1--- 2layout: default 3title: FAQ 4has_children: true 5nav_order: 7 6permalink: /faq/ 7--- 8 9# Frequently Asked Questions 10 11- TOC 12{:toc} 13--- 14 15## Where can I learn more about fuzzing? 16 17We recommend reading [libFuzzer tutorial] and the other docs in [google/fuzzing] 18repository. These and some other resources are listed on the 19[useful links]({{ site.baseurl }}/reference/useful-links/#tutorials) page. 20 21[google/fuzzing]: https://github.com/google/fuzzing/tree/master/docs 22[libFuzzer tutorial]: https://github.com/google/fuzzing/blob/master/tutorial/libFuzzerTutorial.md 23 24## What kind of projects are you accepting? 25 26We accept established projects that have a critical impact on infrastructure and 27user security. We will consider each request on a case-by-case basis, but some 28things we keep in mind are: 29 30 - Exposure to remote attacks (e.g. libraries that are used to process 31 untrusted input). 32 - Number of users/other projects depending on this project. 33 34We hope to relax this requirement in the future though, so keep an eye out even 35if we are not able to accept your project at this time! 36 37## How can I find potential fuzz targets in my open source project? 38 39You should look for places in your code that: 40 41 - consume un-trusted data from users or from the network. 42 - consume complex input data even if it's 'trusted'. 43 - use an algorithm that has two or more implementations 44 (to verify their equivalence). 45 - look for existing fuzz target [examples](https://github.com/google/oss-fuzz/tree/master/projects) 46 and find similarities. 47 48## Where can I store fuzz target sources and the build script if it's not yet accepted upstream? 49 50Fuzz target sources as well as the build script may temporarily live inside the 51`projects/<your_project>` directory in the OSS-Fuzz repository. Note that we do 52not accept integrations that rely on forked repositories. Refer to the 53[ideal integration guide] for the preferred long term solution. 54 55## My project is not open source. Can I use OSS-Fuzz? 56 57You cannot use OSS-Fuzz, but you can use [ClusterFuzz] which OSS-Fuzz is based 58on. ClusterFuzz is an open-source fuzzing infrastructure that you can deploy in 59your own environment and run continuously at scale. 60 61OSS-Fuzz is a production instance of ClusterFuzz, plus the code living in 62[OSS-Fuzz repository]: build scripts, `project.yaml` files with contacts, etc. 63 64[OSS-Fuzz repository]: https://github.com/google/oss-fuzz 65 66## Why do you use a [different issue tracker](https://bugs.chromium.org/p/oss-fuzz/issues/list) for reporting bugs in OSS projects? 67 68Security access control is important for the kind of issues that OSS-Fuzz detects. 69We will reconsider the GitHub issue tracker once the 70[access control feature](https://github.com/isaacs/github/issues/37) is available. 71 72## Why do you require a Google account for authentication? 73 74Our [ClusterFuzz]({{ site.baseurl }}/further-reading/clusterfuzz) fuzzing 75infrastructure and [issue tracker](https://bugs.chromium.org/p/oss-fuzz/issues/list) 76require a Google account for authentication. Note that an alternate email 77address associated with a Google account does not work due to appengine api 78limitations. 79 80## Why do you use Docker? 81 82Building fuzzers requires building your project with a fresh Clang compiler and 83special compiler flags. An easy-to-use Docker image is provided to simplify 84toolchain distribution. This also simplifies our support for a variety of Linux 85distributions and provides a reproducible and secure environment for fuzzer 86building and execution. 87 88## How do you handle timeouts and OOMs? 89 90If a single input to a [fuzz target]({{ site.baseurl }}/reference/glossary/#fuzz-target) 91requires more than **~25 seconds** or more than **2.5GB RAM** to process, we 92report this as a timeout or an OOM (out-of-memory) bug 93(examples: [timeouts](https://bugs.chromium.org/p/oss-fuzz/issues/list?can=1&q=%22Crash+Type%3A+Timeout%22), 94[OOMs](https://bugs.chromium.org/p/oss-fuzz/issues/list?can=1&q="Crash+Type%3A+Out-of-memory")). 95This may or may not be considered as a real bug by the project owners, 96but nevertheless we treat all timeouts and OOMs as bugs 97since they significantly reduce the efficiency of fuzzing. 98 99Remember that fuzzing is executed with AddressSanitizer or other 100sanitizers which introduces a certain overhead in RAM and CPU. 101 102We currently do not have a good way to deduplicate timeout or OOM bugs. 103So, we report only one timeout and only one OOM bug per fuzz target. 104Once that bug is fixed, we will file another one, and so on. 105 106Currently we do not offer ways to change the memory and time limits. 107 108## Can I launch an additional process (e.g. a daemon) from my fuzz target? 109 110No. In order to get all the benefits of in-process, coverage-guided fuzz testing, 111it is required to run everything inside a single process. Any child processes 112created outside the main process introduces heavy launch overhead and is not 113monitored for code coverage. 