Skip to content

fix: update pathspec to 1.0.0 and add librt to resolve ClusterFuzzLite failure (fixes #2167)#2835

Merged
sydseter merged 2 commits intoOWASP:masterfrom
Adarshkumar0509:fix/pathspec-dependency-conflict
Apr 18, 2026
Merged

fix: update pathspec to 1.0.0 and add librt to resolve ClusterFuzzLite failure (fixes #2167)#2835
sydseter merged 2 commits intoOWASP:masterfrom
Adarshkumar0509:fix/pathspec-dependency-conflict

Conversation

@Adarshkumar0509
Copy link
Copy Markdown
Contributor

@Adarshkumar0509 Adarshkumar0509 commented Apr 18, 2026

Resolved or fixed issue: #2167

Problem

  • Two issues were causing ClusterFuzzLite to fail:
    pathspec==0.12.1 conflicts with mypy==1.20.0 which requires pathspec>=1.0.0
    mypy==1.20.0 requires librt>=0.8.0 which was not pinned with a hash in --require-hashes mode
    The fuzzer capec_map_enricher_fuzzer.py was crashing because enricher.main() calls sys.exit(1) on failure, which atheris treats as a crash signal — SystemExit was not being caught

Changes

  • Updated pathspec from 0.12.1 to 1.0.0 with correct hash
  • Added librt==0.9.0 with correct hash for Linux cp311
  • Refactored capec_map_enricher_fuzzer.py to properly catch SystemExit in _run_enricher_main, preventing atheris from treating expected script exits as crashes

Testing

  • Verified locally with oss-fuzz Docker — all 3 fuzzers built successfully
  • Black and flake8 pass with no errors
  • Fuzzer complexity ≤ 10 per function

AI Tool Disclosure

AI Usage
Used AI assistance for understanding the approach all the things done manually. No AI-generated noise or unnecessary comments are present.

Affirmation

@Adarshkumar0509
Copy link
Copy Markdown
Contributor Author

hii @sydseter sir,can you take a look at this?

@sydseter
Copy link
Copy Markdown
Collaborator

@Adarshkumar0509 Thank you. That‘s great!

@sydseter sydseter merged commit 2d484b7 into OWASP:master Apr 18, 2026
11 of 12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants