ossfuzz by trailofbits/skills
npx skills add https://github.com/trailofbits/skills --skill ossfuzzOSS-Fuzz 是由 Google 开发的开源项目,为持续模糊测试提供免费的分布式基础设施。它简化了模糊测试流程,便于进行修改。虽然只有选定的项目能被 OSS-Fuzz 接受,但该项目核心是开源的,任何人都可以为私有项目托管自己的实例。
OSS-Fuzz 提供了一个简单的 CLI 框架,用于构建和启动测试工具或计算其覆盖率。此外,OSS-Fuzz 还可以作为一项服务,托管由模糊测试输出(如覆盖率信息)生成的静态网页。
| 概念 | 描述 |
|---|---|
| helper.py | 用于构建镜像、构建模糊测试工具以及在本地运行测试工具的 CLI 脚本 |
| 基础镜像 | 提供构建依赖项和编译器的分层 Docker 镜像 |
| project.yaml | 定义项目元数据以加入 OSS-Fuzz 的配置文件 |
| Dockerfile | 包含构建依赖项的项目特定镜像 |
| build.sh | 为项目构建模糊测试工具的脚本 |
| 关键性评分 | OSS-Fuzz 团队用于评估项目接受度的指标 |
在以下情况下应用此技术:
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
在以下情况下跳过此技术:
| 任务 | 命令 |
|---|---|
| 克隆 OSS-Fuzz | git clone https://github.com/google/oss-fuzz |
| 构建项目镜像 | python3 infra/helper.py build_image --pull <project> |
| 使用 ASan 构建模糊测试工具 | python3 infra/helper.py build_fuzzers --sanitizer=address <project> |
| 运行特定测试工具 | python3 infra/helper.py run_fuzzer <project> <harness> |
| 生成覆盖率报告 | python3 infra/helper.py coverage <project> |
| 查看 helper.py 选项 | python3 infra/helper.py --help |
OSS-Fuzz 提供了几个公开可用的工具和 Web 界面:
错误跟踪器 允许您:
构建状态系统 有助于跟踪:
模糊测试内省器 显示:
阅读此案例研究以获取示例和解释。
您不需要托管整个 OSS-Fuzz 平台来使用它。辅助脚本使得在本地轻松运行单个测试工具。
git clone https://github.com/google/oss-fuzz
cd oss-fuzz
python3 infra/helper.py --help
python3 infra/helper.py build_image --pull <project-name>
这将下载并构建项目的基础 Docker 镜像。
python3 infra/helper.py build_fuzzers --sanitizer=address <project-name>
Sanitizer 选项:
--sanitizer=address 用于 AddressSanitizer 和 LeakSanitizer注意: 模糊测试工具构建在 /build/out/<project-name>/ 目录下,包含测试工具可执行文件、字典、语料库和崩溃文件。
python3 infra/helper.py run_fuzzer <project-name> <harness-name> [<fuzzer-args>]
如果您跳过了某些步骤,辅助脚本会自动运行任何遗漏的步骤。
首先,安装 gsutil(跳过 gcloud 初始化)。
python3 infra/helper.py build_fuzzers --sanitizer=coverage <project-name>
python3 infra/helper.py coverage <project-name>
使用 --no-corpus-download 仅使用本地语料库。该命令会在本地生成并托管覆盖率报告。
详情请参阅官方 OSS-Fuzz 文档。
用例: 使用一个已加入的简单项目测试 OSS-Fuzz 设置
# Clone and navigate to OSS-Fuzz
git clone https://github.com/google/oss-fuzz
cd oss-fuzz
# Build and run irssi fuzzer
python3 infra/helper.py build_image --pull irssi
python3 infra/helper.py build_fuzzers --sanitizer=address irssi
python3 infra/helper.py run_fuzzer irssi irssi-fuzz
预期输出:
INFO:__main__:Running: docker run --rm --privileged --shm-size=2g --platform linux/amd64 -i -e FUZZING_ENGINE=libfuzzer -e SANITIZER=address -e RUN_FUZZER_MODE=interactive -e HELPER=True -v /private/tmp/oss-fuzz/build/out/irssi:/out -t gcr.io/oss-fuzz-base/base-runner run_fuzzer irssi-fuzz.
