Suggestion: Continuous Fuzzing

[yevgenypats]

Hi, I'm Yevgeny Pats Founder of Fuzzit - Continuous fuzzing as a service platform.

We have a free plan for OSS and I would be happy to contribute a PR if that's interesting.
The PR will include the following

• go-fuzz fuzzers (This is generic step not-connected to fuzzit)
• Continuous Fuzzing of master branch which will generate new corpus and look for new crashes
• Regression on every PR that will run the fuzzers through all the generated corpus and fixed crashes from previous step. This will prevent new or old bugs from crippling into master.

You can see our basic example fuzzitdev/example-go and you can see an example of "in the wild" integration google/syzkaller.

Let me know if this is something worth working on.

Cheers,
Yevgeny

[johanbrandhorst]

Hi Yevgeny,

Thanks for reaching out! This sounds really interesting. The gRPC-Gateway can be used as a first layer against the internet so it seems worthwhile to investigate, however the overlap between us and the Go standard library will be pretty high. We have some custom path parsing and stuff which might be interesting though. If you would like to contribute something, I would start looking at adding some fuzzing to the integration tests maybe? They're in https://github.com/grpc-ecosystem/grpc-gateway/tree/master/examples/integration. That would fuzz against a running server, which might not be appropriate, let me know what you think.

[yevgenypats]

Hi Johan,

Thanks for quick reply.

I'm not sure about the integration test as far as I understand they just send data over the network to the server which is less appropriate to how go-fuzz works. This is more appropriate to be an additional strong "unit-tests", we need to find the relevant function that go-fuzz will call with psudo-random data to test and check for crashes/other bugs.

Also forgot to mention, we have a reward program in case you want/have time to contribute this, I'll be happy to reward you as well as get unbiased feedback on how smooth the integration was. If not I'll try to contribute this myself with your guidance.

[johanbrandhorst]

The reward program seems like a great way to get new users trying the code base as well, so I will leave it. I'd be happy to help you get it in if you find the time, of course.

[johanbrandhorst]

I think we can close this with #1001 merged