Skip to content

Add fuzz targets for OBJ, PLY, STL, and animation decoders - #1222

Open
smoke-wolf wants to merge 1 commit into
google:mainfrom
smoke-wolf:add-io-fuzz-targets
Open

Add fuzz targets for OBJ, PLY, STL, and animation decoders#1222
smoke-wolf wants to merge 1 commit into
google:mainfrom
smoke-wolf:add-io-fuzz-targets

Conversation

@smoke-wolf

Copy link
Copy Markdown

Summary

Add four new fuzz harnesses to src/draco/tools/fuzz/ covering the I/O
format decoders and animation decoder that currently have no fuzz coverage:

  • draco_obj_decoder_fuzzer.cc — OBJ text format parser
  • draco_ply_decoder_fuzzer.cc — PLY binary/text format parser
  • draco_stl_decoder_fuzzer.cc — STL binary/ASCII format parser
  • draco_animation_decoder_fuzzer.cc — Keyframe animation decoder

Rationale

The existing four fuzz targets cover only the compressed .drc format
(draco::Decoder::DecodeMeshFromBuffer / DecodePointCloudFromBuffer).
The OBJ, PLY, and STL decoders accept untrusted file data from the same
sources (web, file imports) and have complex text/binary parsing logic
that would benefit from continuous fuzzing. The animation decoder shares
the compressed-format internal decompression path but through a separate
entry point that exercises keyframe-specific attribute handling.

Build integration

No CMake or build system changes needed — the existing
src/draco/tools/fuzz/build.sh (used by oss-fuzz) automatically
compiles all *.cc files in the fuzz directory. The new harnesses
follow the same pattern and include paths as the existing four.

Context

This was requested by the oss-fuzz maintainer (@DavidKorczynski) in
google/oss-fuzz#16096 — harnesses should live
upstream so oss-fuzz builds them from the main repository.

@google-cla

google-cla Bot commented Sep 3, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@DavidKorczynski

Copy link
Copy Markdown
Contributor

This was requested by the oss-fuzz maintainer (@DavidKorczynski) in
google/oss-fuzz#16096

To clarify: I did not request the creation of these fuzzing harnesses. However, as a maintainer of OSS-Fuzz I review PRs on that repo to make sure contributions align with how existing projects structure the fuzzing + oss-fuzz's preferences. To this end I request contributors place the fuzzing harnesses in the upstream projects, e.g. similar to what draco is already doing with its existing fuzzing harnesses.

I.e. my request is to "coordinate this with the Draco maintainers and make sure you have their collaboration".

Add four new fuzz harnesses covering the I/O format decoders and
animation decoder that currently have zero fuzz coverage. These
complement the existing four compressed-format (.drc) fuzz targets.

No build system changes needed — the existing build.sh compiles all
*.cc files in the fuzz directory automatically.
@smoke-wolf

Copy link
Copy Markdown
Author

Thanks for the clarification, I misworded that. What I meant was that you directed the contribution to the upstream repo rather than oss-fuzz, which makes sense. These harnesses cover the unfuzzed I/O format decoders (OBJ, PLY, STL) and animation decoder as a complement to the existing four .drc targets.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants