OSS-Fuzz Integration — libformix | CULTIVA IA Seguridad

Cobertura total

68.4%

+12.1% vs semana anterior

Crashes encontrados

2 críticos · 2 medios

Ejecuciones / seg

12.4k

3 harnesses · libfuzzer

Corpus total

1.847

seeds + generados por fuzzer

Horas de fuzzing

72h

Sprint 1 completado

🔐 Harnesses activos

3 / 3 OK

fuzz_multipart_parser

2 crashes C++

Cobertura: 74.2% Exec/s: 8.200 Corpus: 1.024 Sanitizer: ASan+LSan

fuzz_url_decode

0 crashes C++

Cobertura: 61.8% Exec/s: 2.900 Corpus: 680 Sanitizer: ASan+UBSan

fuzz_formix_py

2 timeouts Python

Cobertura: 55.1% Exec/s: 1.300 Corpus: 143 Engine: Atheris

🕐 Sprint 1 — Timeline

En progreso

02 Jun 2026

Setup OSS-Fuzz local + Docker

Clone oss-fuzz, build base image gcr.io/oss-fuzz-base/base-builder. Verificado con helper.py --help.

03 Jun 2026

Dockerfile + project.yaml creados

proyecto libformix enrolado. build_image OK en 4min 22s.

04–07 Jun 2026

Harnesses C++ compilados con ASan

fuzz_multipart_parser y fuzz_url_decode. Corpus inicial: 800 seeds multipart + 680 URLs edge-case.

08 Jun 2026

CRASH: heap-buffer-overflow en parseChunk()

MultipartParser::parseChunk() line 347. CRITICAL. Reproducido con testcase-6f3a.

09 Jun 2026

CRASH: heap-use-after-free en FormField::decode()

FormField.cc:192. CRITICAL. Requiere patch urgente.

10–12 Jun 2026

Harness Python (Atheris) + CI GitHub Actions

fuzz_formix_py activo. Pipeline .github/workflows/fuzz.yml configurado. Runs en push a main.

16 Jun 2026 (hoy)

Reporte Sprint 1 — cobertura 68.4%

Sprint 2: fix crashes, ampliar corpus Python, configurar GCS para corpus persistente.

🚨 Crashes detectados

2 CRITICAL 2 MEDIUM

ID	Severidad	Tipo	Función afectada	Sanitizer	Harness	Estado	Testcase
CRASH-001	CRITICAL	heap-buffer-overflow	MultipartParser::parseChunk():347	ASan	fuzz_multipart_parser	En fix	testcase-6f3a
CRASH-002	CRITICAL	heap-use-after-free	FormField::decode():192	ASan	fuzz_multipart_parser	En fix	testcase-9c21
CRASH-003	MEDIUM	integer-overflow	URLDecoder::percentDecode():88	UBSan	fuzz_url_decode	Parchado	testcase-a4f7
CRASH-004	MEDIUM	timeout (25s)	formix.parse() — Python binding	Atheris	fuzz_formix_py	Investigando	testcase-b8d2

Configuracion OSS-Fuzz — libformix

📄 project.yaml

YAML

homepage: "https://github.com/cultiva-clients/libformix"
language: c++
primary_contact: "seguridad@cultivaia.es"
main_repo: "https://github.com/cultiva-clients/libformix"
fuzzing_engines:
  - libfuzzer
  - afl
sanitizers:
  - address
  - undefined
auto_ccs:
  - "equipo@cultivaia.es"
          

🐨 Dockerfile

Docker

# OSS-Fuzz base builder
FROM gcr.io/oss-fuzz-base/base-builder

# Dependencias del proyecto
RUN apt-get update && \
    apt-get install -y \
    cmake \
    libssl-dev \
    zlib1g-dev

# Clonar repo principal
RUN git clone --depth 1 \
  https://github.com/cultiva-clients/libformix

# Clonar harnesses (repo separado)
RUN git clone \
  https://github.com/cultiva-clients/libformix-fuzz

WORKDIR libformix
COPY build.sh $SRC/
          

⚙ build.sh

Bash

#!/bin/bash -eu

# Compilar librería
cmake -B build \
  -DCMAKE_BUILD_TYPE=RelWithDebInfo \
  -DBUILD_SHARED_LIBS=OFF
cmake --build build -j$(nproc)

