Add CLI11 to OSS-Fuzz (CLI parsing fuzzer) by TheodorNEngoy · Pull Request #14131 · google/oss-fuzz

TheodorNEngoy · 2025-10-14T17:58:45Z

Integrates https://github.com/CLIUtils/CLI11 into OSS-Fuzz with a libFuzzer harness. Per acceptance policy, a project committer using a Google account must be added as in project.yaml for access to ClusterFuzz reports. Maintainers: please reply with the email to add.

Docs: Accepting new projects & New project guide.

google-cla · 2025-10-14T17:58:51Z

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

github-actions · 2025-10-14T17:59:54Z

TheodorNEngoy is integrating a new project:
- Main repo: https://github.com/CLIUtils/CLI11
- Criticality score: 0.48704

TheodorNEngoy · 2025-10-14T19:13:57Z

First-time contributor — please approve Actions workflows so CI can run. Thanks!

phlptp · 2025-10-14T19:22:41Z

@TheodorNEngoy I have been thinking about this for a while, so I should be listed as the project contributor on this form. I would suggest however using the fuzz test that is in the repo already, that is the one we have building up over the last year to really test out CLI11 for fuzzing. I think it is getting close to ready for OSS-Fuzz. cli11_app_fuzz.cpp is the primary applications using the fuzzer, then it could be built using CMAKE and maintained as part of the regular repo. If it made sense I could also supply an existing corpus from the more extensive testing I have done locally on the fuzz applications. very happy to have someone else interested in getting this in OSS-Fuzz!

TheodorNEngoy · 2025-10-14T19:32:50Z

I signed it!

TheodorNEngoy · 2025-10-14T19:38:03Z

@googlebot I signed it!

TheodorNEngoy · 2025-10-14T19:38:07Z

First-time contributor — please approve Actions workflows so CI can run. Thanks!

TheodorNEngoy · 2025-10-14T19:44:44Z

Ready for review: local build+run completed successfully (ASan/libFuzzer). Please approve Actions so presubmit builds run, and let us know a committer’s Google‑account email to set as primary_contact.

TheodorNEngoy · 2025-10-14T19:54:10Z

Local helper flow succeeded (build_image → build_fuzzers → run_fuzzer -max_total_time=30). All presubmit prechecks are green. Please approve Actions to run the build matrix and review. We will set primary_contact once a CLI11 committer provides a Google‑account email.

TheodorNEngoy · 2025-10-14T20:11:43Z

Upstream CIFuzz PR opened: CLIUtils/CLI11#1225

TheodorNEngoy · 2025-10-14T20:17:04Z

Local UBSan build+run succeeded (libFuzzer, -runs=1000).

TheodorNEngoy · 2025-10-14T20:17:13Z

First-time contributor — please approve Actions so the build matrix can run. Thanks!

TheodorNEngoy · 2025-10-14T20:17:26Z

Upstream CIFuzz PR: CLIUtils/CLI11#1225

TheodorNEngoy · 2025-10-14T20:38:24Z

Enabled i386 in project.yaml and validated locally (ASan/libFuzzer, -runs=1000).

TheodorNEngoy · 2025-10-14T20:48:53Z

Switched to upstream fuzz harness (cli11_app_fuzz.cpp + fuzzApp.cpp) and packaged CLI11 dictionaries; local ASan build+run OK. @phlptp thanks for the pointer — happy to set you as primary_contact once you share a Google‑account email.

phlptp · 2025-10-14T21:00:41Z

@TheodorNEngoy use phlptp@gmail.com as the google account email, my github account is associated with that address.

TheodorNEngoy · 2025-10-14T21:15:00Z

Set primary_contact: phlptp@gmail.com (project committer). Ready for presubmit once Actions are approved. Thanks!

TheodorNEngoy · 2025-10-14T22:11:31Z

Enabled AFL & Honggfuzz in project.yaml and verified local ASan builds; libFuzzer/AFL/Honggfuzz smoke runs OK. primary_contact is set to phlptp@gmail.com; ready for presubmit once Actions are approved.

TheodorNEngoy · 2025-10-14T22:22:11Z

Enabled AFL & Honggfuzz in project.yaml; local libFuzzer ASan build + check_build passed. primary_contact is set to phlptp@gmail.com. Ready for presubmit once Actions are approved.

TheodorNEngoy · 2025-10-14T22:45:01Z

Local check_build now passes for: libFuzzer (ASan x86_64 + i386, UBSan x86_64), AFL (ASan), and Honggfuzz (ASan). primary_contact is set to phlptp@gmail.com. Ready for presubmit once Actions are approved.

TheodorNEngoy · 2025-10-15T00:59:26Z

Temporarily disabling AFL to get presubmit green (AFL dry-run treats minimal seeds as crashes). libFuzzer + Honggfuzz builds & check_build pass locally. We'll follow up with an AFL-friendly harness/seed.

