I've wondered about fuzzing but whats not too clear to me is what would provide the best value, or in other words, what are the high risk areas. Like in #5851, its parsing strings (not OsStrings) against a limited, static CLI definition. I feel like this is unlikely to uncover anything of interest.

I've wondered about fuzzing but whats not too clear to me is what would provide the best value, or in other words, what are the high risk areas. Like in #5851, its parsing strings (not OsStrings) against a limited, static CLI definition. I feel like this is unlikely to uncover anything of interest.

Thanks for your response.

I agree that the fuzzer in #5851 is unlikely to uncover anything of interest, but I’d like to emphasize that that this is more about integrating OSS-Fuzz support than the specific fuzzers themselves at this stage. We need to ensure that we have the necessary approvals from both parties before diving deep into the fuzzers. The aim is to eventually reach 100% fuzzing coverage through an iterative process of constant refinement.

I've updated #5851 to parse OsStrings instead.

I am open to any further suggestions you may have.

An OsString from a String doesn't make much of a difference.

For me, the big question is "will this be worth it" which is dependent on what a proposed fuzzer looks like.

@initializedd, I'm sorry, I over-reacted based on my own bad experience with some unknown 3rd party actor. I realize now that it sounds like I am accusing you of malicious behavior. I know nothing about you, and so I cannot fairly comment on your intentions. In retrospect, I don't think my original comment has any value, so I will delete it.

@initializedd, I'm sorry, I over-reacted based on my own bad experience with some unknown 3rd party actor. I realize now that it sounds like I am accusing you of malicious behavior. I know nothing about you, and so I cannot fairly comment on your intentions. In retrospect, I don't think my original comment has any value, so I will delete it.

Thanks for understanding.

@epage Are there any specific examples that you would suggest drawing inspiration from to improve the proposed fuzzer?

I don't know of an example that would be relevant for fuzzing. What I'm asking of you is to propose fuzzing that would provide enough value to be worth it.