Library fuzzing using OSS Fuzz

[brian-r-calder]

Background

There is a lot of code in the BAG library, and therefore a significant risk of memory holes or other security issues. This might also reflect issues in underlying libraries including HDF5. One way to find such issues is to use fuzzing techniques. The BAG library has been accepted for testing via Google OSS-Fuzz.

Actions

1. Brief on the current setup for OSS-Fuzz testing, and opportunities.
2. Collect concerns or other suggestions for better automated testing.

[brian-r-calder]

This was not discussed at the CHC'24 WG meeting, and is therefore bound over for the next meeting.

[selimnairb]

Agenda item to provide a status update on fuzz testing efforts at ONWSG meeting at US HYDRO 2025.