From 1c7e8392b4abc918397f1e6e939d83f5d44dde27 Mon Sep 17 00:00:00 2001 From: OSS-Fuzz Team Date: Tue, 29 Sep 2026 03:52:42 -0700 Subject: [PATCH 1/2] Add `strict_flag_check` to `CommandLineBinaryConfig` in `manifest.json`. PiperOrigin-RevId: 990201833 --- infra/base-images/base-builder/indexer/manifest_types.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/infra/base-images/base-builder/indexer/manifest_types.py b/infra/base-images/base-builder/indexer/manifest_types.py index 664d4dc01ee5..08fbb6118bcf 100644 --- a/infra/base-images/base-builder/indexer/manifest_types.py +++ b/infra/base-images/base-builder/indexer/manifest_types.py @@ -196,6 +196,10 @@ class CommandLineBinaryConfig(BinaryConfig): # are directly linked into the target binary. Should usually be true but # some targets like V8 require this to be false, see b/433718862. filter_compile_commands: bool = True + # Whether to enforce a strict flag allowlist for custom flags specified via + # `// Flags:` comments (when harness_kind is JS). Mostly needed for historic + # V8 builds that lack flag hardening (e.g. `--disallow-unsafe-flags`). + strict_flag_check: bool = False @property def uses_stdin(self) -> bool: @@ -220,6 +224,7 @@ def from_dict(cls, config_dict: Mapping[str, Any]) -> Self: filter_compile_commands=config_dict.get( "filter_compile_commands", True ), + strict_flag_check=config_dict.get("strict_flag_check", False), ) From 315cfa685a46e15ffb85da3f215d583a64185e91 Mon Sep 17 00:00:00 2001 From: Arthur Chan Date: Tue, 29 Sep 2026 20:41:25 +0800 Subject: [PATCH 2/2] knot-dns: Update build.sh to accommodate new fuzzer (#16179) This PR updates the build.sh for project knot-dns to accommodate new fuzzer add in https://gitlab.nic.cz/knot/knot-dns/-/merge_requests/1915. Signed-off-by: Arthur Chan --- projects/knot-dns/build.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/projects/knot-dns/build.sh b/projects/knot-dns/build.sh index e01593ebc46f..cd97d184722c 100755 --- a/projects/knot-dns/build.sh +++ b/projects/knot-dns/build.sh @@ -67,7 +67,7 @@ autoreconf -if make -j$(nproc) cd $SRC/knot-dns/tests-fuzz make check -/bin/bash ../libtool --mode=install /usr/bin/install -c fuzz_packet fuzz_zscanner fuzz_dname_to_str fuzz_dname_from_str "$OUT" +/bin/bash ../libtool --mode=install /usr/bin/install -c fuzz_packet fuzz_zscanner fuzz_dname_to_str fuzz_dname_from_str fuzz_dnssec_verify "$OUT" # Set up fuzzing seeds