OSS-Fuzz: Add new fuzzer and corpora targets rtmp - #3516
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The new fuzzer harness should avoid ambiguous RTMP context initialization and an unnecessary input copy to prevent fragility and reduce fuzzing overhead.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR adds an RTMP-focused libFuzzer harness and wires it into the existing fuzzing build/OSS-Fuzz packaging flow for bRPC’s RTMP protocol implementation.
Changes:
- Add a new
fuzz_rtmptarget that feeds data into the RTMP protocol parser. - Register
fuzz_rtmpin the CMake fuzz target list so it’s built whenBUILD_FUZZ_TESTS=ON. - Extend the OSS-Fuzz build script to build
fuzz_rtmpand package an RTMP seed corpus zip.
File summaries
| File | Description |
|---|---|
| test/fuzzing/oss-fuzz.sh | Builds fuzz_rtmp in OSS-Fuzz and packages fuzz_rtmp_seed_corpus into $OUT. |
| test/fuzzing/fuzz_rtmp.cpp | New RTMP fuzzer harness calling into brpc::policy::ParseRtmpMessage. |
| test/CMakeLists.txt | Adds fuzz_rtmp to the FUZZ_TARGETS list so it’s built with other fuzzers. |
Review details
- Files reviewed: 3/26 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
🟡 Changes recommended
The new fuzzer initializes a full brpc server with default options and a fixed port range, which can add unnecessary overhead and reduce robustness in OSS-Fuzz environments.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 3/26 changed files
- Comments generated: 1
- Review effort level: Lite
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Pull request overview
Copilot reviewed 3 out of 26 changed files in this pull request and generated 3 comments.
Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
d824b31 to
d8bf1c1
Compare
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Pull request overview
Copilot reviewed 3 out of 26 changed files in this pull request and generated 3 comments.
There was a problem hiding this comment.
🟢 Approval recommended
The changes are isolated to fuzzing harness/build integration and appear consistent with existing fuzz target patterns in the repository.
Review details
- Files reviewed: 3/26 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Pull request overview
Copilot reviewed 3 out of 26 changed files in this pull request and generated 5 comments.
| if (sock == nullptr) { | ||
| return 0; | ||
| } | ||
| brpc::Server* server = get_fuzz_server(); |
| sock->reset_parsing_context(new brpc::policy::RtmpContext(nullptr, server)); | ||
| brpc::policy::ParseRtmpMessage(&buf, sock, false, server); |
| zip $OUT/fuzz_http_seed_corpus.zip fuzz_http_seed_corpus/* | ||
| zip $OUT/fuzz_butil_seed_corpus.zip fuzz_butil_seed_corpus/* | ||
| zip $OUT/fuzz_hpack_seed_corpus.zip fuzz_hpack_seed_corpus/* | ||
| zip $OUT/fuzz_rtmp_seed_corpus.zip fuzz_rtmp_seed_corpus/* |
| // Stop again straight away. _options -- and so rtmp_service -- is not | ||
| // touched by Stop()/Join() | ||
| server.Stop(0); | ||
| server.Join(); |
| extern "C" int | ||
| LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) | ||
| { | ||
| if (size < kMinInputLength || size > kMaxInputLength){ |
This PR creates a new OSS-Fuzz fuzzer and corpora targets the rtmp process.