google / google/oss-fuzz

Issue accessing `libwebp` corpus, possibly due to `@` in fuzz target name

Open
#15,041 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
12.6k
Forks
2.9k
Avg merge
2d 2h
Merged PRs (30d)
62

Description

I'm having some trouble accessing the `libwebp` public corpus.

Running:
```
$ python3 infra/helper.py download_corpora --public libwebp
```

Gives:
```
% python3 infra/helper.py download_corpora --public libwebp
INFO:__main__:Downloading public corpus
INFO:__main__:Downloading corpora for libwebp project to /Users/harrison/cmu/oss-fuzz/build/corpus/libwebp.
--2026-02-26 13:39:22-- https://storage.googleapis.com/libwebp-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/libwebp_fuzz_simple_api/public.zip
--2026-02-26 13:39:22-- https://storage.googleapis.com/libwebp-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/libwebp_fuzz_advanced_api/public.zip
--2026-02-26 13:39:22-- https://storage.googleapis.com/libwebp-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/libwebp_fuzz_demux_api/public.zip
--2026-02-26 13:39:22-- https://storage.googleapis.com/libwebp-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/libwebp_fuzz_webp_animencoder/public.zip
--2026-02-26 13:39:22-- https://storage.googleapis.com/libwebp-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/libwebp_fuzz_animation_api/public.zip
--2026-02-26 13:39:22-- https://storage.googleapis.com/libwebp-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/libwebp_fuzz_webp_enc_dec/public.zip
Resolving storage.googleapis.com (storage.googleapis.com)... Resolving storage.googleapis.com (storage.googleapis.com)... Resolving storage.googleapis.com (storage.googleapis.com)... Resolving storage.googleapis.com (storage.googleapis.com)... Resolving storage.googleapis.com (storage.googleapis.com)... Resolving storage.googleapis.com (storage.googleapis.com)... 2607:f8b0:4004:c21::cf2607:f8b0:4004:c21::cf2607:f8b0:4004:c21::cf, , 2607:f8b0:4004:c21::cf, 2607:f8b0:4004:c23::cf2607:f8b0:4004:c23::cf, 2607:f8b0:4004:c23::cf, , 2607:f8b0:4004:c23::cf, 2607:f8b0:4004:c07::cf2607:f8b0:4004:c21::cf, , ...2607:f8b0:4004:c21::cf, 2607:f8b0:4004:c07::cf
, 2607:f8b0:4004:c23::cf, ...2607:f8b0:4004:c23::cfConnecting to storage.googleapis.com (storage.googleapis.com)|2607:f8b0:4004:c21::cf|:443... 2607:f8b0:4004:c07::cf, 2607:f8b0:4004:c07::cf
, , ...2607:f8b0:4004:c07::cf, ...
2607:f8b0:4004:c07::cf
, ...Connecting to storage.googleapis.com (storage.googleapis.com)|2607:f8b0:4004:c21::cf|:443... , ...Connecting to storage.googleapis.com (storage.googleapis.com)|2607:f8b0:4004:c21::cf|:443...

Connecting to storage.googleapis.com (storage.googleapis.com)|2607:f8b0:4004:c21::cf|:443... Connecting to storage.googleapis.com (storage.googleapis.com)|2607:f8b0:4004:c21::cf|:443... Connecting to storage.googleapis.com (storage.googleapis.com)|2607:f8b0:4004:c21::cf|:443... connected.
connected.
connected.
connected.
connected.
connected.
HTTP request sent, awaiting response... HTTP request sent, awaiting response... HTTP request sent, awaiting response... HTTP request sent, awaiting response... HTTP request sent, awaiting response... HTTP request sent, awaiting response... 403 Forbidden
2026-02-26 13:39:22 ERROR 403: Forbidden.

403 Forbidden
2026-02-26 13:39:22 ERROR 403: Forbidden.

403 Forbidden
2026-02-26 13:39:22 ERROR 403: Forbidden.

ERROR:__main__:Corpus download for fuzz_advanced_api failed: Command '['wget', 'https://storage.googleapis.com/libwebp-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/libwebp_fuzz_advanced_api/public.zip', '-O', 'build/corpus/libwebp/fuzz_advanced_api.zip']' returned non-zero exit status 8..
ERROR:__main__:Corpus download for fuzz_animation_api failed: Command '['wget', 'https://storage.googleapis.com/libwebp-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/libwebp_fuzz_animation_api/public.zip', '-O', 'build/corpus/libwebp/fuzz_animation_api.zip']' returned non-zero exit status 8..
ERROR:__main__:Corpus download for fuzz_simple_api failed: Command '['wget', 'https://storage.googleapis.com/libwebp-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/libwebp_fuzz_simple_api/public.zip', '-O', 'build/corpus/libwebp/fuzz_simple_api.zip']' returned non-zero exit status 8..
403 Forbidden
403 Forbidden
403 Forbidden
2026-02-26 13:39:22 ERROR 403: Forbidden.

2026-02-26 13:39:22 ERROR 403: Forbidden.
2026-02-26 13:39:22 ERROR 403: Forbidden.

ERROR:__main__:Corpus download for fuzz_webp_enc_dec failed: Command '['wget', 'https://storage.googleapis.com/libwebp-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/libwebp_fuzz_webp_enc_dec/public.zip', '-O', 'build/corpus/libwebp/fuzz_webp_enc_dec.zip']' returned non-zero exit status 8..
ERROR:__main__:Corpus download for fuzz_webp_animencoder failed: Command '['wget', 'https://storage.googleapis.com/libwebp-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/libwebp_fuzz_webp_animencoder/public.zip', '-O', 'build/corpus/libwebp/fuzz_webp_animencoder.zip']' returned non-zero exit status 8..
ERROR:__main__:Corpus download for fuzz_demux_api failed: Command '['wget', 'https://storage.googleapis.com/libwebp-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/libwebp_fuzz_demux_api/public.zip', '-O', 'build/corpus/libwebp/fuzz_demux_api.zip']' returned non-zero exit status 8..
```

I also noticed on the [fuzz introspector page](https://introspector.oss-fuzz.com/project-profile?project=libwebp) all of the targets have `@` in their name which seems to be a FuzzTest autogenerated name. This also seems to be breaking the introspector report, e.g. https://storage.googleapis.com/oss-fuzz-introspector/libwebp/inspector-report/20260224/fuzz_report.html

Contributor guide

Open the contributing guide

Research direction

Start with infra/helper.py and reproduce the public libwebp corpus download command, then inspect the generated target URLs and the linked Fuzz Introspector report. Compare the target names containing @ with the 403 responses and report failures. Done means identifying whether these are related and defining a verified correction or documenting the separate causes.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
testing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.