Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 21 Nov 2014 04:23:59 +0300
From: Alexander Cherepanov <cherepan@...me.ru>
To: oss-security@...ts.openwall.com
Subject: Re: Fuzzing project brainstorming

On 2014-11-20 19:54, Gynvael Coldwind wrote:
> I would argue that "is also valuable" is underplaying it a little ;)
> IMO having the input (and information on how was it loaded in some cases)

Yes, sometimes a crash is only happens under valgrind or with specific 
ulimit etc.

> If it came from a mutation-based fuzzer, the original (not-mutated) sample
> can be useful too.

You mean the closest non-crashing parent (in case there is a chain of 
samples as in AFL)?

And while we are at it, would you mind describing your experience in 
case of ffmpeg. Your blogpost -- http://gynvael.coldwind.pl/?id=524 -- 
gives only high level review of the work. The fuzzer and specific 
methods of fuzzing seems to be proprietary. That's fine. But perhaps you 
can describe other sides of the work:
- how did you deduplicate crashes (full stacktrace, some frames only or 
some other way);
- how did you decide which issues are security-sensitive and which are not;
- how did you requested CVEs (for which issues, which info was required);
- (if you know) how security fixes were released by ffmpeg.
This kind of questions.

Given the sheer number of findings you probably did everything 
automatically?

-- 
Alexander Cherepanov

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.