Skip to content

[pull] master from google:master#172

Merged
pull[bot] merged 3 commits into
threatcode:masterfrom
google:master
Jul 9, 2026
Merged

[pull] master from google:master#172
pull[bot] merged 3 commits into
threatcode:masterfrom
google:master

Conversation

@pull

@pull pull Bot commented Jul 9, 2026

Copy link
Copy Markdown

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

alexcrichton and others added 3 commits July 9, 2026 17:01
Keeping things up-to-date to avoid falling too far behind
Follow-up to #15848, adding dictionaries for 11 of the 15 fuzz targets,
copied to `$OUT/<target>.dict` so ClusterFuzz picks them up
automatically.

- **mkv, isomp4, ogg, wav, mpa**: merged from the [google/fuzzing
dictionaries](https://github.com/google/fuzzing/tree/master/dictionaries)
(matroska+webm, mp4+mov, ogg, wav, mp3), with Symphonia-specific
additions (Opus/Vorbis/FLAC Ogg mapping signatures, MP1/MP2 frame sync
codes).
- **flac, vorbis, aiff, caf**: hand-written from the constants in
Symphonia's parsers (chunk IDs, header signatures, AIFF-C compression
types, CAF format IDs).
- **any**: merged superset for the probe-based `decode_any` target.

The raw-sample decoders (pcm, adpcm, alac, aac) have no byte-level
syntax to tokenize and intentionally get no dictionary.

All 10 files were validated with libFuzzer's `-dict=` parser (2,691
entries total, no parse errors).
Summary:
- build every fuzz target available in upstream libyang after
CESNET/libyang#2537
- add the new LYB and schema-mount XML fuzz targets to OSS-Fuzz
- package upstream per-target fuzz regression corpora as OSS-Fuzz seed
corpora when present

Testing:
- bash -n projects/libyang/build.sh
- git diff --check
- python3 infra/helper.py build_fuzzers --sanitizer address libyang was
started locally; Docker dependency installation completed, but the image
build stalled while cloning CESNET/libyang and was interrupted before
completion.

Co-authored-by: BeaCox <0xbeac@gmail.com>
@pull pull Bot locked and limited conversation to collaborators Jul 9, 2026
@pull pull Bot added the ⤵️ pull label Jul 9, 2026
@pull pull Bot merged commit 222bde7 into threatcode:master Jul 9, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants