1798631 - Add fuzzing for JAR code

Status: RESOLVED FIXED

(Core :: Networking: JAR, task, P2)

Description

[Valentin Gosu [:valentin] {{ IETF until 25 July - PTO until 3 August }}]

We've been looking at some JAR security bugs lately, and considering how old the code is, it isn't really tested well enough.
It would be great to have some fuzzing for this.

Chris, what's the usual approach here?

Comment 1

[Valentin Gosu [:valentin] {{ IETF until 25 July - PTO until 3 August }}]

Attachment: Bug 1798631 - Add zip reader fuzzer r=decoder

Add back nsIZipReader.openMemory - Backed out changeset 1b442368d567

Comment 2

[BugBot [:suhaib / :marco]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:valentin, could you have a look please?
If you still have some work to do, you can add an action "Plan Changes" in Phabricator.
For more information, please visit auto_nag documentation.

Comment 3

[Valentin Gosu [:valentin] {{ IETF until 25 July - PTO until 3 August }}]

I want to run this for a couple more days next week before we can land it.

Comment 4

[Tyson Smith [:tsmith] (Back Aug 12)]

I have been able to run the fuzzer with the patch for bug 1838117 applied for over 48h (running 5 instances) without hitting any issues on an ASan build. I think this is ready to land and I can get it running in automation.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/bfcf1b0a05b4
Add zip reader fuzzer r=decoder,necko-reviewers,kershaw

Comment 6

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/bfcf1b0a05b4