From 1f903913f77214c29ab938fca83071d7e8827bfe Mon Sep 17 00:00:00 2001 From: Kevin Ushey Date: Tue, 4 Aug 2026 12:16:37 -0700 Subject: [PATCH 1/6] r: add fuzzing targets for the R programming language Add R as an OSS-Fuzz project. The fuzz harnesses and build logic live in a separate repository (https://github.com/r-devel/r-oss-fuzz), cloned at build time, following the pattern used by the aspell project; projects/r/ is a thin bootstrap that checks out R and delegates the build. Targets: parse, unserialize (readRDS), grep (TRE/PCRE2), coerce, datetime, decompress (memDecompress), scan (read.table/csv), agrep. --- projects/r/Dockerfile | 38 ++++++++++++++++++++++++++++++++++++++ projects/r/build.sh | 21 +++++++++++++++++++++ projects/r/project.yaml | 9 +++++++++ 3 files changed, 68 insertions(+) create mode 100644 projects/r/Dockerfile create mode 100644 projects/r/build.sh create mode 100644 projects/r/project.yaml diff --git a/projects/r/Dockerfile b/projects/r/Dockerfile new file mode 100644 index 000000000000..81b187a4a6b0 --- /dev/null +++ b/projects/r/Dockerfile @@ -0,0 +1,38 @@ +# Copyright 2026 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +FROM gcr.io/oss-fuzz-base/base-builder + +RUN apt-get update && apt-get install -y \ + gfortran \ + libbz2-dev \ + libcurl4-openssl-dev \ + liblzma-dev \ + libpcre2-dev \ + libreadline-dev \ + subversion \ + texinfo \ + zlib1g-dev + +# R source: the canonical upstream is SVN trunk. +RUN svn checkout --depth=infinity https://svn.r-project.org/R/trunk $SRC/r-source + +# Fuzz harnesses and build logic are maintained separately by R-devel, so +# they can be updated without a google/oss-fuzz PR. +RUN git clone --depth 1 https://github.com/r-devel/r-oss-fuzz.git $SRC/r-oss-fuzz + +COPY build.sh $SRC/ +WORKDIR $SRC/r-source diff --git a/projects/r/build.sh b/projects/r/build.sh new file mode 100644 index 000000000000..79f0e5787648 --- /dev/null +++ b/projects/r/build.sh @@ -0,0 +1,21 @@ +#!/bin/bash -eu +# Copyright 2026 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +################################################################################ + +# The R fuzz targets and their build logic are maintained in a separate +# repository (https://github.com/r-devel/r-oss-fuzz), cloned into +# $SRC/r-oss-fuzz by the Dockerfile. Delegate the build to it. +exec "$SRC/r-oss-fuzz/ossfuzz.sh" diff --git a/projects/r/project.yaml b/projects/r/project.yaml new file mode 100644 index 000000000000..699ee03c07d0 --- /dev/null +++ b/projects/r/project.yaml @@ -0,0 +1,9 @@ +homepage: "https://www.r-project.org/" +language: c +primary_contact: "kevin@posit.co" +main_repo: "https://svn.r-project.org/R/trunk" +sanitizers: + - address + - undefined +fuzzing_engines: + - libfuzzer From 845c6cffad9642220cb49d128e015fc77cf9ab2e Mon Sep 17 00:00:00 2001 From: Kevin Ushey Date: Tue, 4 Aug 2026 13:12:35 -0700 Subject: [PATCH 2/6] r: also fuzz with afl++ --- projects/r/project.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/projects/r/project.yaml b/projects/r/project.yaml index 699ee03c07d0..3d19c7048556 100644 --- a/projects/r/project.yaml +++ b/projects/r/project.yaml @@ -7,3 +7,4 @@ sanitizers: - undefined fuzzing_engines: - libfuzzer + - afl From 7c1dfb5097b1d2328046619032d90471d93326c8 Mon Sep 17 00:00:00 2001 From: Kevin Ushey Date: Wed, 5 Aug 2026 10:03:17 -0700 Subject: [PATCH 3/6] r: add R core maintainers to auto_ccs --- projects/r/project.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/projects/r/project.yaml b/projects/r/project.yaml index 3d19c7048556..3cdb2830fa4e 100644 --- a/projects/r/project.yaml +++ b/projects/r/project.yaml @@ -1,6 +1,9 @@ homepage: "https://www.r-project.org/" language: c primary_contact: "kevin@posit.co" +auto_ccs: + - "simon.urbanek@r-project.org" + - "heather.turner@r-project.org" main_repo: "https://svn.r-project.org/R/trunk" sanitizers: - address From 1d543e045f1a0e3930b0ce9a33af164b9d7d8acf Mon Sep 17 00:00:00 2001 From: Kevin Ushey Date: Mon, 10 Aug 2026 17:41:54 -0700 Subject: [PATCH 4/6] r: hand primary contact to simon urbanek, cc r-core Contact structure agreed with R Core: an R Core member as primary contact, with the R-core list and the harness maintainer CCed. --- projects/r/project.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/projects/r/project.yaml b/projects/r/project.yaml index 3cdb2830fa4e..6ede961744b8 100644 --- a/projects/r/project.yaml +++ b/projects/r/project.yaml @@ -1,9 +1,9 @@ homepage: "https://www.r-project.org/" language: c -primary_contact: "kevin@posit.co" +primary_contact: "simon.urbanek@r-project.org" auto_ccs: - - "simon.urbanek@r-project.org" - - "heather.turner@r-project.org" + - "R-core@R-project.org" + - "kevin@posit.co" main_repo: "https://svn.r-project.org/R/trunk" sanitizers: - address From 4a176809407f92ec3715f0acfdb474003c7d31f2 Mon Sep 17 00:00:00 2001 From: Kevin Ushey Date: Mon, 10 Aug 2026 17:42:20 -0700 Subject: [PATCH 5/6] r: start with the address sanitizer only Keep the initial triage volume manageable: UBSan on a codebase of R's age produces many low-severity reports (signed overflow, alignment), each carrying a 90-day disclosure clock. Add undefined once triage of the initial targets has a rhythm. --- projects/r/project.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/projects/r/project.yaml b/projects/r/project.yaml index 6ede961744b8..06765b457939 100644 --- a/projects/r/project.yaml +++ b/projects/r/project.yaml @@ -7,7 +7,6 @@ auto_ccs: main_repo: "https://svn.r-project.org/R/trunk" sanitizers: - address - - undefined fuzzing_engines: - libfuzzer - afl From 8e3c934860edb751b3309a09c7cf14142ca94886 Mon Sep 17 00:00:00 2001 From: Kevin Ushey Date: Wed, 26 Aug 2026 09:32:16 -0700 Subject: [PATCH 6/6] use r-oss-fuzz in auto_ccs --- projects/r/project.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/r/project.yaml b/projects/r/project.yaml index 06765b457939..8f6e7a167f2e 100644 --- a/projects/r/project.yaml +++ b/projects/r/project.yaml @@ -2,7 +2,7 @@ homepage: "https://www.r-project.org/" language: c primary_contact: "simon.urbanek@r-project.org" auto_ccs: - - "R-core@R-project.org" + - "r-oss-fuzz@R-project.org" - "kevin@posit.co" main_repo: "https://svn.r-project.org/R/trunk" sanitizers: