OSS-Fuzz integration
- Dominant language
- Java
- Stars
- 1.3k
- Forks
- 165
- PR merge metrics
- No merged PRs in 30d
Description
OSS-Fuzz now offers support for fuzzing Java projects with [Jazzer](https://github.com/CodeIntelligenceTesting/jazzer). If you are interested, I could set up re2j in OSS-Fuzz.
By default, Jazzer would detect undeclared exceptions (i.e. those that are not `PatternSyntaxException`s) as well as more serious, potentially DoSable issues such as `OutOfMemoryError`s. In order to come up with a good fuzz target, it would be helpful for me to get a better understanding of the security guarantees re2j intends to offer. The [parent project's fuzzer](https://github.com/google/re2/blob/master/re2/fuzzing/re2_fuzzer.cc) could serve as a starting point for that discussion. Depending on your particular security goals, it could also make sense to perform differential fuzzing, i.e., to use a fuzzer to confirm that re2 and re2j behave identically on the common subset of their features.
Contributor guide
Assessment
This issue has not been assessed yet.