Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:106005
To: Nikita Popov <nikita.ppv@gmail.com>,
 Stanislav Malyshev <smalyshev@gmail.com>
Cc: PHP Internals <internals@lists.php.net>,
 "security@php.net" <security@php.net>
References: <a73c84cb-efe3-507e-1a0d-1967e1521e50@gmail.com>
 <CAF+90c_R_c+iT3Qa6BigqWAvoQOd9RoQ6N69Pp-zoMego8fWvg@mail.gmail.com>
Message-ID: <a7d10a50-5994-bb29-7b2a-4519ff269cb1@gmx.de>
Date: Thu, 20 Jun 2019 18:43:51 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101
 Thunderbird/60.7.1
MIME-Version: 1.0
In-Reply-To: <CAF+90c_R_c+iT3Qa6BigqWAvoQOd9RoQ6N69Pp-zoMego8fWvg@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Language: de-DE
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] PHP on OSS-fuzz
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 20.06.2019 at 17:54, Nikita Popov wrote:
> On Sun, Mar 17, 2019 at 10:23 PM Stanislav Malyshev <smalyshev@gmail.com=
>
> wrote:
>
>> Hi!
>>
>> Looking at the recent PHP security issues, it is clear that many of the=
m
>> are stemming from corner cases in various format-parsing code, and most
>> of them either is or can be found by fuzzers.
>>
>> Thus, I've made an initial integration for PHP on OSS-fuzz project - a
>> fuzzing engine for testing open source projects. PHP configuration sits
>> here:
>> https://github.com/google/oss-fuzz/tree/master/projects/php
>> and implementation of fuzzers is here:
>> https://github.com/php/php-fuzzing-sapi
>>
>> So far we have three fuzzers enabled: JSON, EXIF and mbstring. I plan
>> also to add basic phar fuzzer soon. Everybody is welcome to add more
>> fuzzers - with priority on ones that actually deal with third-party
>> data, e.g. language parser fuzzer is not enabled right now, because
>> people usually do not run random byte streams as PHP scripts on their
>> servers. On the other hand, people do apply EXIF or gd functions to
>> third-party data, so a vulnerability in that code would be high priorit=
y.
>>
>> That said, fuzzers can be run independently of OSS-Fuzz, so if you feel
>> inspired to add a fuzzer for any code please do so.
>
> Where are issues detected by oss-fuzz reported?

Everyone who is listed under primary_contact or auto_ccs[1] should be
able to see the reports on <https://oss-fuzz.com/> and gets e-mails for
first time issues (works for me for libgd).

[1]
<https://github.com/google/oss-fuzz/blob/master/projects/php/project.yaml>

Thanks,
Christoph