google / google/re2j

OSS-Fuzz integration

Open
#135 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
1.3k
Forks
165
PR merge metrics
No merged PRs in 30d

Description

OSS-Fuzz now offers support for fuzzing Java projects with [Jazzer](https://github.com/CodeIntelligenceTesting/jazzer). If you are interested, I could set up re2j in OSS-Fuzz.

By default, Jazzer would detect undeclared exceptions (i.e. those that are not `PatternSyntaxException`s) as well as more serious, potentially DoSable issues such as `OutOfMemoryError`s. In order to come up with a good fuzz target, it would be helpful for me to get a better understanding of the security guarantees re2j intends to offer. The [parent project's fuzzer](https://github.com/google/re2/blob/master/re2/fuzzing/re2_fuzzer.cc) could serve as a starting point for that discussion. Depending on your particular security goals, it could also make sense to perform differential fuzzing, i.e., to use a fuzzer to confirm that re2 and re2j behave identically on the common subset of their features.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.