Using seed corpus: irssi-fuzz_seed_corpus.zip
/out/irssi-fuzz -rss_limit_mb=2560 -timeout=25 /tmp/irssi-fuzz_corpus -max_len=2048 < /dev/null
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 1531341664
INFO: Loaded 1 modules (95687 inline 8-bit counters): 95687 [0x1096c80, 0x10ae247),
INFO: Loaded 1 PC tables (95687 PCs): 95687 [0x10ae248,0x1223eb8),
INFO: 719 files found in /tmp/irssi-fuzz_corpus
INFO: seed corpus: files: 719 min: 1b max: 170106b total: 367969b rss: 48Mb
#720 INITED cov: 409 ft: 1738 corp: 640/163Kb exec/s: 0 rss: 62Mb
#762 REDUCE cov: 409 ft: 1738 corp: 640/163Kb lim: 2048 exec/s: 0 rss: 63Mb L: 236/2048 MS: 2 ShuffleBytes-EraseBytes-
用例: 将您的项目添加到 OSS-Fuzz(或私有实例)
在 projects/<your-project>/ 目录下创建三个文件:
1. project.yaml - 项目元数据:
homepage: "https://github.com/yourorg/yourproject"
language: c++
primary_contact: "your-email@example.com"
main_repo: "https://github.com/yourorg/yourproject"
fuzzing_engines:
- libfuzzer
sanitizers:
- address
- undefined
2. Dockerfile - 构建依赖项:
FROM gcr.io/oss-fuzz-base/base-builder
RUN apt-get update && apt-get install -y \
autoconf \
automake \
libtool \
pkg-config
RUN git clone --depth 1 https://github.com/yourorg/yourproject
WORKDIR yourproject
COPY build.sh $SRC/
3. build.sh - 构建测试工具:
#!/bin/bash -eu
./autogen.sh
./configure --disable-shared
make -j$(nproc)
# Build harnesses
$CXX $CXXFLAGS -std=c++11 -I. \
$SRC/yourproject/fuzz/harness.cc -o $OUT/harness \
$LIB_FUZZING_ENGINE ./libyourproject.a
# Copy corpus and dictionary if available
cp $SRC/yourproject/fuzz/corpus.zip $OUT/harness_seed_corpus.zip
cp $SRC/yourproject/fuzz/dictionary.dict $OUT/harness.dict
测试工具在 Docker 容器中构建和执行。所有项目共享一个运行器镜像,但每个项目都有自己的构建镜像。
镜像按以下顺序相互构建:
base_imagebase_clang
base_builder_go 等base_builder 或语言变体base_clangbase_runner| 技巧 | 为何有帮助 |
|---|---|
| 不要手动复制源代码 | 项目 Dockerfile 可能已经拉取了最新版本 |
| 检查现有项目 | 浏览 oss-fuzz/projects 寻找示例 |
| 将测试工具保存在单独的仓库中 | 像 curl-fuzzer 一样 - 组织更清晰 |
| 使用特定的编译器版本 | 基础镜像提供一致的构建环境 |
| 在 Dockerfile 中安装依赖项 | 可能需要获得 OSS-Fuzz 加入批准 |
评分较低的项目仍可能被添加到私有的 OSS-Fuzz 实例中。
由于 OSS-Fuzz 是开源的,您可以托管自己的实例用于:
| 反面模式 | 问题 | 正确方法 |
|---|---|---|
| 在 build.sh 中手动拉取源代码 | 不使用最新版本 | 让 Dockerfile 处理 git clone |
| 将代码复制到 OSS-Fuzz 仓库 | 难以维护,违反分离原则 | 引用外部测试工具仓库 |
| 忽略基础镜像版本 | 构建不一致 | 使用提供的基础镜像和编译器 |
| 跳过本地测试 | 浪费 CI 资源 | 在提交 PR 前使用 helper.py 在本地测试 |
| 不检查构建状态 | 未注意到的构建失败 | 定期监控构建状态页面 |
OSS-Fuzz 主要使用 libFuzzer 作为 C/C++ 项目的模糊测试引擎。
测试工具签名:
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
// Your fuzzing logic
return 0;
