Fuzzing open source projects with OSS-Fuzz

They use libfuzzer (also mainly developed by people from Google).

A couple. Mostly libfuzzer and HongFuzz. You can tune or skip them with an ini file

Typically there's a report with a repro test case and an indication of the stack trace where it happened.

My experience is that it's generally pretty easy to nail down what's going on (assuming experience with the code base) unless it's something subtle with library dependency versions where it's not showing up under valgrind, only in their tool, in their docker container.

I wasn't involved in the work mentioned in the post, but I worked on integrating QEMU into oss-fuzz. Here's an example of a report from oss-fuzz, that we get by email: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29225 This lets us download the test-case and reproduce the bug, locally.

Internally, we convert this test-case into something that can be used with an unmodified build of qemu, for developers unfamiliar with oss-fuzz, and post it to our own issue tracker: https://gitlab.com/qemu-project/qemu/-/issues/450