metzmanj·2 年前·議論That's what people are saying though I haven't had the chance to look into this myself.Fuzzing isn't really the best tool for catching bugs the maintainer intentionally inserted though.
metzmanj·2 年前·議論>Woha, is this legit or some sort of scam on Google in some way?:I work on OSS-Fuzz.As far as I can tell, the author's PRs do not compromise OSS-Fuzz in any way.OSS-Fuzz doesn't trust user code for this very reason.
Fuzzing isn't really the best tool for catching bugs the maintainer intentionally inserted though.