}
在 build.sh 中构建:
$CXX $CXXFLAGS -std=c++11 -I. \
harness.cc -o $OUT/harness \
$LIB_FUZZING_ENGINE ./libproject.a
集成技巧:
$LIB_FUZZING_ENGINE 变量-fsanitize=fuzzer 会自动处理OSS-Fuzz 支持 AFL++ 作为替代的模糊测试引擎。
在 project.yaml 中启用:
fuzzing_engines:
- afl
- libfuzzer
集成技巧:
适用于带有 C 扩展的 Python 项目。
来自 cbor2 集成 的示例:
测试工具:
import atheris
import sys
import cbor2
@atheris.instrument_func
def TestOneInput(data):
fdp = atheris.FuzzedDataProvider(data)
try:
cbor2.loads(data)
except (cbor2.CBORDecodeError, ValueError):
pass
def main():
atheris.Setup(sys.argv, TestOneInput)
atheris.Fuzz()
if __name__ == "__main__":
main()
在 build.sh 中构建:
pip3 install .
for fuzzer in $(find $SRC -name 'fuzz_*.py'); do
compile_python_fuzzer $fuzzer
done
集成技巧:
compile_python_fuzzer 辅助函数在 project.yaml 中启用:
language: rust
fuzzing_engines:
- libfuzzer
sanitizers:
- address # Only AddressSanitizer supported for Rust
在 build.sh 中构建:
cargo fuzz build -O --debug-assertions
cp fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_target_1 $OUT/
集成技巧:
| 问题 | 原因 | 解决方案 |
|---|---|---|
| 构建因缺少依赖项而失败 | Dockerfile 中没有依赖项 | 在 Dockerfile 中添加 apt-get install 或等效命令 |
| 测试工具立即崩溃 | 缺少输入验证 | 在测试工具中添加大小检查 |
| 覆盖率为 0% | 测试工具未到达目标代码 | 验证测试工具是否实际调用了目标函数 |
| 构建超时 | 复杂的构建过程 | 优化 build.sh,考虑并行构建 |
| 构建中出现 Sanitizer 错误 | 不兼容的标志 | 使用 OSS-Fuzz 环境变量提供的标志 |
| 找不到源代码 | Dockerfile 中的工作目录错误 | 设置 WORKDIR 或使用绝对路径 |
| 技能 | 如何应用 |
|---|---|
| libfuzzer | OSS-Fuzz 使用的主要模糊测试引擎 |
| aflpp | OSS-Fuzz 支持的替代模糊测试引擎 |
| atheris | 用于在 OSS-Fuzz 中模糊测试 Python 项目 |
| cargo-fuzz | 用于在 OSS-Fuzz 中模糊测试 Rust 项目 |
| 技能 | 关系 |
|---|---|
| coverage-analysis | OSS-Fuzz 通过 helper.py 生成覆盖率报告 |
| address-sanitizer | OSS-Fuzz 项目的默认 sanitizer |
| fuzz-harness-writing | 将项目加入 OSS-Fuzz 所必需 |
| corpus-management | OSS-Fuzz 为加入的项目维护语料库 |
OSS-Fuzz 官方文档 涵盖 OSS-Fuzz 平台的加入、测试工具编写和故障排除的全面文档。
入门指南 将新项目加入 OSS-Fuzz 的分步过程,包括要求和批准流程。
cbor2 OSS-Fuzz 集成 PR 将带有 C 扩展的 Python 项目加入 OSS-Fuzz 的真实示例。展示了:
模糊测试内省器案例研究 使用模糊测试内省器分析覆盖率和识别模糊测试阻塞点的示例和解释。
查看 OSS-Fuzz 文档,了解关于加入和测试工具开发的研讨会录音和教程。
每周安装次数
1.1K
仓库
GitHub 星标数
3.9K
首次出现
Jan 19, 2026
安全审计
安装于
claude-code966
opencode923
gemini-cli908
codex900
cursor879
github-copilot849
OSS-Fuzz is an open-source project developed by Google that provides free distributed infrastructure for continuous fuzz testing. It streamlines the fuzzing process and facilitates simpler modifications. While only select projects are accepted into OSS-Fuzz, the project's core is open-source, allowing anyone to host their own instance for private projects.
