Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:125981
Precedence: bulk
MIME-Version: 1.0
References: <79C53085-9AD8-4E6D-ADAA-38AC1660A57E@gmail.com>
In-Reply-To: <79C53085-9AD8-4E6D-ADAA-38AC1660A57E@gmail.com>
Date: Tue, 19 Nov 2024 00:20:21 +0100
Message-ID: <CAPyj-LAPjdTFLRGJVroo17J9MKoS5X0U3rXmgh3SgLM6-KbmvA@mail.gmail.com>
Subject: Re: [PHP-DEV] A new fuzz testing tool for PHP
To: Yuancheng Jiang <0599jiangyc@gmail.com>, PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
From: tovilo.ilija@gmail.com (Ilija Tovilo)

Hi Yuancheng

On Fri, Nov 15, 2024 at 2:21=E2=80=AFPM Yuancheng Jiang <0599jiangyc@gmail.=
com> wrote:
>
> I have been submitting hundreds of bugs (see https://github.com/php/php-s=
rc/issues/created_by/YuanchengJiang) during the past months and I first tha=
nk all the developers who take time to fix these issues to make PHP better.
>
> I am thrilled to introduce one fully automated fuzz testing tool, FlowFus=
ion, for discovering various bugs of the PHP interpreter.
>
> I can open-source the tool under my personal repository. I wonder by any =
chance if I can contribute it as the official PHP tool under https://github=
.com/php, and I would be happy to maintain it for a long time.

Thank you very much for your continued effort in finding and reporting
these bugs! Congratulations on this impressive tool. It has certainly
proven helpful. A few questions:

Are you happy adopting an appropriate license, e.g. the PHP license?
[1] (Or potentially some other the community agrees with). Can we
assume this tool remains a PHP specific tool, or are you planning on
expanding it to other programming languages, now that the concept has
proven useful? Provided these two things are not a problem, I don't
see a reason not to move it into the PHP organization.

Could you also expand on hosting? Will infrastructure be provided
(assuming we want continuous fuzzing) or is this something we will
need to set up?

It would also be nice to know how issues are reported, how many
false-positives there are, how we can tweak fuzzing configuration,
etc. This discussion doesn't need to happen on a big public list like
this one. You can contact me directly if you wish to move this
forward.

Ilija

[1] https://opensource.org/license/php-3-01