Skip to content

Conversation

@Skn0tt
Copy link
Contributor

@Skn0tt Skn0tt commented Mar 5, 2024

The proxy/http3 package isn't covered by fuzz tests at all currently. Since HTTP3 is interfaced directly with the user-agent, it's a prime attack target.

This PR contributes a fuzzing setup for the HTTP3Frame parser. In depends on the H3 tools to compile, so we've extended oss-fuzz.sh to run the existing utility script.

Co-Authored-By: Yannis Hofmann <yannis.hofmann@student.hpi.de>
@Skn0tt
Copy link
Contributor Author

Skn0tt commented Mar 5, 2024

We've verified this to work locally by manually building + running the tracer using the infra/helper.py script from oss-fuzz.

@shukitchan shukitchan self-requested a review March 5, 2024 10:53
@shukitchan shukitchan added this to the 10.0.0 milestone Mar 5, 2024
@Skn0tt
Copy link
Contributor Author

Skn0tt commented Mar 5, 2024

The failing test seems unrelated to me.

@shukitchan
Copy link
Contributor

[approve ci autest]

Copy link
Contributor

@shukitchan shukitchan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks fine.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants