-
Notifications
You must be signed in to change notification settings - Fork 164
Description
OSS-Fuzz now offers support for fuzzing Java projects with Jazzer. If you are interested, I could set up re2j in OSS-Fuzz.
By default, Jazzer would detect undeclared exceptions (i.e. those that are not PatternSyntaxException
s) as well as more serious, potentially DoSable issues such as OutOfMemoryError
s. In order to come up with a good fuzz target, it would be helpful for me to get a better understanding of the security guarantees re2j intends to offer. The parent project's fuzzer could serve as a starting point for that discussion. Depending on your particular security goals, it could also make sense to perform differential fuzzing, i.e., to use a fuzzer to confirm that re2 and re2j behave identically on the common subset of their features.