile** - Build dependencies: ```dockerfile FROM gcr.io/oss-fuzz-base/base-builder RUN apt-get update && apt-get install -y \ autoconf \ automake \ libtool \ pkg-config RUN git clone --depth 1 https://github.com/yourorg/yourproject WORKDIR yourproject COPY build.sh $SRC/ ``` **3. build.sh** - Build harnesses: ```bash #!/bin/bash -eu ./autogen.sh ./configure --disable-shared make -j$(nproc) # Build harnesses $CXX $CXXFLAGS -std=c++11 -I. \ $SRC/yourproject/fuzz/harness.cc -o $OUT/harness \ $LIB_FUZZING_ENGINE ./libyourproject.a # Copy corpus and dictionary if available cp $SRC/yourproject/fuzz/corpus.zip $OUT/harness_seed_corpus.zip cp $SRC/yourproject/fuzz/dictionary.dict $OUT/harness.dict ``` ## Docker Images in OSS-Fuzz Harnesses are built and executed in Docker containers. All projects share a runner image, but each project has its own build image. ### Image Hierarchy Images build on each other in this sequence: 1. **[base_image](https://github.com/google/oss-fuzz/blob/master/infra/base-images/base-image/Dockerfile)** - Specific Ubuntu version 2. **[base_clang](https://github.com/google/oss-fuzz/tree/master/infra/base-images/base-clang)** - Clang compiler; based on `base_image` 3. **[base_builder](https://github.com/google/oss-fuzz/tree/master/infra/base-images/base-builder)** - Build dependencies; based on `base_clang` - Language-specific variants: [`base_builder_go`](https://github.com/google/oss-fuzz/tree/master/infra/base-images/base-builder-go), etc. - See [/oss-fuzz/infra/base-images/](https://github.com/google/oss-fuzz/tree/master/infra/base-images) for full list 4. **Your project Docker image** - Project-specific dependencies; based on `base_builder` or language variant ### Runner Images (Used Separately) - **[base_runner](https://github.com/google/oss-fuzz/tree/master/infra/base-images/base-runner)** - Executes harnesses; based on `base_clang` - **[base_runner_debug](https://github.com/google/oss-fuzz/tree/master/infra/base-images/base-runner-debug)** - With debug tools; based on `base_runner` ## Advanced Usage ### Tips and Tricks | Tip | Why It Helps | |-----|--------------| | **Don't manually copy source code** | Project Dockerfile likely already pulls latest version | | **Check existing projects** | Browse [oss-fuzz/projects](https://github.com/google/oss-fuzz/tree/master/projects) for examples | | **Keep harnesses in separate repo** | Like [curl-fuzzer](https://github.com/curl/curl-fuzzer) - cleaner organization | | **Use specific compiler versions** | Base images provide consistent build environment | | **Install dependencies in Dockerfile** | May require approval for OSS-Fuzz enrollment | ### Criticality Score OSS-Fuzz uses a [criticality score](https://github.com/ossf/criticality_score) to evaluate project acceptance. See [this example](https://github.com/google/oss-fuzz/pull/11444#issuecomment-1875907472) for how scoring works. Projects with lower scores may still be added to private OSS-Fuzz instances. ### Hosting Your Own Instance Since OSS-Fuzz is open-source, you can host your own instance for: - Private projects not eligible for public OSS-Fuzz - Projects with lower criticality scores - Custom fuzzing infrastructure needs ## Anti-Patterns | Anti-Pattern | Problem | Correct Approach | |--------------|---------|------------------| | **Manually pulling source in build.sh** | Doesn't use latest version | Let Dockerfile handle git clone | | **Copying code to OSS-Fuzz repo** | Hard to maintain, violates separation | Reference external harness repo | | **Ignoring base image versions** | Build inconsistencies | Use provided base images and compilers | | **Skipping local testing** | Wastes CI resources | Use helper.py locally before PR | | **Not checking build status** | Unnoticed build failures | Monitor build status page regularly | ## Tool-Specific Guidance ### libFuzzer OSS-Fuzz primarily uses libFuzzer as the fuzzing engine for C/C++ projects. **Harness signature:** ```c++ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { // Your fuzzing logic return 0; } ``` **Build in build.sh:** ```bash $CXX $CXXFLAGS -std=c++11 -I. \ harness.cc -o $OUT/harness \ $LIB_FUZZING_ENGINE ./libproject.a ``` **Integration tips:** - Use `$LIB_FUZZING_ENGINE` variable provided by OSS-Fuzz - Include `-fsanitize=fuzzer` is handled automatically - Link against static libraries when possible ### AFL++ OSS-Fuzz supports AFL++ as an alternative fuzzing engine. **Enable in project.yaml:** ```yaml fuzzing_engines: - afl - libfuzzer ``` **Integration tips:** - AFL++ harnesses work alongside libFuzzer harnesses - Use persistent mode for better performance - OSS-Fuzz handles engine-specific compilation flags ### Atheris (Python) For Python projects with C extensions. **Example from [cbor2 integration](https://github.com/google/oss-fuzz/pull/11444):** **Harness:** ```python import atheris import sys import cbor2 @atheris.instrument_func def TestOneInput(data): fdp = atheris.FuzzedDataProvider(data) try: cbor2.loads(data) except (cbor2.CBORDecodeError, ValueError): pass def main(): atheris.Setup(sys.argv, TestOneInput) atheris.Fuzz() if __name__ == "__main__": main() ``` **Build in build.sh:** ```bash # allow-legacy-python: build.sh runs inside the oss-fuzz container, where the shims are absent. pip3 install . for fuzzer in $(find $SRC -name 'fuzz_*.py'); do compile_python_fuzzer $fuzzer done ``` **Integration tips:** - Use `compile_python_fuzzer` helper provided by OSS-Fuzz - See [Continuously Fuzzing Python C Extensions](https://blog.trailofbits.com/2024/02/23/continuously-fuzzing-python-c-extensions/) blog post ### Rust Projects **Enable in project.yaml:** ```yaml language: rust fuzzing_engines: - libfuzzer sanitizers: - address # Only AddressSanitizer supported for Rust ``` **Build in build.sh:** ```bash cargo fuzz build -O --debug-assertions cp fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_target_1 $OUT/ ``` **Integration tips:** - [Rust supports only AddressSanitizer with libfuzzer](https://google.github.io/oss-fuzz/getting-started/new-project-guide/rust-lang/#projectyaml) - Use cargo-fuzz for local development - OSS-Fuzz handles Rust-specific compilation ## Troubleshooting | Issue | Cause | Solution | |-------|-------|----------| | **Build fails with missing dependencies** | Dependencies not in Dockerfile | Add `apt-get install` or equivalent in Dockerfile | | **Harness crashes immediately** | Missing input validation | Add size checks in harness | | **Coverage is 0%** | Harness not reaching target code | Verify harness actually calls target functions | | **Build timeout** | Complex build process | Optimize build.sh, consider parallel builds | | **Sanitizer errors in build** | Incompatible flags | Use flags provided by OSS-Fuzz environment variables | | **Cannot find source code** | Wrong working directory in Dockerfile | Set WORKDIR or use absolute paths | ## Related Skills ### Tools That Use This Technique | Skill | How It Applies | |-------|----------------| | **libfuzzer** | Primary fuzzing engine used by OSS-Fuzz | | **aflpp** | Alternative fuzzing engine supported by OSS-Fuzz | | **atheris** | Used for fuzzing Python projects in OSS-Fuzz | | **cargo-fuzz** | Used for Rust projects in OSS-Fuzz | ### Related Techniques | Skill | Relationship | |-------|--------------| | **coverage-analysis** | OSS-Fuzz generates coverage reports via helper.py | | **address-sanitizer** | Default sanitizer for OSS-Fuzz projects | | **fuzz-harness-writing** | Essential for enrolling projects in OSS-Fuzz | | **corpus-management** | OSS-Fuzz maintains corpus for enrolled projects | ## Resources ### Key External Resources **[OSS-Fuzz Official Documentation](https://google.github.io/oss-fuzz/)** Comprehensive documentation covering enrollment, harness writing, and troubleshooting for the OSS-Fuzz platform. **[Getting Started Guide](https://google.github.io/oss-fuzz/getting-started/accepting-new-projects/)** Step-by-step process for enrolling new projects into OSS-Fuzz, including requirements and approval process. **[cbor2 OSS-Fuzz Integration PR](https://github.com/google/oss-fuzz/pull/11444)** Real-world example of enrolling a Python project with C extensions into OSS-Fuzz. Shows: - Initial proposal and project introduction - Criticality score evaluation - Complete implementation (project.yaml, Dockerfile, build.sh, harnesses) **[Fuzz Introspector Case Studies](https://github.com/ossf/fuzz-introspector/blob/main/doc/CaseStudies.md)** Examples and explanations of using Fuzz Introspector to analyze coverage and identify fuzzing blockers. ### Video Resources Check OSS-Fuzz documentation for workshop recordings and tutorials on enrollment and harness development.

Related skills

DevOps & Cloud

Ossfuzz

What this skill does

What it does

When to use it

How agents load it

File analysis

SKILL.md & Agent activation

Install this skill

Related skills

Docker Essentials

Find Skills

Microsoft Foundry

Azure Deploy