The OSS-Fuzz infrastructure for continuous fuzz testing has added the capability to test projects written in Lua, in addition to previously supported languages such as C/C++, Go, Swift, Rust, Python, JavaScript, and Java. The integration is implemented through the luzer project, which develops specialized tools for fuzz testing Lua code and Lua extensions written in C/C++.
The project uses the libFuzzer library and can be used in conjunction with AddressSanitizer, MemorySanitizer, LeakSanitizer, ThreadSanitizer, and Undefined Behavior Sanitizer tools, which help identify common vulnerabilities caused by buffer overflows, integer overflows, access to uninitialized and freed areas, memory leaks, dereferencing pointers, and locking issues based on problems found during fuzz testing. The project's code is available under the ISC license.
During its operation, luzer iterates through possible input combinations and generates a report of all encountered failures and unhandled exceptions. For instance, when testing the MsgPack format parsing library antirez/lua-cmsgpack in luzer, it was found that data with a large number of arrays could lead to a stack overflow.
As part of the lunapark project, the luzer toolkit is used to test PUC Rio Lua, the LuaJIT tracing compiler, a high-performance DBMS, and server Tarantool applications, as well as for testing third-party Lua modules.
Developers of open projects can add their repositories for testing by preparing a fuzz testing template and submitting a special request through a pull request. Upon discovering errors, developers are automatically notified, and a private ticket for fixing is created (to prevent premature information leaks about vulnerabilities, a ticket is created in a restricted-access bug tracking system). OSS Fuzz monitors the status of the bug fix and will close the ticket itself if the issue is no longer reproducible. Information about the issue becomes publicly available 7 days after the fix or 90 days after the bug was discovered if the issue remains unresolved.
Source: opennet.ru
