Build structure for OSS-Fuzz integration #34761

DavidKorczynski · 2020-08-13T17:30:21Z

Checklist

commit message follows commit guidelines

This PR sets up integration with OSS-Fuzz continuous fuzzing.

Fixes: #33724
Also fixes the integration described here google/oss-fuzz#3860 by @bnoordhuis

The idea is that we can avoid having a complicated build script on the OSS-Fuzz repository:
https://github.com/google/oss-fuzz/blob/master/projects/nodejs/build.sh

The code has been tested with oss-fuzz and simplifies things a lot, as well as make it much easier to write more fuzzers. Once this PR is merged I have several fuzzers that will be added, but I figured doing it step-by-step makes most sense.

The basic idea is to add a --with-ossfuzz flag in configure.py that is then used by the fuzzer targets inside node.gyp.

node.gyp

test/fuzzers/fuzz_url.cc

configure.py

nodejs-github-bot · 2020-08-14T03:58:21Z

CI: https://ci.nodejs.org/job/node-test-pull-request/32777/

aduh95 · 2020-08-14T08:18:09Z

The commit messages don't follow guidelines, do they? That should look something like:

build: setup for OSS-Fuzz integration

Refs: https://github.com/google /oss-fuzz/pull/3860
Fixes: https://github.com/nodejs /node/issues/33724

I've added spaces in the URL to workaround GitHub automatic linkage, please ignore that.

mmarchini · 2020-08-14T08:27:22Z

@aduh95 we usually fix it ourselves before landing for first time contributors

Trott · 2020-08-15T21:57:14Z

build: setup for OSS-Fuzz integration

Refs: https://github.com/google /oss-fuzz/pull/3860
Fixes: https://github.com/nodejs /node/issues/33724

Well, while we're at it, for whoever does land this: First word after build: should be an imperative verb, so maybe build: add build flag for OSS-Fuzz integration or something like that?

Refs: google/oss-fuzz#3860 Fixes: #33724 PR-URL: #34761 Fixes: #33724 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Rich Trott <rtrott@gmail.com>

Trott · 2020-08-15T22:01:58Z

Well, while we're at it, for whoever does land this

Oh, look, it was me.

Landed in 375b859

@DavidKorczynski Welcome and thanks for the contribution! 🎉

@aduh95 Thanks for the draft commit message. I don't know why, but the need to formulate a commit message sometimes makes me procrastinate on landing something, so being able to copy/paste what you had done took away that excuse for inaction on my part. 🎉

Refs: google/oss-fuzz#3860 Fixes: #33724 PR-URL: #34761 Fixes: #33724 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Rich Trott <rtrott@gmail.com>

Refs: nodejs#34761 Refs: nodejs#33724

Refs: google/oss-fuzz#3860 Fixes: #33724 PR-URL: #34761 Fixes: #33724 Reviewed-By: Richard Lau <riclau@uk.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Rich Trott <rtrott@gmail.com>

Notable changes: async_hooks: * add AsyncResource.bind utility (James M Snell) (#34574) buffer: * also alias BigUInt methods (Anna Henningsen) (#34960) * alias UInt ➡️ Uint in buffer methods (Anna Henningsen) (#34729) build: * add build flag for OSS-Fuzz integration (davkor) (#34761) cli: * add alias for report-directory to make it consistent (Ash Cripps) (#33587) crypto: * allow KeyObjects in postMessage (Tobias Nießen) (#33360) * add randomInt function (Oli Lalonde) (#34600) deps: * upgrade to libuv 1.39.0 (Colin Ihrig) (#34915) dgram: * add IPv6 scope id suffix to received udp6 dgrams (Pekka Nikander) (#14500) * allow typed arrays in .send() (Sarat Addepalli) (#22413) doc: * add basic embedding example documentation (Anna Henningsen) (#30467) embedding: * make Stop() stop Workers (Anna Henningsen) (#32531) * provide hook for custom process.exit() behaviour (Anna Henningsen) (#32531) fs: * implement lutimes (Maël Nison) (#33399) http: * return this from IncomingMessage#destroy() (Colin Ihrig) (#32789) * expose host and protocol on ClientRequest (wenningplus) [#33803](#33803) http2: * return this for Http2ServerRequest#setTimeout (Pranshu Srivastava) (#33994) * do not modify explicity set date headers (Pranshu Srivastava) (#33160) * n-api**: * support type-tagging objects (Gabriel Schulhof) (#28237) * provide asynchronous cleanup hooks (Anna Henningsen) (#34572) perf_hooks: * add idleTime and event loop util (Trevor Norris) (#34938) timers: * allow timers to be used as primitives (Denys Otrishko) [#34017](#34017) tls: * make 'createSecureContext' honor more options (Mateusz Krawczuk) (#33974) worker: * add public method for marking objects as untransferable (Anna Henningsen) (#33979) * emit `'messagerror'` events for failed deserialization (Anna Henningsen) (#33772) * allow passing JS wrapper objects via postMessage (Anna Henningsen) (#33772) * allow transferring/cloning generic BaseObjects (Anna Henningsen) (#33772) * add option to track unmanaged file descriptors (Anna Henningsen) (#34303) * add stack size resource limit option (Anna Henningsen) (#33085) * make FileHandle transferable (Anna Henningsen) (#33772) zlib: * add `maxOutputLength` option (unknown) (#33516) PR-URL: TODO

Notable changes: assert: * (SEMVER-MINOR) port common.mustCall() to assert (ConorDavenport) #31982 async_hooks: * (SEMVER-MINOR) add AsyncResource.bind utility (James M Snell) #34574 buffer: * (SEMVER-MINOR) also alias BigUInt methods (Anna Henningsen) #34960 * (SEMVER-MINOR) alias UInt ➡️ Uint in buffer methods (Anna Henningsen) #34729 build: * (SEMVER-MINOR) add build flag for OSS-Fuzz integration (davkor) #34761 cli: * (SEMVER-MINOR) add alias for report-directory to make it consistent (Ash Cripps) #33587 crypto: * (SEMVER-MINOR) allow KeyObjects in postMessage (Tobias Nießen) #33360 * (SEMVER-MINOR) add randomInt function (Oli Lalonde) #34600 deps: * upgrade to libuv 1.39.0 (Colin Ihrig) #34915 * upgrade npm to 6.14.7 (claudiahdz) #34468 * upgrade to libuv 1.38.1 (Colin Ihrig) #34187 dgram: * (SEMVER-MINOR) add IPv6 scope id suffix to received udp6 dgrams (Pekka Nikander) #14500 * (SEMVER-MINOR) allow typed arrays in .send() (Sarat Addepalli) #22413 doc: * (SEMVER-MINOR) Add maxTotalSockets option to agent constructor (rickyes) #33617 * (SEMVER-MINOR) add basic embedding example documentation (Anna Henningsen) #30467 * add Ricky Zhou to collaborators (rickyes) #34676 * add release key for Ruy Adorno (Ruy Adorno) #34628 * add DerekNonGeneric to collaborators (Derek Lewis) #34602 * add AshCripps to collaborators (Ash Cripps) #34494 * add HarshithaKP to collaborators (Harshitha K P) #34417 * add rexagod to collaborators (Pranshu Srivastava) #34457 * add release key for Richard Lau (Richard Lau) #34397 * add danielleadams to collaborators (Danielle Adams) #34360 * add sxa as collaborator (Stewart X Addison) #34338 * add ruyadorno to collaborators (Ruy Adorno) #34297 * (SEMVER-MAJOR) deprecate process.umask() with no arguments (Colin Ihrig) #32499 embedding: * (SEMVER-MINOR) make Stop() stop Workers (Anna Henningsen) #32531 * (SEMVER-MINOR) provide hook for custom process.exit() behaviour (Anna Henningsen) #32531 fs: * (SEMVER-MINOR) implement lutimes (Maël Nison) #33399 http: * (SEMVER-MINOR) add maxTotalSockets to agent class (rickyes) #33617 * (SEMVER-MINOR) return this from IncomingMessage#destroy() (Colin Ihrig) #32789 * (SEMVER-MINOR) expose host and protocol on ClientRequest (wenningplus) #33803 http2: * (SEMVER-MINOR) return this for Http2ServerRequest#setTimeout (Pranshu Srivastava) #33994 * (SEMVER-MINOR) do not modify explicity set date headers (Pranshu Srivastava) #33160 module: * (SEMVER-MINOR) named exports for CJS via static analysis (Guy Bedford) #35249 * (SEMVER-MINOR) exports pattern support (Guy Bedford) #34718 * (SEMVER-MINOR) package "imports" field (Guy Bedford) #34117 * (SEMVER-MINOR) deprecate module.parent (Antoine du HAMEL) #32217 n-api: * (SEMVER-MINOR) create N-API version 7 (Gabriel Schulhof) #35199 * (SEMVER-MINOR) support type-tagging objects (Gabriel Schulhof) #28237 n-api,src: * (SEMVER-MINOR) provide asynchronous cleanup hooks (Anna Henningsen) #34572 perf_hooks: * (SEMVER-MINOR) add idleTime and event loop util (Trevor Norris) #34938 timers: * (SEMVER-MINOR) allow timers to be used as primitives (Denys Otrishko) #34017 tls: * (SEMVER-MINOR) make 'createSecureContext' honor more options (Mateusz Krawczuk) #33974 worker: * (SEMVER-MINOR) add public method for marking objects as untransferable (Anna Henningsen) #33979 * (SEMVER-MINOR) emit `'messagerror'` events for failed deserialization (Anna Henningsen) #33772 * (SEMVER-MINOR) allow passing JS wrapper objects via postMessage (Anna Henningsen) #33772 * (SEMVER-MINOR) allow transferring/cloning generic BaseObjects (Anna Henningsen) #33772 * (SEMVER-MINOR) add option to track unmanaged file descriptors (Anna Henningsen) #34303 * (SEMVER-MINOR) add stack size resource limit option (Anna Henningsen) #33085 worker,fs: * (SEMVER-MINOR) make FileHandle transferable (Anna Henningsen) #33772 zlib: * (SEMVER-MINOR) add `maxOutputLength` option (unknown) #33516 * switch to lazy init for zlib streams (Andrey Pechkurov) #34048 PR-URL: TODO

