OSS-Fuzz

What OSS-Fuzz is

OSS-Fuzz is a free service that runs fuzzers for open-source projects and privately sends developers alerts about bugs it detects. Its distributed execution pairs fuzzing engines with sanitizers to help improve software security and stability. Listed engines include libFuzzer, AFL++, Honggfuzz, and Centipede, which is identified as experimental in the FAQ. The setup guide describes AddressSanitizer and UndefinedBehaviorSanitizer as the default supported sanitizers. Supported languages are C/C++, Rust, Go, Python, Java/JVM, JavaScript, and Lua. Projects provide a Dockerfile and build.sh script to define the build environment and produce fuzz targets. OSS-Fuzz supports x86_64 and i386 builds, with i386 disabled by default. Builds run once per day by default, with up to four permitted daily, and builders provide 250 GB of disk space including the operating system. Issues are filed in the OSS-Fuzz tracker by default, with an option to mirror them on GitHub. Project contacts need a Google account for full ClusterFuzz access, including crash reports and fuzzer statistics. Acceptance requires an open-source project with a significant user base and/or critical importance to global IT infrastructure. Google founded the service in 2016.

Who it suits

OSS-Fuzz suits eligible open-source projects seeking fuzzing and private bug alerts across its supported languages. It is relevant to project teams prepared to provide a Dockerfile and build script and whose projects meet the acceptance criteria.

Limits

The setup guide allows up to four builds per day, with one build per day by default. Builds must stay below 250 GB of builder disk space, including the operating system; i386 builds are not enabled by default.

Getting started

1. Check that the project is open source and has a significant user base and/or is critical to global IT infrastructure.
2. Prepare a Dockerfile and build.sh script to define the build environment and produce fuzz targets.
3. Visit the OSS-Fuzz website to begin the setup process.
4. Project contacts should use a Google account for full ClusterFuzz access.

Verdict

Eligible open-source projects should consider OSS-Fuzz for distributed fuzzing and private bug alerts at no charge. Projects that do not qualify, including closed-source projects, can run their own ClusterFuzz or ClusterFuzzLite instances; accepted projects also need to work within the build and disk limits.