python / python/library-fuzzers
Merge `cpython3` and `python3-libraries` fuzzers?
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 5
- Forks
- 8
- PR merge metrics
- No merged PRs in 30d
Description
Our fuzzers are currently split between Modules/_xxtestfuzz/ and this repository. I think we should merge them into one cpython project,
-
There is the idea of
cpython3fuzzing the core interpreter, andpython3-librariesfuzzing the stdlib, but that isn't the case. In fact, more than half ofcpython3s fuzzers are for stdlib modules. Even worse so, we have overlap, for example, both projects fuzzcsv.reader(). -
I'm writing this issue because after opening https://github.com/python/library-fuzzers/pull/25, I considered doing the same in CPython for
_xxtestfuzz, but that would just duplicate infrastructure. We would have two almost identical workflows in two very different places. This split/duplication also increases our maintenance burden, we have to maintain quite similar (even more so with https://github.com/python/library-fuzzers/pull/23) scripts for two projects ingoogle/oss-fuzz. -
We actually already share resources between the fuzzers by using the
py_compile.dictfromcpython3forpython3-libraries'sfuzzer-ast, but this is quite hacky and easy to forget about, as such I worry it may break some day.
CC @python/fuzzers
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the fuzzer definitions in Modules/_xxtestfuzz/ and this repository, then read the approaches in pull requests #23 and #25. Review the python3-libraries build.sh reference to cpython3's py_compile.dict and identify the duplicated workflows and overlapping targets. Done means the maintainers agree on and implement one cpython fuzzing project without duplicated infrastructure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- testing
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100