From emptyiscolor@gmail.com Fri Feb 13 02:36:06 2026
From: emptyiscolor@gmail.com
To: openldap-devel@openldap.org
Subject: [RESEND] Proposal: Continuous fuzzing support via OSS-Fuzz
Date: Fri, 13 Feb 2026 02:06:34 +0000
Message-ID: <177094839419.1014223.330739661383009045@hypatia.openldap.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============6550199221523204177=="

--===============6550199221523204177==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Dear OpenLDAP team,

Apologies if this is a duplicate =E2=80=94 I=E2=80=99m resending this message=
 in case my previous post did not reach the list.

I=E2=80=99m writing to ask for guidance on potential ongoing fuzzing and secu=
rity contributions for OpenLDAP. This is not a bug report or patch submission.

Brief context: we recently reported Bug 10429, which was fixed in MR 826 (tha=
nk you). We have since been applying our fuzzing infrastructure to OpenLDAP a=
nd integrated a set of LibFuzzer-based harnesses into OSS-Fuzz.

Draft OSS-Fuzz integration:
https://github.com/google/oss-fuzz/pull/14872

In addition to Bug 10429, several related issues identified through fuzzing h=
ave recently been reported to the Issue Tracking System by my collaborator Ka=
ng Yang (Issues 10445, 10446, 10447, 10448, 10449, and 10450), which further =
motivates broader and continuous fuzzing coverage.

At present, this work lives entirely in OSS-Fuzz and does not modify the Open=
LDAP source tree. We are continuing to verify additional harnesses and invest=
igate findings; any confirmed bugs and patches will be submitted via the Issu=
e Tracking System in accordance with the contribution guidelines.

We would appreciate guidance on whether this OSS-Fuzz integration approach al=
igns with OpenLDAP=E2=80=99s expectations, and whether there are preferences =
regarding API scope or future in-tree fuzzing work.

Thanks for your time.

Best regards,
Yunhang Zhang
University of Utah

--===============6550199221523204177==--


