OSS-Fuzz Integration

[ennamarie19]

My name is McKenna Dallmeyer and I would like to submit librosa to OSS-Fuzz. If you are not familiar with the project, OSS-Fuzz is Google's platform for continuous fuzzing of Open Source Software. In order to get the most out of this program, it would be greatly beneficial to be able to merge-in my fuzz harness and build scripts into the upstream repository and contribute bug fixes if they come up. Is this something that you would support me putting the effort into?

Thank you!

[bmcfee]

Sure, seems like a worthwhile endeavor. Thanks!

We may need to be a bit strategic about prioritizing which functions to test though. The package is entirely Python (no c/cython extensions), but we do use make extensive use of numba, numpy stride tricks, and ufunc/vectorization. I expect these might require a bit of care to cook up proper tests.

The main other place where fuzzing is probably useful is the io wrappers for audioread and soundfile. Those would probably be worth testing independently as well. Sample rate conversion (soxr, libsamplerate) would also be worth digging into.