Migrating `go` binary to a security-oriented `go` binary
Open
- Dominant language
- Shell
- Stars
- 12.6k
- Forks
- 2.9k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 61
Description
I've recently published [a tool](https://github.com/trailofbits/go-panikint) to detect integer overflows in Go, since they're silent by default. The setup is (_really_) easy: compile the toolchain and use the generated `go` binary instead of the official `go` binary. Adding this would help detecting a whole new class of bugs for Go targets in OSS-fuzz that are currently mostly undetected, but I have a few questions before working on it.
What would OSS fuzz folks recommend for the migration to happen ? I'm guessing replacing all Go compilers to go-panikint would be a bit abrupt. What are your migrations recommendations ? Thank you!
Contributor guide
Assessment
This issue has not been assessed yet.