[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20190206094102.11bb7daa@computer>
Date: Wed, 6 Feb 2019 09:41:02 +0100
From: Hanno Böck <hanno@...eck.de>
To: Alex Gaynor <alex.gaynor@...il.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: Notes on fuzzing ImageMagick and GraphicsMagick
On Tue, 5 Feb 2019 17:28:03 -0500
Alex Gaynor <alex.gaynor@...il.com> wrote:
> Both ImageMagick and GraphicsMagick had been widely fuzzed and audited
> before
> this. Hanno Böck [#]_ observed: "In the past it was pretty easy to
> bugs in
> imagemagick, but after some review by Google most of them have been
> fixed and
> these days there are at least no more trivial to find fuzzing issues."
Even though you had a disclaimer I feel I want to give a short answer.
That quote probably comes from a page that I removed a while ago and
now says " I'm no longer maintaining this list, as it was extremely
outdated."
It's at least 3 years old and back then we were in a state where you
could pick a random command line tool, run afl+asan against it and
crashes would fall out within seconds.
My intent back then was to establish some baseline robustness, so take
my words there as "it's not that easy any more to find bugs in IM/GM
within very short timeframes and very simple methods". Which I guess is
still true and not in contradiction that with more involved methods
you'll find more.
These days my remaining worries about fuzzing-related bugs are
primarily targets that don't fit into the libfuzzer/oss-fuzz framework,
e.g. networking-software that has no easy way to abstract their parser
code into a function call.
--
Hanno Böck
https://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