OSS-Fuzz provides a simple CLI framework for building and starting harnesses or calculating their coverage. Additionally, OSS-Fuzz can be used as a service that hosts static web pages generated from fuzzing outputs such as coverage information.
| Concept | Description |
|---|---|
| helper.py | CLI script for building images, building fuzzers, and running harnesses locally |
| Base Images | Hierarchical Docker images providing build dependencies and compilers |
| project.yaml | Configuration file defining project metadata for OSS-Fuzz enrollment |
| Dockerfile | Project-specific image with build dependencies |
| build.sh | Script that builds fuzzing harnesses for your project |
| Criticality Score | Metric used by OSS-Fuzz team to evaluate project acceptance |
Apply this technique when:
Skip this technique when:
| Task | Command |
|---|---|
| Clone OSS-Fuzz | git clone https://github.com/google/oss-fuzz |
| Build project image | python3 infra/helper.py build_image --pull <project> |
| Build fuzzers with ASan | python3 infra/helper.py build_fuzzers --sanitizer=address <project> |
| Run specific harness | python3 infra/helper.py run_fuzzer <project> <harness> |
| Generate coverage report | python3 infra/helper.py coverage <project> |
| Check helper.py options |
OSS-Fuzz provides several publicly available tools and web interfaces:
The bug tracker allows you to:
The build status system helps track:
Fuzz Introspector displays:
Read this case study for examples and explanations.
You don't need to host the whole OSS-Fuzz platform to use it. The helper script makes it easy to run individual harnesses locally.
git clone https://github.com/google/oss-fuzz
cd oss-fuzz
python3 infra/helper.py --help
python3 infra/helper.py build_image --pull <project-name>
This downloads and builds the base Docker image for the project.
python3 infra/helper.py build_fuzzers --sanitizer=address <project-name>
Sanitizer options:
--sanitizer=address for AddressSanitizer with LeakSanitizerNote: Fuzzers are built to /build/out/<project-name>/ containing the harness executables, dictionaries, corpus, and crash files.
python3 infra/helper.py run_fuzzer <project-name> <harness-name> [<fuzzer-args>]
The helper script automatically runs any missed steps if you skip them.
First, install gsutil (skip gcloud initialization).
python3 infra/helper.py build_fuzzers --sanitizer=coverage <project-name>
python3 infra/helper.py coverage <project-name>
Use --no-corpus-download to use only local corpus. The command generates and hosts a coverage report locally.
See official OSS-Fuzz documentation for details.
Use Case: Testing OSS-Fuzz setup with a simple enrolled project
# Clone and navigate to OSS-Fuzz
git clone https://github.com/google/oss-fuzz
cd oss-fuzz
# Build and run irssi fuzzer
python3 infra/helper.py build_image --pull irssi
python3 infra/helper.py build_fuzzers --sanitizer=address irssi
python3 infra/helper.py run_fuzzer irssi irssi-fuzz
Expected Output:
INFO:__main__:Running: docker run --rm --privileged --shm-size=2g --platform linux/amd64 -i -e FUZZING_ENGINE=libfuzzer -e SANITIZER=address -e RUN_FUZZER_MODE=interactive -e HELPER=True -v /private/tmp/oss-fuzz/build/out/irssi:/out -t gcr.io/oss-fuzz-base/base-runner run_fuzzer irssi-fuzz.
