Skip to content

raylib#15345

Open
Sheri98 wants to merge 2 commits intogoogle:masterfrom
Sheri98:add-raylib
Open

raylib#15345
Sheri98 wants to merge 2 commits intogoogle:masterfrom
Sheri98:add-raylib

Conversation

@Sheri98
Copy link
Copy Markdown

@Sheri98 Sheri98 commented Apr 12, 2026

Summary

  • Add libFuzzer harness for raylib, a C game development library (~23K stars)
  • Targets model file parsers: OBJ, IQM, GLTF, VOX, M3D — all reachable via LoadModel()
  • GPU/windowing functions stubbed for headless fuzzing (no X11/OpenGL needed)
  • Initial fuzzing already found 2 novel heap-buffer-overflow vulnerabilities (IQM + VOX parsers, reported upstream)
  • Includes seed corpus for all 5 formats + format-aware dictionary
  • Sanitizers: ASan + UBSan
  • Engines: libFuzzer, AFL, honggfuzz

Test plan

  • CLA check passes
  • Container build succeeds for all sanitizer/engine combinations
  • Harness reaches model parsing code paths

raylib is a C game development library (~23K stars) with built-in
model file parsers for OBJ, IQM, GLTF, VOX, and M3D formats. All
parsers process untrusted input when users load model files in games,
modding tools, and asset pipelines.

This adds a libFuzzer harness targeting raylib's model loading
dispatch (LoadModel → LoadOBJ/LoadIQM/LoadGLTF/LoadVOX/LoadM3D)
with GPU/windowing stubs for headless fuzzing.

Sanitizers: ASan + UBSan. Engines: libFuzzer, AFL, honggfuzz.
@github-actions
Copy link
Copy Markdown

Sheri98 is integrating a new project:
- Main repo: https://github.com/raysan5/raylib.git
- Criticality score: 0.59351

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant