Oss-fuzz Alternatives
Similar projects and alternatives to oss-fuzz
-
AFLplusplus
The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!
-
-
Scout APM
Less time debugging, more time building. Scout APM allows you to find and fix performance issues with no hassle. Now with error monitoring and external services monitoring, Scout is a developer's best friend when it comes to application development.
-
-
libfuzzer
Thin interface for libFuzzer, an in-process, coverage-guided, evolutionary fuzzing engine.
-
-
-
ffmpeg-libav-tutorial
FFmpeg libav tutorial - learn how media works from basic to transmuxing, transcoding and more
-
SonarQube
Static code analysis for 29 languages.. Your projects are multi-language. So is SonarQube analysis. Find Bugs, Vulnerabilities, Security Hotspots, and Code Smells so you can release quality code every time. Get started analyzing your projects today for free.
-
ffmpeg-tutorial
A set of tutorials that demonstrates how to write a video player based on FFmpeg
-
-
imaginary
Fast, simple, scalable, Docker-ready HTTP microservice for high-level image processing
-
-
-
-
-
-
-
Av1an
Cross-platform command-line AV1 / VP9 / HEVC / H264 encoding framework with per scene quality encoding
-
-
oss-fuzz reviews and mentions
- Learnings from 5 Years of Tech Startup Code Audits
- OSS-Fuzz: Continuous Fuzzing for Open Source Software
-
Google supports Monero in new OSS security initiative
Element of truth in it.. https://github.com/google/oss-fuzz/blob/master/projects/monero/project.yaml
-
OSS-Fuzz ?? Setup Cluster API on OSS-Fuzz
This is the corresponding google/oss-fuzz PR for CAPI setup `
To know more, read this detailed documentation to learn how to use OSS-Fuzz
-
Dav1d, fast AV1 decoder, version 1.0.0 released
It is tested by Google's OSS-Fuzz among others: https://github.com/google/oss-fuzz/tree/master/projects/dav1...
It did produce results: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11464
-
Ten-year experience in DBMS testing
I have already mentioned that Tarantool uses third-party libraries. Many of them already use fuzz testing: the curl, c-ares, zstd, and OpenSSL projects are regularly tested in the OSS-Fuzz infrastructure. Tarantool code has many parts where the code is used for parsing (e.g., SQL or HTTP query parsing) or MsgPack decoding. This code may be vulnerable to bugs related to memory management. The good news is that fuzz testing quickly detects such issues. Tarantool also has integration with OSS-Fuzz, but there are not many tests yet, and we found a single bug in the http_parser library. The number of such tests might eventually grow, and we have detailed instructions for those who want to add a new one.
-
Can Some one here verify whether it is true or false? I saw this passage on Quora. It looks Kinda funny to me.
https://google.github.io/oss-fuzz/ "In cooperation with the Core Infrastructure Initiative and the OpenSSF, OSS-Fuzz aims to make common open source software more secure and stable"
-
All the giant companies used ffmpeg
ffmpeg/libav is being fuzzed with reasonable success. See for example https://github.com/google/oss-fuzz/tree/master/projects/ffmp... and https://security.googleblog.com/2014/01/ffmpeg-and-thousand-....
They found issues in code I wrote...
(I work for Google but do not speak for it)
-
Imagor is a fast, Docker-ready image processing server written in Go
For what it's worth, it's part of OSS fuzz
https://github.com/google/oss-fuzz/tree/a21768ce6a5056d27f82...
-
Is OSCP right certification for me? Pentesting vs exploit development
fuzzing is not secret knowledge. check out https://github.com/google/oss-fuzz and it's documentation
- FuzzBench: Open Fuzzer Benchmarking Platform and Service
- Free fuzzing tool for (major) java projects.
-
FastDoubleParser: Java port of Daniel Lemires fast_double_parser
The successes of fuzzing projects like oss-fuzz have demonstrated significant shortcomings to hand-curating test cases in the manner you describe. Testing every 64bit float value is unrealistic, but testing a huge number of randomly selected values by cross-comparison with other libraries is a very good idea for code like this.
Stats
google/oss-fuzz is an open source project licensed under Apache License 2.0 which is an OSI approved license.
Popular Comparisons
Are you hiring? Post a new remote job listing for free.