Fuzzing in the open: Integrate your project in OSS-Fuzz for continuous fuzzing
summary
Demo shows how to set up OSS‑Fuzz locally with Docker and the Python helper to build libFuzzer targets, use AddressSanitizer, and reproduce a Heartbleed crash against a checked-out OpenSSL commit; OSS‑Fuzz claims 12,000 bugs found in open source and the workshop reports integrating OpenPrinting harnesses that uncover 41 issues (about 20 confirmed); the team uses a OSS‑Fuzz‑Gen LLM loop to auto-generate targets and confirms builds via F‑introspector and remote OSS‑Fuzz integration.
AI-written summary · about
chapters (16)
- 0:00OSS-Fuzz integration intro
- 2:13Workshop setup prerequisites
- 4:44Agenda and fuzzing basics
- 12:15What is OSS-Fuzz
- 14:21Heartbleed demo setup
- 22:09Configuring project files
- 27:01Docker fuzzing setup
- 35:22Building harnesses
- 51:51Running fuzzers
- 1:03:57Validating crashes
- 1:06:03Submitting projects
- 1:14:34Monitoring builds
- 1:18:06OpenPrinting experience
- 1:31:44OSS-Fuzz Gen harnesses
- 1:34:50Workshop recap
- 1:35:53Q&A vulnerabilities
related talks
44mOSS-Fuzz - Google's continuous fuzzing service for open source software
25mHow fuzzing helps to find bugs
01h 15mMake your programs more reliable with Fuzzing
24mWhy you should be using automated fuzzing to test for security issues in your code
39mMaking Fuzzing Part of Your Software Development Lifecycle
31m“Fuzz or lose..."
39mFuzzing Session: Finding Bugs and Vulnerabilities Automatically
53mFuzzing 101