[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <546E942F.6000903@mccme.ru>
Date: Fri, 21 Nov 2014 04:23:59 +0300
From: Alexander Cherepanov <cherepan@...me.ru>
To: oss-security@...ts.openwall.com
Subject: Re: Fuzzing project brainstorming
On 2014-11-20 19:54, Gynvael Coldwind wrote:
> I would argue that "is also valuable" is underplaying it a little ;)
> IMO having the input (and information on how was it loaded in some cases)
Yes, sometimes a crash is only happens under valgrind or with specific
ulimit etc.
> If it came from a mutation-based fuzzer, the original (not-mutated) sample
> can be useful too.
You mean the closest non-crashing parent (in case there is a chain of
samples as in AFL)?
And while we are at it, would you mind describing your experience in
case of ffmpeg. Your blogpost -- http://gynvael.coldwind.pl/?id=524 --
gives only high level review of the work. The fuzzer and specific
methods of fuzzing seems to be proprietary. That's fine. But perhaps you
can describe other sides of the work:
- how did you deduplicate crashes (full stacktrace, some frames only or
some other way);
- how did you decide which issues are security-sensitive and which are not;
- how did you requested CVEs (for which issues, which info was required);
- (if you know) how security fixes were released by ffmpeg.
This kind of questions.
Given the sheer number of findings you probably did everything
automatically?
--
Alexander Cherepanov
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
