projects/exim: add OSS-Fuzz integration for SMTP address parser#15599
projects/exim: add OSS-Fuzz integration for SMTP address parser#15599XananasX7 wants to merge 8 commits into
Conversation
Redis is a widely-deployed Tier 1 in-memory data store used by millions of applications. It currently has no OSS-Fuzz project. This PR adds: Fuzz targets: - fuzz_resp_parser: exercises the RESP3 protocol reply parser (src/resp_parser.c) with arbitrary network-like input. Covers all RESP3 type prefixes: simple strings, errors, integers, bulk strings, arrays, sets, maps, null, bool, double, big number, verbatim string, and attribute types. - fuzz_rdb_load: exercises the RDB file parser (src/rdb.c) by writing arbitrary input to a temp file and calling rdbLoad(). RDB parsing is a critical attack surface for Redis replication and persistence. Seed corpus: 13 valid RESP3 messages covering every reply type. Dictionary: RESP3 type prefix tokens for guided mutation.
… parser Vim is a ubiquitous text editor with a history of memory-safety CVEs (heap overflows, use-after-free in regexp, eval, ex_cmds). It has no existing OSS-Fuzz project. Fuzz targets: - fuzz_regexp: feeds arbitrary pattern/subject pairs to vim_regcomp() and vim_regexec(). Covers backtracking (regexp_bt.c), NFA engine (regexp_nfa.c), and all special regex syntax including backreferences, character classes, and look-around assertions. - fuzz_vimscript: feeds arbitrary input to eval0() to exercise the Vimscript expression evaluator. Covers variable access, function calls, operators, and string/list/dict constructors. Seed corpus: valid regex pattern/subject pairs for guided mutation. Historical CVEs in scope: CVE-2022-0359, CVE-2022-0368, CVE-2022-0443, CVE-2023-48231 (and many more in the regexp/eval paths).
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
|
XananasX7 is integrating a new project: |
|
I have read the CLA Document and I hereby sign the CLA Signed-off-by: XananasX7 mehdiananas007@gmail.com |
|
Thanks for the detailed feedback @DavidKorczynski — addressing all 5 points:
The remaining open PRs here cover genuinely new projects not yet in OSS-Fuzz. Happy to address any other issues on those. |
|
Reauthored all commits with the correct email (mehdiananas007@gmail.com) matching the signed Google Individual CLA. The CLA bot should now verify successfully. |
|
Hi @DavidKorczynski — following up on the CLA and header-check failures still showing. I signed the CLA via the Google portal using mehdiananas007@gmail.com and reauthored all commits with that email, but the bot is still showing FAILURE. Is there anything else needed to get the CLA check to pass — perhaps a manual recheck? Happy to squash/rebase or adjust anything else you'd like. |
All Dockerfiles, build scripts, and fuzzer source files now carry the complete 13-line Apache 2.0 license header matching the OSS-Fuzz convention. Previously several files had either no header or a truncated version (missing the URL, disclaimer, and 'limitations under the License' line). Fixes the header-check CI failure.
|
Hi @DavidKorczynski — pushed a fix addressing the remaining header-check failure. All project files that had missing or incomplete Apache 2.0 license headers have been updated:
All headers now match the format used by the rest of the oss-fuzz project. The CLA was already signed using |
2 participants
Exim OSS-Fuzz Integration
Exim is one of the most widely deployed Mail Transfer Agents in the world, handling SMTP message routing, address parsing, header processing, and content scanning. It has a significant CVE history including critical RCEs (CVE-2019-10149 "Return of the WIZard", CVE-2017-16943, Exim 21Nails).
Despite being a critical MTA with historically high bug density, Exim currently has no OSS-Fuzz project.
Fuzz target
fuzz_smtp_inputparse_extract_address())Why this matters
Exim's address parser handles maliciously crafted MAIL FROM/RCPT TO addresses that are supplied directly by remote SMTP clients. This function has been the site of historical heap overflows and logic bugs. Continuous fuzzing catches regressions before deployment.