Skip to content

Add libmobi fuzzing integration#15449

Open
S3DFX-CYBER wants to merge 13 commits intogoogle:masterfrom
S3DFX-CYBER:master
Open

Add libmobi fuzzing integration#15449
S3DFX-CYBER wants to merge 13 commits intogoogle:masterfrom
S3DFX-CYBER:master

Conversation

@S3DFX-CYBER
Copy link
Copy Markdown

@S3DFX-CYBER S3DFX-CYBER commented May 1, 2026

libmobi is a C library for
reading, writing, and converting MOBI/KF8/KF7 ebook files. It is used
by widely deployed tools including Calibre and KOReader to process
user-supplied ebook files, making it a meaningful target for malformed
input fuzzing.

Fuzz Targets

Target Surface covered
fuzz_load mobi_load_file() — PalmDB header, record list, MOBI/EXTH header parsing
fuzz_parse_rawml Full two-phase pipeline — HTML reconstruction, CSS parsing, OPF generation, resource extraction
fuzz_huffman Huffman-CDIC decompression path via full document load

Build System

autotools (./autogen.sh + ./configure + make)
Static library build with --disable-shared --enable-static

Local Testing

All three fuzz targets were built and run locally using the OSS-Fuzz
helper before submission:
python3 infra/helper.py build_image libmobi ✓
python3 infra/helper.py build_fuzzers libmobi ✓
python3 infra/helper.py run_fuzzer libmobi fuzz_load ✓
python3 infra/helper.py run_fuzzer libmobi fuzz_parse_rawml ✓
python3 infra/helper.py run_fuzzer libmobi fuzz_huffman ✓

Tested with FUZZING_ENGINE=libfuzzer and SANITIZER=address on
linux/amd64.

Why libmobi qualifies

  • Parses untrusted binary input (MOBI/KF8 ebook files) from
    user-supplied sources
  • C codebase — high value for memory safety fuzzing
  • Prior CVEs found via fuzzing (CVE-2022-1533, CVE-2022-1534) confirm
    real bug surface exists
  • Used downstream by Calibre (20M+ downloads) and KOReader

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 1, 2026

S3DFX-CYBER is integrating a new project:
- Main repo: https://github.com/bfabiszewski/libmobi.git
- Criticality score: 0.28204

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant