python / python/library-fuzzers

Merge `cpython3` and `python3-libraries` fuzzers?

Open
#26 7 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
5
Forks
8
PR merge metrics
No merged PRs in 30d

Description

Our fuzzers are currently split between Modules/_xxtestfuzz/ and this repository. I think we should merge them into one cpython project,

  • There is the idea of cpython3 fuzzing the core interpreter, and python3-libraries fuzzing the stdlib, but that isn't the case. In fact, more than half of cpython3s fuzzers are for stdlib modules. Even worse so, we have overlap, for example, both projects fuzz csv.reader().

  • I'm writing this issue because after opening https://github.com/python/library-fuzzers/pull/25, I considered doing the same in CPython for _xxtestfuzz, but that would just duplicate infrastructure. We would have two almost identical workflows in two very different places. This split/duplication also increases our maintenance burden, we have to maintain quite similar (even more so with https://github.com/python/library-fuzzers/pull/23) scripts for two projects in google/oss-fuzz.

  • We actually already share resources between the fuzzers by using the py_compile.dict from cpython3 for python3-libraries's fuzzer-ast, but this is quite hacky and easy to forget about, as such I worry it may break some day.

CC @python/fuzzers

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by comparing the fuzzer definitions in Modules/_xxtestfuzz/ and this repository, then read the approaches in pull requests #23 and #25. Review the python3-libraries build.sh reference to cpython3's py_compile.dict and identify the duplicated workflows and overlapping targets. Done means the maintainers agree on and implement one cpython fuzzing project without duplicated infrastructure.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
testing
Issue type
Refactor
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.