|
|
|
@ -234,7 +234,7 @@ $ honggfuzz/honggfuzz --exit_upon_crash --quiet --timeout 4 -n 1 -Q \
|
|
|
|
# OSS-Fuzz
|
|
|
|
# OSS-Fuzz
|
|
|
|
|
|
|
|
|
|
|
|
Bitcoin Core participates in Google's [OSS-Fuzz](https://github.com/google/oss-fuzz/tree/master/projects/bitcoin-core)
|
|
|
|
Bitcoin Core participates in Google's [OSS-Fuzz](https://github.com/google/oss-fuzz/tree/master/projects/bitcoin-core)
|
|
|
|
program, which includes a dashboard of [publicly disclosed vulnerabilities](https://bugs.chromium.org/p/oss-fuzz/issues/list).
|
|
|
|
program, which includes a dashboard of [publicly disclosed vulnerabilities](https://bugs.chromium.org/p/oss-fuzz/issues/list?q=bitcoin-core).
|
|
|
|
Generally, we try to disclose vulnerabilities as soon as possible after they
|
|
|
|
Generally, we try to disclose vulnerabilities as soon as possible after they
|
|
|
|
are fixed to give users the knowledge they need to be protected. However,
|
|
|
|
are fixed to give users the knowledge they need to be protected. However,
|
|
|
|
because Bitcoin is a live P2P network, and not just standalone local software,
|
|
|
|
because Bitcoin is a live P2P network, and not just standalone local software,
|
|
|
|
@ -242,3 +242,5 @@ we might not fully disclose every issue within Google's standard
|
|
|
|
[90-day disclosure window](https://google.github.io/oss-fuzz/getting-started/bug-disclosure-guidelines/)
|
|
|
|
[90-day disclosure window](https://google.github.io/oss-fuzz/getting-started/bug-disclosure-guidelines/)
|
|
|
|
if a partial or delayed disclosure is important to protect users or the
|
|
|
|
if a partial or delayed disclosure is important to protect users or the
|
|
|
|
function of the network.
|
|
|
|
function of the network.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
OSS-Fuzz also produces [a fuzzing coverage report](https://oss-fuzz.com/coverage-report/job/libfuzzer_asan_bitcoin-core/latest).
|
|
|
|
|
MarcoFalke
4 years ago