From e1b65afdee464a109f553d8ead670fa5753d7eee Mon Sep 17 00:00:00 2001 From: Arjun Singh Date: Tue, 19 Sep 2023 09:51:02 +0530 Subject: [PATCH 1/3] [Fuzzing] add cifuzz Signed-off-by: Arjun Singh --- .github/workflows/cifuzz.yml | 42 ++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 .github/workflows/cifuzz.yml diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml new file mode 100644 index 00000000000..4b63aea27aa --- /dev/null +++ b/.github/workflows/cifuzz.yml @@ -0,0 +1,42 @@ +name: CIFuzz +on: [pull_request] +permissions: {} +jobs: + Fuzzing: + runs-on: ubuntu-latest + permissions: + security-events: write + strategy: + fail-fast: false + matrix: + sanitizer: [address, undefined, memory] + steps: + - name: Build Fuzzers (${{ matrix.sanitizer }}) + id: build + uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master + with: + oss-fuzz-project-name: 'example' + language: c++ + sanitizer: ${{ matrix.sanitizer }} + - name: Run Fuzzers (${{ matrix.sanitizer }}) + uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master + with: + oss-fuzz-project-name: 'example' + language: c++ + fuzz-seconds: 600 + sanitizer: ${{ matrix.sanitizer }} + output-sarif: true + - name: Upload Crash + uses: actions/upload-artifact@v3 + if: steps.build.outcome == 'success' + with: + name: ${{ matrix.sanitizer }}-artifacts + path: ./out/artifacts + - name: Upload Sarif + if: always() && steps.build.outcome == 'success' + uses: github/codeql-action/upload-sarif@v2 + with: + # Path to SARIF file relative to the root of the repository + sarif_file: cifuzz-sarif/results.sarif + checkout_path: cifuzz-sarif + category: CIFuzz From e2a04b75b13d44194f8e92e7f596aea8adfcc576 Mon Sep 17 00:00:00 2001 From: Arjun Singh Date: Sat, 23 Sep 2023 11:31:45 +0530 Subject: [PATCH 2/3] [Fuzzing] fix i'm stupid Signed-off-by: Arjun Singh --- .github/workflows/cifuzz.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 4b63aea27aa..0f89c8746ea 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -15,15 +15,15 @@ jobs: id: build uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master with: - oss-fuzz-project-name: 'example' + oss-fuzz-project-name: 'trafficserver' language: c++ sanitizer: ${{ matrix.sanitizer }} - name: Run Fuzzers (${{ matrix.sanitizer }}) uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master with: - oss-fuzz-project-name: 'example' + oss-fuzz-project-name: 'trafficserver' language: c++ - fuzz-seconds: 600 + fuzz-seconds: 300 sanitizer: ${{ matrix.sanitizer }} output-sarif: true - name: Upload Crash From c372b3bfc21e1baef0beb1332de5c2505b26d57d Mon Sep 17 00:00:00 2001 From: Arjun Singh Date: Fri, 29 Sep 2023 07:52:58 +0530 Subject: [PATCH 3/3] [cifuzz] update pr Signed-off-by: Arjun Singh --- .github/workflows/cifuzz.yml | 18 +++++++----------- tests/fuzzing/oss-fuzz.sh | 4 ++-- 2 files changed, 9 insertions(+), 13 deletions(-) diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml index 0f89c8746ea..9e906cbd1b2 100644 --- a/.github/workflows/cifuzz.yml +++ b/.github/workflows/cifuzz.yml @@ -1,36 +1,32 @@ name: CIFuzz -on: [pull_request] +on: + schedule: + - cron: '0 0 * * 0' permissions: {} jobs: Fuzzing: runs-on: ubuntu-latest permissions: security-events: write - strategy: - fail-fast: false - matrix: - sanitizer: [address, undefined, memory] steps: - - name: Build Fuzzers (${{ matrix.sanitizer }}) + - name: Build Fuzzers id: build uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master with: oss-fuzz-project-name: 'trafficserver' language: c++ - sanitizer: ${{ matrix.sanitizer }} - - name: Run Fuzzers (${{ matrix.sanitizer }}) + - name: Run Fuzzers uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master with: oss-fuzz-project-name: 'trafficserver' language: c++ fuzz-seconds: 300 - sanitizer: ${{ matrix.sanitizer }} output-sarif: true - name: Upload Crash uses: actions/upload-artifact@v3 - if: steps.build.outcome == 'success' + if: failure() && steps.build.outcome == 'success' with: - name: ${{ matrix.sanitizer }}-artifacts + name: artifacts path: ./out/artifacts - name: Upload Sarif if: always() && steps.build.outcome == 'success' diff --git a/tests/fuzzing/oss-fuzz.sh b/tests/fuzzing/oss-fuzz.sh index ac4640cde12..2fcac3704c9 100644 --- a/tests/fuzzing/oss-fuzz.sh +++ b/tests/fuzzing/oss-fuzz.sh @@ -39,6 +39,6 @@ cp $SRC/trafficserver/tests/fuzzing/*.zip $OUT/ if [[ $SANITIZER = undefined ]] then - rm $OUT/fuzz_http - rm $OUT/fuzz_hpack + rm -f $OUT/fuzz_http + rm -f $OUT/fuzz_hpack fi