# Oss Fuzz

Run Tika's OSS-Fuzz Jazzer targets locally against a working-tree checkout, build the...

- Repository: https://github.com/apache/tika (4119 stars)
- Category: Media
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add apache/tika --skill oss-fuzz -g -a claude-code -y`
Codex: `npx skills add apache/tika --skill oss-fuzz -g -a codex -y`
Cursor: `npx skills add apache/tika --skill oss-fuzz -g -a cursor -y`
Gemini CLI: `npx skills add apache/tika --skill oss-fuzz -g -a gemini-cli -y`

## Description

Run Tika's OSS-Fuzz Jazzer targets locally against a working-tree checkout, build the image, build fuzzers from local source, fuzz a target, run a corpus as a regression pass, reproduce a crash, and add seeds. Use for "fuzz the OneNote parser", "run OneNoteParserFuzzer against these files", "reproduce an OSS-Fuzz crash", "fuzz my branch before merge".

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements.  See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License.  You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->

Local override: `$TIKA_SKILLS_LOCAL/oss-fuzz/LOCAL.md` (default `~/.tika-skills`),
read after this file, wins on conflict.

# Tika OSS-Fuzz, local fuzzing

Tika is already in OSS-Fuzz as the **`apache-tika`** project (not `tika`).
It is Jazzer-based (coverage-guided, in-process JVM fuzzing), not the old
`tika-fuzzing` seed-mutation module (removed in TIKA-4506). The fuzz targets
and seed logic live in the **oss-fuzz** repo under
`projects/apache-tika/`, *not* in this repo:

- `project-parent/fuzz-targets/src/main/java/com/example/*Fuzzer.java`, one
  Jazzer target per parser family. Each calls `ParserFuzzer.parseOne(...)`
  (parse-from-bytes and parse-from-file) and swallows
  `TikaException | SAXException | IOException`; anything else, `Error`
  (OOM, StackOverflow), a hang, or an unexpected `RuntimeException`, is a
  finding.
- `build.sh`, builds `tika-app`, then the `fuzz-targets` module.
- `build_seeds.sh`, packs Tika's own unit-test files into
  `<Target>_seed_corpus.zip` by file extension.

The rest: https://github.com/apache/tika/blob/HEAD/.skills/devs/oss-fuzz/SKILL.md