Google Testing Blog: OSS-Fuzz: Five Months Later, and Rewarding Projects

OSS-Fuzz: Five Months Later, and Rewarding Projects

Monday, May 08, 2017

By Oliver Chang, Abhishek Arya (Security Engineers, Chrome Security), Kostya Serebryany (Software Engineer, Dynamic Tools), and Josh Armour (Security Program Manager)announcedOSS-Fuzzfuzzing471,000264

Breakdown of the types of bugs we're finding

Notable results

1017338102597CVE-2017-2801CVE-2017-3732timeout and out-of-memory failures Announcing rewards for open source projectsideal integrationPatch Rewardsfuzz targets

Fuzz targets are checked into their upstream repository and integrated in the build system with sanitizer support (up to $5,000).

Fuzz targets are efficient and provide good code coverage (>80%) (up to $5,000).

Fuzz targets are part of the official upstream development and regression testing process, i.e. they are maintained, run against old known crashers and the periodically updated corpora (up to $5,000).

The last $5,000 is a "l33t" bonus that we may reward at our discretion for projects that we feel have gone the extra mile or done something really awesome.