Gary, are you familiar with how Firefox is configured to fuzz? Or who does?

I think Thunderbird shares platform code common to both, so fuzzing those that are also in Firefox, should end up as duplicated work and would probably not be a wise initial decision.

What should be focused on are those mail-specific - things like MIME stuff come to mind. With that said, I'd probably agree that Magnus is the right person to think about this. Moving needinfo? to him.

Here's some tips - having a shell specific to that region of code to test would probably be best. With JS, there's the JS shell, and I believe there is a media shell for testing media code. We could have shells for mail-specific code.

Also, a (long) while ago, I wrote a mail fuzzer (bug 465797) then fed its input into Thunderbird, that could be a way forward. Detecting crashes and assertion failures in a debug build would be a good first start. (I found a Terminal.app bug using this, which was an interesting experience)

Sure, but what commands (etc.) do you run to fuzz Firefox?

It depends on what fuzzers you want to run, and which parts of code to test.

Our fuzzers are mostly here in this namespace: https://github.com/MozillaSecurity/

Christoph (passing the baton to him) may know what fuzzing frameworks you can use to test mail-related code.

There are some possible options coming to mind.

If you really want to run this in OSS-Fuzz then a LibFuzzer implementation is required and probably as a stand-alone executable. They do have a Firefox target running with LibFuzzer integration but I am unsure right now in what state this is at OSS-Fuzz.

What we use in our own cluster is a LibFuzzer fuzzing interface, this is defined here.

The other option would be to write a grammar with Dharma which we then can hook up into our fuzzing cluster.

Firefox still does this

from choller "yes, we are still running some Firefox targets in oss-fuzz. However, we are considering moving some of them back to our own fuzzing infrastructure, in particular those that require a full Firefox build, and leave only the third party stuff to be tested there. The problem we are facing is that we can't use our own CI builds in oss-fuzz and maintaining the full build process in oss-fuzz is time-consuming."