ossfuzz

SKILL.md

OSS-Fuzz

OSS-Fuzz is an open-source project developed by Google that provides free distributed infrastructure for continuous fuzz testing. It streamlines the fuzzing process and facilitates simpler modifications. While only select projects are accepted into OSS-Fuzz, the project's core is open-source, allowing anyone to host their own instance for private projects.

Overview

OSS-Fuzz provides a simple CLI framework for building and starting harnesses or calculating their coverage. Additionally, OSS-Fuzz can be used as a service that hosts static web pages generated from fuzzing outputs such as coverage information.

Key Concepts

Concept
Description

helper.py
CLI script for building images, building fuzzers, and running harnesses locally

Base Images
Hierarchical Docker images providing build dependencies and compilers

project.yaml
Configuration file defining project metadata for OSS-Fuzz enrollment

Dockerfile
Project-specific image with build dependencies

build.sh
Script that builds fuzzing harnesses for your project

Criticality Score
Metric used by OSS-Fuzz team to evaluate project acceptance