CPython uses
, Google’s continuous fuzzing service for open-source projects, to find bugs and security vulnerabilities by feeding semi-random data to various APIs.
CPython has two OSS-Fuzz projects:
: The fuzz targets, seed corpora, and dictionaries can be found in the
directory of CPython. This project is maintained for existing fuzz targets; add new targets to python3-libraries.
: The fuzz targets, seed corpora, and dictionaries can be found in the
repository. Access to the repository is managed through the
team on GitHub.
OSS-Fuzz bug reports are private when filed, so access to crash details and reproducer test cases is limited to those listed in the auto_ccs fields of the OSS-Fuzz project configuration files. Those listed can log into
with their Google account to view crash details, reproducer test cases, and project statistics. If you need access, contact the
team. Completed issues, and issues that remain unresolved after 90 days, are publicly visible in the
.
Coverage and target statistics are available in the OSS-Fuzz Introspector project profiles for
and
.
In addition,
runs the fuzz targets on GitHub Actions for PRs to the main branch changing relevant files.
See also
The
documentation for details about the fuzzing engine used by OSS-Fuzz.
Adding new targets
Add new targets to the python3-libraries project. For more information, see the documentation in the
repository.
If the new target covers a standard library module, update the relevant CIFuzz path configuration so pull requests touching that module trigger fuzzing. See the LIBRARY_FUZZER_PATHS set in
Tools/build/compute-changes.py
.