Refs: #34761 Refs: #33724 PR-URL: #34844 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Michael Dawson <midawson@redhat.com>

Notable changes: assert: * (SEMVER-MINOR) port common.mustCall() to assert (ConorDavenport) nodejs#31982 async_hooks: * (SEMVER-MINOR) add AsyncResource.bind utility (James M Snell) nodejs#34574 buffer: * (SEMVER-MINOR) also alias BigUInt methods (Anna Henningsen) nodejs#34960 * (SEMVER-MINOR) alias UInt ➡️ Uint in buffer methods (Anna Henningsen) nodejs#34729 build: * (SEMVER-MINOR) add build flag for OSS-Fuzz integration (davkor) nodejs#34761 cli: * (SEMVER-MINOR) add alias for report-directory to make it consistent (Ash Cripps) nodejs#33587 crypto: * (SEMVER-MINOR) allow KeyObjects in postMessage (Tobias Nießen) nodejs#33360 * (SEMVER-MINOR) add randomInt function (Oli Lalonde) nodejs#34600 deps: * upgrade to libuv 1.39.0 (Colin Ihrig) nodejs#34915 * upgrade npm to 6.14.7 (claudiahdz) nodejs#34468 * upgrade to libuv 1.38.1 (Colin Ihrig) nodejs#34187 dgram: * (SEMVER-MINOR) add IPv6 scope id suffix to received udp6 dgrams (Pekka Nikander) nodejs#14500 * (SEMVER-MINOR) allow typed arrays in .send() (Sarat Addepalli) nodejs#22413 doc: * (SEMVER-MINOR) Add maxTotalSockets option to agent constructor (rickyes) nodejs#33617 * (SEMVER-MINOR) add basic embedding example documentation (Anna Henningsen) nodejs#30467 * add Ricky Zhou to collaborators (rickyes) nodejs#34676 * add release key for Ruy Adorno (Ruy Adorno) nodejs#34628 * add DerekNonGeneric to collaborators (Derek Lewis) nodejs#34602 * add AshCripps to collaborators (Ash Cripps) nodejs#34494 * add HarshithaKP to collaborators (Harshitha K P) nodejs#34417 * add rexagod to collaborators (Pranshu Srivastava) nodejs#34457 * add release key for Richard Lau (Richard Lau) nodejs#34397 * add danielleadams to collaborators (Danielle Adams) nodejs#34360 * add sxa as collaborator (Stewart X Addison) nodejs#34338 * add ruyadorno to collaborators (Ruy Adorno) nodejs#34297 * (SEMVER-MAJOR) deprecate process.umask() with no arguments (Colin Ihrig) nodejs#32499 embedding: * (SEMVER-MINOR) make Stop() stop Workers (Anna Henningsen) nodejs#32531 * (SEMVER-MINOR) provide hook for custom process.exit() behaviour (Anna Henningsen) nodejs#32531 fs: * (SEMVER-MINOR) implement lutimes (Maël Nison) nodejs#33399 http: * (SEMVER-MINOR) add maxTotalSockets to agent class (rickyes) nodejs#33617 * (SEMVER-MINOR) return this from IncomingMessage#destroy() (Colin Ihrig) nodejs#32789 * (SEMVER-MINOR) expose host and protocol on ClientRequest (wenningplus) nodejs#33803 http2: * (SEMVER-MINOR) return this for Http2ServerRequest#setTimeout (Pranshu Srivastava) nodejs#33994 * (SEMVER-MINOR) do not modify explicity set date headers (Pranshu Srivastava) nodejs#33160 module: * (SEMVER-MINOR) named exports for CJS via static analysis (Guy Bedford) nodejs#35249 * (SEMVER-MINOR) exports pattern support (Guy Bedford) nodejs#34718 * (SEMVER-MINOR) package "imports" field (Guy Bedford) nodejs#34117 * (SEMVER-MINOR) deprecate module.parent (Antoine du HAMEL) nodejs#32217 n-api: * (SEMVER-MINOR) create N-API version 7 (Gabriel Schulhof) nodejs#35199 * (SEMVER-MINOR) support type-tagging objects (Gabriel Schulhof) nodejs#28237 n-api,src: * (SEMVER-MINOR) provide asynchronous cleanup hooks (Anna Henningsen) nodejs#34572 perf_hooks: * (SEMVER-MINOR) add idleTime and event loop util (Trevor Norris) nodejs#34938 timers: * (SEMVER-MINOR) allow timers to be used as primitives (Denys Otrishko) nodejs#34017 tls: * (SEMVER-MINOR) make 'createSecureContext' honor more options (Mateusz Krawczuk) nodejs#33974 worker: * (SEMVER-MINOR) add public method for marking objects as untransferable (Anna Henningsen) nodejs#33979 * (SEMVER-MINOR) emit `'messagerror'` events for failed deserialization (Anna Henningsen) nodejs#33772 * (SEMVER-MINOR) allow passing JS wrapper objects via postMessage (Anna Henningsen) nodejs#33772 * (SEMVER-MINOR) allow transferring/cloning generic BaseObjects (Anna Henningsen) nodejs#33772 * (SEMVER-MINOR) add option to track unmanaged file descriptors (Anna Henningsen) nodejs#34303 * (SEMVER-MINOR) add stack size resource limit option (Anna Henningsen) nodejs#33085 worker,fs: * (SEMVER-MINOR) make FileHandle transferable (Anna Henningsen) nodejs#33772 zlib: * (SEMVER-MINOR) add `maxOutputLength` option (unknown) nodejs#33516 * switch to lazy init for zlib streams (Andrey Pechkurov) nodejs#34048 PR-URL: nodejs#35401

Refs: nodejs#34761 Refs: nodejs#33724 PR-URL: nodejs#34844 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com> Reviewed-By: Michael Dawson <midawson@redhat.com>

DavidKorczynski added 3 commits August 13, 2020 17:12

Added setup for OSS-Fuzz integration.

f6837d8

Simplified the gyp settings for fuzz-url.

10647c0

Removed whitespace.

ba5b7df

nodejs-github-bot added the build Issues and PRs related to build files or the CI. label Aug 13, 2020

richardlau approved these changes Aug 13, 2020

View reviewed changes

Added a help description for the with-ossfuzz configuration.

fdace7e

bnoordhuis approved these changes Aug 13, 2020

View reviewed changes

node.gyp Outdated Show resolved Hide resolved

test/fuzzers/fuzz_url.cc Outdated Show resolved Hide resolved

configure.py Outdated Show resolved Hide resolved

Resolved suggestions for improvements in oss-fuzz infrastructure.

fd987b6

Trott approved these changes Aug 15, 2020

View reviewed changes

Trott added the semver-minor PRs that contain new features and should be released in the next minor version. label Aug 15, 2020

Trott closed this Aug 15, 2020

DavidKorczynski mentioned this pull request Aug 16, 2020

[nodejs] Simplify build process as most work is now upstreamed. google/oss-fuzz#4327

Merged

DavidKorczynski added a commit to DavidKorczynski/node that referenced this pull request Aug 19, 2020

build: adds a new fuzzer that targets node::LoadEnvironment()

1570339

Refs: nodejs#34761 Refs: nodejs#33724

DavidKorczynski mentioned this pull request Aug 19, 2020

Adds a fuzzer for LoadEnvironment #34844

Closed

1 task

danielleadams mentioned this pull request Aug 20, 2020

V14.9.0 proposal #34852

Merged

codebytere mentioned this pull request Sep 28, 2020

v12.19.0 proposal #35401

Merged

This was referenced May 27, 2022

[Snyk] Fix for 1 vulnerabilities Dmarch28/node#59

Open

[Snyk] Fix for 1 vulnerabilities aliceUnhinged613/node#59

Open

137717unity mentioned this pull request May 27, 2022

[Snyk] Fix for 1 vulnerabilities 137717unity/node#58

Open

baby636 mentioned this pull request May 27, 2022

[Snyk] Fix for 1 vulnerabilities baby636/node#56

Open

snyk-bot mentioned this pull request May 27, 2022

[Snyk] Fix for 1 vulnerabilities kissofire/node#68

Open

wedataintelligence mentioned this pull request May 27, 2022

[Snyk] Fix for 1 vulnerabilities wedataintelligence/node#34

Open

ron-a20 mentioned this pull request May 27, 2022

[Snyk] Fix for 1 vulnerabilities ron-a20/node#67

Open

molllyn1 mentioned this pull request May 28, 2022

[Snyk] Fix for 1 vulnerabilities molllyn1/node#49

Open

snyk-bot mentioned this pull request Sep 25, 2022

[Snyk] Fix for 22 vulnerabilities 137717unity/node#70

Open

wedataintelligence mentioned this pull request Sep 26, 2022

[Snyk] Fix for 22 vulnerabilities wedataintelligence/node#44

Open

137717unity mentioned this pull request Sep 26, 2022

[Snyk] Fix for 22 vulnerabilities 137717unity/node#73

Open

snyk-bot mentioned this pull request Sep 27, 2022

[Snyk] Fix for 21 vulnerabilities Rednickle/node-1#56

Open

wedataintelligence mentioned this pull request Sep 29, 2022

[Snyk] Fix for 24 vulnerabilities wedataintelligence/node#50

Open

This was referenced Sep 29, 2022

[Snyk] Fix for 24 vulnerabilities 137717unity/node#75

Open

[Snyk] Fix for 23 vulnerabilities Rednickle/node-1#60

Open

This was referenced Oct 5, 2022

[Snyk] Fix for 24 vulnerabilities wedataintelligence/node#51

Open

[Snyk] Fix for 24 vulnerabilities wedataintelligence/node#52

Open

snyk-bot mentioned this pull request Oct 6, 2022

[Snyk] Fix for 24 vulnerabilities wedataintelligence/node#53

Open

137717unity mentioned this pull request Oct 7, 2022

[Snyk] Fix for 24 vulnerabilities 137717unity/node#76

Open

wedataintelligence mentioned this pull request Oct 7, 2022

[Snyk] Fix for 24 vulnerabilities wedataintelligence/node#54

Open

This was referenced Oct 8, 2022

[Snyk] Fix for 24 vulnerabilities wedataintelligence/node#55

Open

[Snyk] Fix for 24 vulnerabilities 137717unity/node#77

Open

137717unity mentioned this pull request Oct 9, 2022

[Snyk] Fix for 24 vulnerabilities 137717unity/node#78

Open

snyk-bot mentioned this pull request Oct 9, 2022

[Snyk] Fix for 23 vulnerabilities Rednickle/node-1#63

Open

kissofire mentioned this pull request Jun 25, 2023

[Snyk] Fix for 28 vulnerabilities kissofire/node#102

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Build structure for OSS-Fuzz integration #34761

Build structure for OSS-Fuzz integration #34761

DavidKorczynski commented Aug 13, 2020 •

edited

Loading

nodejs-github-bot commented Aug 14, 2020

aduh95 commented Aug 14, 2020

mmarchini commented Aug 14, 2020

Trott commented Aug 15, 2020

Trott commented Aug 15, 2020

Build structure for OSS-Fuzz integration #34761

Build structure for OSS-Fuzz integration #34761

Conversation

DavidKorczynski commented Aug 13, 2020 • edited Loading

Checklist

nodejs-github-bot commented Aug 14, 2020

aduh95 commented Aug 14, 2020

mmarchini commented Aug 14, 2020

Trott commented Aug 15, 2020

Trott commented Aug 15, 2020

DavidKorczynski commented Aug 13, 2020 •

edited

Loading