114 115Another rule of thumb is: "the smaller fuzz target is, the better it is". It is 116expected that your project will have many fuzz targets to test different 117components, instead of a single fuzz target trying to cover everything. 118Think of fuzz target as a unit test, though it is much more powerful since it 119helps to test millions of data permutations rather than just one. 120 121## What if my fuzz target finds a bug in another project (dependency) ? 122 123Every bug report has a crash stack-trace that shows where the crash happened. 124Using that, you can debug the root cause and see which category the bug falls in: 125 126- If this is a bug is due to an incorrect usage of the dependent project's API 127in your project, then you need to fix your usage to call the API correctly. 128- If this is a real bug in the dependent project, then you should CC the 129maintainers of that project on the bug. Once CCed, they will get automatic 130access to all the information necessary to reproduce the issue. If this project 131is maintained in OSS-Fuzz, you can search for contacts in the respective 132project.yaml file. 133 134## What if my fuzzer does not find anything? 135 136If your fuzz target is running for many days and does not find bugs or new 137coverage, it may mean several things: 138- We've covered all reachable code. In order to cover more code we need more 139 fuzz targets. 140- The [seed corpus]({{ site.baseurl }}/getting-started/new-project-guide#seed-corpus) is not good enough and the 141 fuzzing engine(s) are not able to go deeper based on the existing seeds. 142 Need to add more seeds. 143- There is some crypto/crc stuff in the code that will prevent any fuzzing 144 engine from going deeper, in which case the crypto should be disabled in 145 [fuzzing mode](http://libfuzzer.info#fuzzer-friendly-build-mode). 146 Examples: [openssl](https://github.com/openssl/openssl/tree/master/fuzz#reproducing-issues), 147 [boringssl](https://boringssl.googlesource.com/boringssl/+/HEAD/FUZZING.md#Fuzzer-mode) 148- It is also possible that the fuzzer is running too slow 149 (you may check the speed of your targets at https://oss-fuzz.com/) 150 151In either case, look at the 152[coverage reports]({{ site.baseurl }}/further-reading/clusterfuzz#coverage-reports) 153for your target(s) and figure out why some parts of the code are not covered. 154 155## Why are code coverage reports public? 156 157We work with open source projects and try to keep as much information public as 158possible. We believe that public code coverage reports do not put users at risk, 159as they do not indicate the presence of bugs or lack thereof. 160 161## Why is the coverage command complaining about format compatibility issues? 162 163This may happen if the Docker images fetched locally become out of sync. Make 164sure you run the following command to pull the most recent images: 165 166```bash 167$ python infra/helper.py pull_images 168``` 169 170Please refer to 171[code coverage]({{ site.baseurl }}/advanced-topics/code-coverage/) for detailed 172information on code coverage generation. 173 174## What happens when I rename a fuzz target ? 175 176If you rename your fuzz targets, the existing bugs for those targets will get 177closed and fuzzing will start from scratch from a fresh corpora 178(seed corpus only). Similar corpora will get accumulated over time depending on 179the number of cpu cycles that original fuzz target has run. If this is not 180desirable, make sure to copy the accumulated corpora from the original fuzz 181target (instructions to download 182[here]({{ site.baseurl }}/advanced-topics/corpora/#downloading-the-corpus)) and 183restore it to the new GCS location later (instruction to find the 184new location [here]({{ site.baseurl }}/advanced-topics/corpora/#viewing-the-corpus-for-a-fuzz-target)). 185 186## Does OSS-Fuzz support AFL or honggfuzz? 187 188OSS-Fuzz *uses* the following 189[fuzzing engines]({{ site.baseurl }}/reference/glossary/#fuzzing-engine): 190 1911. [libFuzzer](https://llvm.org/docs/LibFuzzer.html). 1921. [AFL++](https://github.com/AFLplusplus/AFLplusplus), an improved and 193 well-maintained version of [AFL](https://lcamtuf.coredump.cx/afl/). 1941. [Honggfuzz](https://github.com/google/honggfuzz). 195 196Follow the [new project guide] and OSS-Fuzz will use all its fuzzing engines 197on your code. 198 199## What are the specs on your machines? 200 201OSS-Fuzz builders have 32CPU/28.8GB RAM. 202 203Fuzzing machines only have a single core and fuzz targets should not use more 204than 2.5GB of RAM. 205 206## Are there any restrictions on using test cases / corpora generated by OSS-Fuzz? 207 208No, you can freely use (i.e. share, add to your repo, etc.) the test cases and 209corpora generated by OSS-Fuzz. OSS-Fuzz infrastructure is fully open source 210(including [ClusterFuzz], various fuzzing engines, and other dependencies). We 211have no intent to restrict the use of the artifacts produced by OSS-Fuzz. 212 213[ClusterFuzz]: https://github.com/google/clusterfuzz 214[new project guide]: {{ site.baseurl }}/getting-started/new-project-guide/ 215[ideal integration guide]: {{ site.baseurl }}/getting-started/new-project-guide/ 216