TheodorNEngoy · 2025-10-15T01:32:30Z

libFuzzer + Honggfuzz pass local check_build. AFL is temporarily disabled to avoid dry‑run issues. primary_contact is set to phlptp@gmail.com. Please approve GitHub Actions and review. Thanks!

TheodorNEngoy · 2025-10-15T01:45:24Z

libFuzzer + Honggfuzz pass local check_build. AFL is disabled for now. primary_contact is set to phlptp@gmail.com (Google account). Please review/approve when ready.

TheodorNEngoy · 2025-10-15T20:31:59Z

Status: libFuzzer + Honggfuzz build & check_build pass locally; AFL is disabled for now. CIFuzz on CLI11 is set to dry-run until this PR merges. Ready for review.

phlptp · 2025-10-17T11:37:15Z

projects/cli11/build.sh

+  -o "$OUT/cli11_app_fuzzer" $LIB_FUZZING_ENGINE ${LDFLAGS:-}
+
+# --- Package dictionary (if present) ---
+if [[ -f "$SRC/cli11/fuzz/fuzz_dictionary1.txt" ]]; then


The fuzz_dictionary2 file is meant for the file_fuzzer, it probably isn't that useful to concatenate them. For the app fuzzer just fuzz_dictionary1 should be used.

TheodorNEngoy · 2025-10-17T12:23:30Z

Updated build.sh: cli11_app_fuzzer now packages only fuzz_dictionary1.txt (per maintainer feedback; fuzz_dictionary2.txt is for the file fuzzer). Ready for another look.

…aries

…uzzer/HF

…p libFuzzer + Honggfuzz

…per maintainer feedback)

TheodorNEngoy · 2025-10-18T20:02:49Z

Status: Upstream CIFuzz is merged (CLIUtils/CLI11#1225). CLI11’s workflow is in dry‑run (safe) until this PR lands. Locally verified: libFuzzer + Honggfuzz pass ; AFL is disabled. Please approve presubmit workflows. Thanks!

TheodorNEngoy · 2025-10-18T20:10:12Z

Status: Upstream CIFuzz is merged (CLIUtils/CLI11#1225). CLI11’s workflow is in dry-run (safe) until this PR lands. Locally verified: libFuzzer + Honggfuzz pass infra/helper.py check_build; AFL is disabled. Please approve presubmit workflows. Thanks!

TheodorNEngoy · 2025-10-18T20:13:01Z

CI note: This PR comes from a fork. Please click Approve and run on the pending GitHub Actions checks so presubmit can execute. Thanks!
(Reference: GitHub Docs – Approving workflow runs from public forks)

TheodorNEngoy · 2025-10-18T20:46:24Z

First-time fork: please click Approve and run on the pending GitHub Actions checks so presubmit can execute. Thanks!

Flip CIFuzz out of dry‑run now that cli11 exists in OSS‑Fuzz. --------- Co-authored-by: TheodorNEngoy <[email protected]>

jonathanmetzman · 2025-12-15T16:31:14Z

Can you share who are some of the important users of this project?

phlptp · 2026-01-17T15:11:33Z

I lack insight into all the users. There are 4000+ stars on github. I know we use it in several applications for the Department of Energy and have been contacted by other Government applications for review to include it their applications. It is included in several C++ packaging repositories. And does get used in High performance computing applications which is some of the original applications.

jonathanmetzman · 2026-01-18T19:11:32Z

I lack insight into all the users. There are 4000+ stars on github. I know we use it in several applications for the Department of Energy and have been contacted by other Government applications for review to include it their applications. It is included in several C++ packaging repositories. And does get used in High performance computing applications which is some of the original applications.

Department of energy is important enough for us :-)

phlptp · 2026-01-19T15:32:13Z

projects/cli11/Dockerfile

@@ -0,0 +1,19 @@
+# Copyright 2025 Google LLC


phlptp · 2026-01-19T15:32:27Z

projects/cli11/build.sh

@@ -0,0 +1,30 @@
+#!/bin/bash -eu
+# Copyright 2025 Google LLC


TheodorNEngoy mentioned this pull request Oct 14, 2025

Proposing OSS-Fuzz integration (needs primary_contact Google-account email) CLIUtils/CLI11#1224

Open

TheodorNEngoy force-pushed the add-cli11 branch from 760e254 to 87786eb Compare October 14, 2025 18:49

TheodorNEngoy force-pushed the add-cli11 branch from ff4638c to e5f23c9 Compare October 14, 2025 19:32

