google / google/oss-fuzz

Migrating `go` binary to a security-oriented `go` binary

Open
#14,769 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Shell
Stars
12.6k
Forks
2.9k
Avg merge
2d 3h
Merged PRs (30d)
61

Description

I've recently published [a tool](https://github.com/trailofbits/go-panikint) to detect integer overflows in Go, since they're silent by default. The setup is (_really_) easy: compile the toolchain and use the generated `go` binary instead of the official `go` binary. Adding this would help detecting a whole new class of bugs for Go targets in OSS-fuzz that are currently mostly undetected, but I have a few questions before working on it.

What would OSS fuzz folks recommend for the migration to happen ? I'm guessing replacing all Go compilers to go-panikint would be a bit abrupt. What are your migrations recommendations ? Thank you!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.