2 ms·
That seems to be largely grasped at straws and connecting dots without reason. For example oss-fuzz was building xz by cloning the github repo directly. There
by ihsoy 3y ago
That seems to be largely grasped at straws and connecting dots without reason.
For example oss-fuzz was building xz by cloning the github repo directly. There was never a chance for oss-fuzz to discover the backdoor, because only the tarball had it, not the repo itself. So that oss-fuzz PR might genuinely just be a genuine thing unrelated to the backdoor.
- sp332 3y agoThe ifunc part looked more legitimate, it was used to switch between optimized implementations of CRC. So that part was in the git repo. https://github.com/google/oss-fuzz/pull/10667 https://github.com/google/oss-fuzz/pull/10667