Using seed corpus: irssi-fuzz_seed_corpus.zip
/out/irssi-fuzz -rss_limit_mb=2560 -timeout=25 /tmp/irssi-fuzz_corpus -max_len=2048 < /dev/null
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 1531341664
INFO: Loaded 1 modules (95687 inline 8-bit counters): 95687 [0x1096c80, 0x10ae247),
INFO: Loaded 1 PC tables (95687 PCs): 95687 [0x10ae248,0x1223eb8),
INFO: 719 files found in /tmp/irssi-fuzz_corpus
INFO: seed corpus: files: 719 min: 1b max: 170106b total: 367969b rss: 48Mb
#720 INITED cov: 409 ft: 1738 corp: 640/163Kb exec/s: 0 rss: 62Mb
#762 REDUCE cov: 409 ft: 1738 corp: 640/163Kb lim: 2048 exec/s: 0 rss: 63Mb L: 236/2048 MS: 2 ShuffleBytes-EraseBytes-
Use Case: Adding your project to OSS-Fuzz (or private instance)
Create three files in projects/<your-project>/:
1. project.yaml - Project metadata:
homepage: "https://github.com/yourorg/yourproject"
language: c++
primary_contact: "your-email@example.com"
main_repo: "https://github.com/yourorg/yourproject"
fuzzing_engines:
- libfuzzer
sanitizers:
- address
- undefined
2. Dockerfile - Build dependencies:
FROM gcr.io/oss-fuzz-base/base-builder
RUN apt-get update && apt-get install -y \
autoconf \
automake \
libtool \
pkg-config
RUN git clone --depth 1 https://github.com/yourorg/yourproject
WORKDIR yourproject
COPY build.sh $SRC/
3. build.sh - Build harnesses:
#!/bin/bash -eu
./autogen.sh
./configure --disable-shared
make -j$(nproc)
# Build harnesses
$CXX $CXXFLAGS -std=c++11 -I. \
$SRC/yourproject/fuzz/harness.cc -o $OUT/harness \
$LIB_FUZZING_ENGINE ./libyourproject.a
# Copy corpus and dictionary if available
cp $SRC/yourproject/fuzz/corpus.zip $OUT/harness_seed_corpus.zip
cp $SRC/yourproject/fuzz/dictionary.dict $OUT/harness.dict
Harnesses are built and executed in Docker containers. All projects share a runner image, but each project has its own build image.
Images build on each other in this sequence:
base_imagebase_clang
base_builder_go, etc.base_builder or language variantbase_clangbase_runner| Tip | Why It Helps |
|---|---|
| Don't manually copy source code | Project Dockerfile likely already pulls latest version |
| Check existing projects | Browse oss-fuzz/projects for examples |
| Keep harnesses in separate repo | Like curl-fuzzer - cleaner organization |
| Use specific compiler versions | Base images provide consistent build environment |
| Install dependencies in Dockerfile | May require approval for OSS-Fuzz enrollment |
OSS-Fuzz uses a criticality score to evaluate project acceptance. See this example for how scoring works.
Projects with lower scores may still be added to private OSS-Fuzz instances.
Since OSS-Fuzz is open-source, you can host your own instance for:
| Anti-Pattern | Problem | Correct Approach |
|---|---|---|
| Manually pulling source in build.sh | Doesn't use latest version | Let Dockerfile handle git clone |
| Copying code to OSS-Fuzz repo | Hard to maintain, violates separation | Reference external harness repo |
| Ignoring base image versions | Build inconsistencies | Use provided base images and compilers |
| Skipping local testing | Wastes CI resources | Use helper.py locally before PR |
| Not checking build status | Unnoticed build failures | Monitor build status page regularly |
OSS-Fuzz primarily uses libFuzzer as the fuzzing engine for C/C++ projects.
Harness signature:
extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
// Your fuzzing logic
return 0;
}
Build in build.sh:
$CXX $CXXFLAGS -std=c++11 -I. \
harness.cc -o $OUT/harness \
$LIB_FUZZING_ENGINE ./libproject.a
Integration tips:
$LIB_FUZZING_ENGINE variable provided by OSS-Fuzz-fsanitize=fuzzer is handled automaticallyOSS-Fuzz supports AFL++ as an alternative fuzzing engine.
Enable in project.yaml:
fuzzing_engines:
- afl
- libfuzzer
Integration tips:
For Python projects with C extensions.
Example fromcbor2 integration:
Harness:
import atheris
import sys
import cbor2
@atheris.instrument_func
def TestOneInput(data):
fdp = atheris.FuzzedDataProvider(data)
try:
cbor2.loads(data)
except (cbor2.CBORDecodeError, ValueError):
pass
def main():
atheris.Setup(sys.argv, TestOneInput)
atheris.Fuzz()
if __name__ == "__main__":
main()
Build in build.sh:
pip3 install .
for fuzzer in $(find $SRC -name 'fuzz_*.py'); do
compile_python_fuzzer $fuzzer
done
Integration tips:
compile_python_fuzzer helper provided by OSS-FuzzEnable in project.yaml:
language: rust
fuzzing_engines:
- libfuzzer
sanitizers:
- address # Only AddressSanitizer supported for Rust
Build in build.sh:
cargo fuzz build -O --debug-assertions
cp fuzz/target/x86_64-unknown-linux-gnu/release/fuzz_target_1 $OUT/
Integration tips:
| Issue | Cause | Solution |
|---|---|---|
| Build fails with missing dependencies | Dependencies not in Dockerfile | Add apt-get install or equivalent in Dockerfile |
| Harness crashes immediately | Missing input validation | Add size checks in harness |
| Coverage is 0% | Harness not reaching target code | Verify harness actually calls target functions |
| Build timeout | Complex build process | Optimize build.sh, consider parallel builds |
| Sanitizer errors in build | Incompatible flags | Use flags provided by OSS-Fuzz environment variables |
| Cannot find source code | Wrong working directory in Dockerfile | Set WORKDIR or use absolute paths |
| Skill | How It Applies |
|---|---|
| libfuzzer | Primary fuzzing engine used by OSS-Fuzz |
| aflpp | Alternative fuzzing engine supported by OSS-Fuzz |
| atheris | Used for fuzzing Python projects in OSS-Fuzz |
| cargo-fuzz | Used for Rust projects in OSS-Fuzz |
| Skill | Relationship |
|---|---|
| coverage-analysis | OSS-Fuzz generates coverage reports via helper.py |
| address-sanitizer | Default sanitizer for OSS-Fuzz projects |
| fuzz-harness-writing | Essential for enrolling projects in OSS-Fuzz |
| corpus-management | OSS-Fuzz maintains corpus for enrolled projects |
OSS-Fuzz Official Documentation Comprehensive documentation covering enrollment, harness writing, and troubleshooting for the OSS-Fuzz platform.
Getting Started Guide Step-by-step process for enrolling new projects into OSS-Fuzz, including requirements and approval process.
cbor2 OSS-Fuzz Integration PR Real-world example of enrolling a Python project with C extensions into OSS-Fuzz. Shows:
Fuzz Introspector Case Studies Examples and explanations of using Fuzz Introspector to analyze coverage and identify fuzzing blockers.
Check OSS-Fuzz documentation for workshop recordings and tutorials on enrollment and harness development.
Weekly Installs
1.1K
Repository
GitHub Stars
3.9K
First Seen
Jan 19, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykPass
Installed on
claude-code966
opencode923
gemini-cli908
codex900
cursor879
github-copilot849
Azure 升级评估与自动化工具 - 轻松迁移 Functions 计划、托管层级和 SKU
59,200 周安装
Grimoire CLI 使用指南:区块链法术编写、验证与执行全流程
940 周安装
Grimoire Uniswap 技能:查询 Uniswap 元数据与生成代币/资金池快照的 CLI 工具
940 周安装
Grimoire Aave 技能:查询 Aave V3 元数据和储备快照的 CLI 工具
941 周安装
Railway CLI 部署指南:使用 railway up 命令快速部署代码到 Railway 平台
942 周安装
n8n Python 代码节点使用指南:在自动化工作流中编写 Python 脚本
943 周安装
Flutter Platform Views 实现指南:Android/iOS/macOS原生视图与Web嵌入教程
943 周安装
python3 infra/helper.py --help |