[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20140619150713.GN179@brightrain.aerifal.cx>
Date: Thu, 19 Jun 2014 11:07:13 -0400
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Subject: Re: is there a fuzzer for libc? (fwd)
Looks interesting.
----- Forwarded message from Konstantin Serebryany <konstantin.s.serebryany@...il.com> -----
In-Reply-To: <20140603183434.GK507@...ghtrain.aerifal.cx>
From: Konstantin Serebryany <konstantin.s.serebryany@...il.com>
Date: Thu, 19 Jun 2014 11:53:51 +0400
Message-ID: <CAGQ9bdwNm+OgzKikSD+yvf8BxavEO=UBkNM8quPYpXsh3qZTfw@...l.gmail.com>
Subject: Re: is there a fuzzer for libc?
To: Rich Felker <dalias@...c.org>
Cc: Siddhesh Poyarekar <siddhesh.poyarekar@...il.com>, GNU C Library <libc-alpha@...rceware.org>
Quick update: I found regfuzz, a fuzzer for regular expressions.
https://code.google.com/p/regfuzz/
A short run revealed a least 3 somewhat scary situations in regcomp:
infinite loop, quick memory exhaustion and a memory leak:
I've submitted two bugs so far; if they are considered interesting and
get fixed I can file more :)
https://sourceware.org/bugzilla/show_bug.cgi?id=17069
https://sourceware.org/bugzilla/show_bug.cgi?id=17070
I also wrote a naive fuzzer for wildcards and it found a buffer
overflow in fnmatch:
https://sourceware.org/bugzilla/show_bug.cgi?id=17062 (already fixed).
--kcc
On Tue, Jun 3, 2014 at 10:34 PM, Rich Felker <dalias@...c.org> wrote:
> On Tue, Jun 03, 2014 at 11:00:44AM +0400, Konstantin Serebryany wrote:
>> Thanks for the answer -- it confirms what I concluded from a quick web search.
>> There are however some libc functions that might be easier to fuzz
>> (e.g. gethostbyname),
>> so I thought that there could be at least something.
>
> Sure, one class of functions that aren't too hard to fuzz is functions
> which take only integer and pointer-to-string arguments with no
> constraints on them. However it still may be hard to hit the
> meaningful cases. I think fuzzing gethostbyname would be pretty slow
> since you'd end up waiting for the dns request to fail for nearly
> every random string you generated.
>
> Rich
----- End forwarded message -----
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
