[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150307133043.GA16656@openwall.com>
Date: Sat, 7 Mar 2015 16:30:43 +0300
From: Solar Designer <solar@...nwall.com>
To: john-dev@...ts.openwall.com
Subject: Re: Any advice on how to fuzz john jumbo by AFL
On Sat, Mar 07, 2015 at 09:22:30PM +0800, Kai Zhao wrote:
> john jumbo is robust
I wish this were the case, but it definitely is not.
I'd like Alexander Cherepanov to comment on this, as he'd need to
(co-)mentor this project. His custom fuzzer was spewing bugs in jumbo
before, and there's no indication we ran out of those - in fact, we
certainly introduced new bugs since then.
I might comment as well, at a later time and if still needed.
The really brief comment from me, though, is that fuzzing must not be
the only method to find bugs in jumbo. For example, integer overflow on
"+ 1" might take lots of time to fuzz, but is apparent at first glance.
We're not going to accept a student who proposes only fuzzing or only
code reviews. It must be both.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
