Replying to this email means your email address will be shared with the team that works on this product. https://issues.oss-fuzz.com/issues/481932457
Changed [email protected] added comment #15:
It looks like I conflated two separate concerns here.
Sadly, I am often guilty of the same thing. Too many issues, all mostly similar, and trying to get it done quickly. So, no big deal.
Opening up issues once a patch is made public (e.g. merged upstream) has
been OSS-Fuzz's default disclosure policy since inception (and is handled by our automation). Yeah, blame it on the computer.
Also, I wanted to clarify: while the issue text is made public, detailed
information such as full stacktraces (i.e.the oss-fuzz.com links) or PoCs are NOT made public. That was unclear. It helps.
Is there a documented embargo policy for gpsd for us to look at?
No. We are always at the mercy of the reporter.
There's generally not much more information you can
gain from the issue being made public that you can't already get from a publicly merged patch. I disagree. I'm sure Black Hats follow OSS Fuzz issues closely. Not so much gpsd issues. And the gpsd commits reference the issue, but do not specify how bad it is.
If there are still concerns with this approach here, please let me know
90 days should mean 90 days. That give me a chance to cut a nice release, and then for distros to pick it up, before the0-days show up. 1 day is not enough enough time for me to warn distros that an urgent patch is needed. And they'll hate me when I tell them that several times in a few weeks. I'd really like another 60 days for you to find what you are going to find, then I can vut a nice release, and deal with the blowback just one time. OTOH, I certainly do want these things fixed, however it gets done. _______________________________ Reference Info: 481932457 gpsd:FuzzDrivers: Crash in gpsd_poll component: Public Trackers > 1362134 > OSS Fuzz status: Verified reporter: [email protected] assignee: [email protected] verifier: [email protected] cc: [email protected], [email protected], [email protected], and 3 more collaborators: [email protected] type: Vulnerability access level: Default access priority: P2 severity: S2 hotlist: ClusterFuzz-Verified, Reproducible, Stability-Memory-MemorySanitizer retention: Component default Disclosure: May 6, 2026 Project: gpsd Reported: Feb 5, 2026 Generated by Google IssueTracker notification system.
