woff2 VS fuzzing

The github you linked already has the framework on "how" to do it. If you are looking for the newest version, if you follow the path on that github they link you back to googles repo. Just clone this repo and compile it, and you will have the latest version.

I extracted and converted all of the fonts using ffmpeg and then https://github.com/google/woff2.git, set up the folder and made sure Jellyfin can see and select it from inside the mounted volumes on the container, and checked the enable fallback fonts box.

Font Squirrel's webfont generator is a popular tool that web devs use for generating webfonts from desktop fonts. You can also use Google's woff2_compress command line tool.

# clone woff2 git clone --recursive https://github.com/google/woff2.git # enter into the cloned repo cd woff2 # build make clean all # convert the font ./woff2_compress ~/Jost-400-Book-subset.ttf

so I just wanted to start to fuzz a little bit and I used libfuzzer for that. and as you can tell in this tutorial https://github.com/google/fuzzing/blob/master/tutorial/libFuzzerTutorial.md it tells you that if you leave it running like that you will get a bounty. and so I did exactly this, I followed the exact instructions listed there(I fuzzed this woff thing they mentioned) and my fuzzer said "SUMMARY: AddressSanitizer: heap-buffer-overflow" can I report that? or is this woff thing just for testing?

For a project like this, fuzz testing is also crucial. The issue pointed out by gremolata would have been trivial to find with fuzzing.

Another is testing: Many C++ projects use sanitizers regularly together with fuzzing, https://github.com/google/fuzzing/blob/master/docs/why-fuzz.md, https://github.com/google/fuzzing/blob/master/docs/intro-to-fuzzing.md#sanitizers

Maybe a bit biased opinion here, but you could start with this blog post, and see whether you go more into C/C++ fuzzing or web fuzzing from there:

https://blog.code-intelligence.com/the-magic-behind-feedback...

https://github.com/google/fuzzing