# Harness multipart
$CXX $CXXFLAGS -std=c++17 \
  -I$SRC/libformix/include \
  $SRC/libformix-fuzz/fuzz_multipart.cc \
  -o $OUT/fuzz_multipart_parser \
  $LIB_FUZZING_ENGINE \
  $SRC/libformix/build/libformix.a

# Corpus
cp $SRC/libformix-fuzz/corpus/*.zip \
   $OUT/fuzz_multipart_parser_seed_corpus.zip
          

🛠 Harness C++ — fuzz_multipart_parser

libFuzzer

// fuzz_multipart.cc
#include <cstdint>
#include <cstddef>
#include "formix/multipart_parser.h"

extern "C" int LLVMFuzzerTestOneInput(
    const uint8_t *data,
    size_t size) {

  // Validar tamaño mínimo de entrada
  if (size < 8) return 0;

  formix::MultipartParser parser;
  parser.setBoundary("----FormBoundary");

  // Target del crash CRASH-001
  try {
    parser.parseChunk(data, size);
    parser.finalize();
  } catch (const std::exception&) {
    /* crashes reales no lanzan excepcion */
  }
  return 0;
}
        

📈 Mapa de cobertura — src/

Cada celda = 50 líneas

Alta (>80%) Media (40-80%) Baja (<40%) Crash

multipart_parser.cc (74.2%)

form_field.cc (61.3%)

url_decoder.cc (61.8%)

Objetivo Sprint 2: llevar cobertura total a 80%+ mediante corpus expansion + targeted harnesses para rutas muertas.

⚖ Comandos helper.py

Quick Ref

# 1. Clonar OSS-Fuzz
git clone https://github.com/google/oss-fuzz
cd oss-fuzz

# 2. Construir imagen Docker del proyecto
python3 infra/helper.py build_image \
  --pull libformix

# 3. Compilar fuzzers con AddressSanitizer
python3 infra/helper.py build_fuzzers \
  --sanitizer=address libformix

# 4. Ejecutar harness específico
python3 infra/helper.py run_fuzzer \
  libformix fuzz_multipart_parser

# 5. Reproducir crash CRASH-001
python3 infra/helper.py reproduce \
  libformix fuzz_multipart_parser \
  ./testcase-6f3a

# 6. Reporte de cobertura
python3 infra/helper.py build_fuzzers \
  --sanitizer=coverage libformix
python3 infra/helper.py coverage \
  libformix --no-corpus-download
        

⚡ GitHub Actions — fuzz.yml

CI/CD

name: libformix OSS-Fuzz CI
on:
  push:
    branches: [main, develop]
  schedule:
    - cron: '0 2 * * 1'  # Lunes 02:00 UTC

jobs:
  fuzz:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Clone OSS-Fuzz
        run: git clone https://github.com/google/oss-fuzz
      - name: Build fuzzers
        run: |
          cd oss-fuzz
          python3 infra/helper.py build_fuzzers \
            --sanitizer=address libformix
      - name: Run 60s fuzz
        run: |
          python3 infra/helper.py run_fuzzer \
            libformix fuzz_multipart_parser \
            -- -max_total_time=60
      - name: Notify Slack on crash
        if: failure()
        uses: slackapi/slack-github-action@v1
        

🚀 Sprint 2 — Acciones pendientes

16–30 Jun 2026

⚠ Fix críticos

○ Patch CRASH-001: bounds check en parseChunk()
○ Patch CRASH-002: smart pointer en FormField
○ Regresión: re-run corpus contra versión parchada
○ CVE disclosure si se confirma exploit público

📈 Ampliar cobertura

○ Targeted seeds para rutas muertas (<40%)
○ Fuzz Introspector: identificar blockers
○ AFL++ modo persistente para url_decode
○ Harness para ChunkedEncoder (sin cobertura)

🔗 Infraestructura

○ GCS bucket para corpus persistente entre runs
○ Dashboard OSS-Fuzz privado (opcional)
○ Alertas Slack por crash + email a cliente
○ Solicitar enrolamiento OSS-Fuzz público (score eval)