Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 6 Feb 2019 09:41:02 +0100
From: Hanno Böck <>
To: Alex Gaynor <>
Subject: Re: Notes on fuzzing ImageMagick and GraphicsMagick

On Tue, 5 Feb 2019 17:28:03 -0500
Alex Gaynor <> wrote:

> Both ImageMagick and GraphicsMagick had been widely fuzzed and audited
> before
> this. Hanno Böck [#]_ observed: "In the past it was pretty easy to
> bugs in
> imagemagick, but after some review by Google most of them have been
> fixed and
> these days there are at least no more trivial to find fuzzing issues."

Even though you had a disclaimer I feel I want to give a short answer.
That quote probably comes from a page that I removed a while ago and
now says " I'm no longer maintaining this list, as it was extremely

It's at least 3 years old and back then we were in a state where you
could pick a random command line tool, run afl+asan against it and
crashes would fall out within seconds.
My intent back then was to establish some baseline robustness, so take
my words there as "it's not that easy any more to find bugs in IM/GM
within very short timeframes and very simple methods". Which I guess is
still true and not in contradiction that with more involved methods
you'll find more.

These days my remaining worries about fuzzing-related bugs are
primarily targets that don't fit into the libfuzzer/oss-fuzz framework,
e.g. networking-software that has no easy way to abstract their parser
code into a function call.

Hanno Böck

GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.