Experiment Request: The Things That Count

benchmarks/libjpeg-turbo_libjpeg_turbo_fuzzer/Dockerfile

@@ -19,11 +19,8 @@ FROM gcr.io/oss-fuzz-base/base-builder@sha256:87ca1e9e19235e731fac8de8d1892ebe8d
 RUN apt-get update && \
     apt-get install -y make yasm cmake
 
-RUN git clone https://github.com/libjpeg-turbo/fuzz && \
-    cat fuzz/branches.txt | while read branch; do \
-      git clone https://github.com/libjpeg-turbo/libjpeg-turbo \
-          -b $branch libjpeg-turbo.$branch; \
-    done
+RUN git clone https://github.com/libjpeg-turbo/libjpeg-turbo libjpeg-turbo && \
+    git -C libjpeg-turbo checkout 3b19db4e6e7493a748369974819b4c5fa84c7614
 
 RUN git clone https://github.com/libjpeg-turbo/seed-corpora && \
     git -C seed-corpora checkout 7c9ea5ffaac76ef618657978c9fdfa845d310b93

benchmarks/libjpeg-turbo_libjpeg_turbo_fuzzer/build.sh

@@ -16,12 +16,5 @@
 set -e
 set -u
 
-cat fuzz/branches.txt | while read branch; do
-    pushd libjpeg-turbo.$branch
-    if [ "$branch" = "main" ]; then
-        sh fuzz/build.sh
-    else
-        sh fuzz/build.sh _$branch
-    fi
-    popd
-done
+cd $SRC/libjpeg-turbo
+sh fuzz/build.sh

benchmarks/libpng_libpng_read_fuzzer/Dockerfile

@@ -30,10 +30,11 @@ RUN git clone \
         https://github.com/madler/zlib.git
 
 RUN git clone \
-        https://github.com/glennrp/libpng.git
-RUN cp libpng/contrib/oss-fuzz/build.sh $SRC
+        https://github.com/pnggroup/libpng.git $SRC/libpng && \
+    git -C $SRC/libpng checkout cd0ea2a7f53b603d3d9b5b891c779c430047b39a
+RUN cp $SRC/libpng/contrib/oss-fuzz/build.sh $SRC
 
-WORKDIR libpng
+WORKDIR $SRC/libpng
 
 RUN wget --no-check-certificate -qO $OUT/libpng_read_fuzzer.dict \
     https://raw.githubusercontent.com/google/fuzzing/master/dictionaries/png.dict

benchmarks/proj4_proj_crs_to_crs_fuzzer/Dockerfile

@@ -31,6 +31,12 @@ RUN git clone https://gitlab.com/libtiff/libtiff.git PROJ/libtiff && \
 WORKDIR PROJ
 
 COPY third_party/build.sh $SRC/
+
+# Avoid build failures due to unstable https://git.savannah.gnu.org/
+COPY third_party/config.sub $SRC/
+COPY third_party/config.guess $SRC/
+COPY third_party/autogen.sh.patch $SRC/
+
 # This is to fix Fuzz Introspector build by using LLVM old pass manager
 # re https://github.com/ossf/fuzz-introspector/issues/305
 ENV OLD_LLVMPASS 1

benchmarks/proj4_proj_crs_to_crs_fuzzer/third_party/autogen.sh.patch

@@ -0,0 +1,21 @@
+diff --git a/autogen.sh b/autogen.sh
+index f63dc11d..0d1fd5f8 100644
+--- a/autogen.sh
++++ b/autogen.sh
+@@ -12,16 +12,3 @@ aclocal -I ./m4
+ autoheader
+ automake --foreign --add-missing --copy
+ autoconf
+-# Get latest config.guess and config.sub from upstream master since
+-# these are often out of date.
+-for file in config.guess config.sub
+-do
+-    echo "$0: getting $file..."
+-    wget -q --timeout=5 -O config/$file.tmp \
+-      "https://git.savannah.gnu.org/cgit/config.git/plain/${file}" \
+-      && mv -f config/$file.tmp config/$file \
+-      && chmod a+x config/$file
+-    retval=$?
+-    rm -f config/$file.tmp
+-    test $retval -eq 0 || exit $retval
+-done

benchmarks/proj4_proj_crs_to_crs_fuzzer/third_party/build.sh

@@ -44,7 +44,15 @@ cd ..
 
 # build libtiff.a
 cd libtiff
+
+# Don't try to download from unstable https://git.savannah.gnu.org/
+git apply $SRC/autogen.sh.patch
 ./autogen.sh
+
+# Use static config files, as we should do anyway
+cp $SRC/config.sub config/config.sub
+cp $SRC/config.guess config/config.guess
+
 ./configure --disable-shared --prefix=$SRC/install
 make -j$(nproc)
 make install