TheodorNEngoy mentioned this pull request Oct 14, 2025

ci: add CIFuzz CLIUtils/CLI11#1225

Merged

phlptp reviewed Oct 17, 2025

View reviewed changes

TheodorNEngoy added 12 commits October 18, 2025 22:02

trigger CLA recheck

562fd85

cli11: add maintainer to auto_ccs

895c7aa

cli11: enable i386 builds

e7b3e81

cli11: use upstream fuzz harness (cli11_app_fuzz) and package diction…

f7e089e

…aries

cli11: honor $LIB_FUZZING_ENGINE in build.sh

857bba3

cli11: set primary_contact to phlptp@gmail.com

042a0e0

cli11: enable AFL & Honggfuzz engines

78998b4

cli11: add non-crashing seeds; flatten seed zip for AFL++

233ed01

cli11: ship seeds as zip + plain dir (make AFL check_build happy)

8ceffc8

cli11: rebuild upstream harness; ship seeds as zip + dir for AFL/libF…

9c78aa8

…uzzer/HF

cli11: temporarily disable AFL (dry-run treats seeds as crashes); kee…

758303c

…p libFuzzer + Honggfuzz

cli11: app fuzzer should use only fuzz_dictionary1 (drop dictionary2 …

ea72da3

…per maintainer feedback)

TheodorNEngoy force-pushed the add-cli11 branch from e1205be to ea72da3 Compare October 18, 2025 20:02

TheodorNEngoy pushed a commit to TheodorNEngoy/CLI11 that referenced this pull request Oct 18, 2025

ci(cifuzz): keep dry-run until google/oss-fuzz#14131 merges

b8cdc30

TheodorNEngoy pushed a commit to TheodorNEngoy/CLI11 that referenced this pull request Oct 18, 2025

ci(cifuzz): keep dry-run until google/oss-fuzz#14131 merges

c2d787d

phlptp pushed a commit to CLIUtils/CLI11 that referenced this pull request Oct 19, 2025

ci(cifuzz): keep dry-run until google/oss-fuzz#14131 merges (#1232)

8225a6a

Flip CIFuzz out of dry‑run now that cli11 exists in OSS‑Fuzz. --------- Co-authored-by: TheodorNEngoy <[email protected]>

phlptp mentioned this pull request Oct 19, 2025

ci(cifuzz): enable real fuzzing (remove dry-run) CLIUtils/CLI11#1233

Open

Merge branch 'master' into add-cli11

edab7cb

jonathanmetzman closed this Jan 18, 2026

jonathanmetzman reopened this Jan 18, 2026

Merge branch 'master' into add-cli11

3dfc301

phlptp reviewed Jan 19, 2026

View reviewed changes

Conversation

TheodorNEngoy commented Oct 14, 2025

Uh oh!

google-cla bot commented Oct 14, 2025

Uh oh!

github-actions bot commented Oct 14, 2025

Uh oh!

TheodorNEngoy commented Oct 14, 2025

Uh oh!

phlptp commented Oct 14, 2025

Uh oh!

TheodorNEngoy commented Oct 14, 2025

Uh oh!

TheodorNEngoy commented Oct 14, 2025

Uh oh!

TheodorNEngoy commented Oct 14, 2025

Uh oh!

TheodorNEngoy commented Oct 14, 2025

Uh oh!

TheodorNEngoy commented Oct 14, 2025

Uh oh!

TheodorNEngoy commented Oct 14, 2025

Uh oh!

TheodorNEngoy commented Oct 14, 2025

Uh oh!

TheodorNEngoy commented Oct 14, 2025

Uh oh!

TheodorNEngoy commented Oct 14, 2025

Uh oh!

TheodorNEngoy commented Oct 14, 2025

Uh oh!

TheodorNEngoy commented Oct 14, 2025

Uh oh!

phlptp commented Oct 14, 2025

Uh oh!

TheodorNEngoy commented Oct 14, 2025

Uh oh!

TheodorNEngoy commented Oct 14, 2025

Uh oh!

TheodorNEngoy commented Oct 14, 2025

Uh oh!

TheodorNEngoy commented Oct 14, 2025

Uh oh!

TheodorNEngoy commented Oct 15, 2025

Uh oh!

TheodorNEngoy commented Oct 15, 2025

Uh oh!

TheodorNEngoy commented Oct 15, 2025

Uh oh!

TheodorNEngoy commented Oct 15, 2025

Uh oh!

phlptp Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

TheodorNEngoy commented Oct 17, 2025

Uh oh!

TheodorNEngoy commented Oct 18, 2025

Uh oh!

TheodorNEngoy commented Oct 18, 2025

Uh oh!

TheodorNEngoy commented Oct 18, 2025

Uh oh!

TheodorNEngoy commented Oct 18, 2025

Uh oh!

jonathanmetzman commented Dec 15, 2025

Uh oh!

phlptp commented Jan 17, 2026

Uh oh!

jonathanmetzman commented Jan 18, 2026

Uh oh!

phlptp Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

phlptp Jan 19, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects