Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 07 Mar 2015 15:50:26 +0100
From: Frank Dittrich <>
Subject: Re: Any advice on how to fuzz john jumbo by AFL

On 03/07/2015 02:30 PM, Solar Designer wrote:
> On Sat, Mar 07, 2015 at 09:22:30PM +0800, Kai Zhao wrote:
>> john jumbo is robust
> I wish this were the case, but it definitely is not.
> I'd like Alexander Cherepanov to comment on this, as he'd need to
> (co-)mentor this project.  His custom fuzzer was spewing bugs in jumbo
> before, and there's no indication we ran out of those - in fact, we
> certainly introduced new bugs since then.

1.8.0-jumbo-1 definitely had several issues.
But after the 1.8.0-jumbo-1 release, I discovered and reported lots of
such issues, and Jim fixed them all, IIRC.

See, for instance,

I used Alexander's fuzzing scripts, or slightly modified versions of his
So, I think, the situation is now (latest bleeding-jumbo) way better
than it has been for 1.8.0-jumbo-1.

There might have been new bugs introduced meanwhile, and the GPU formats
didn't get tested that much, so these might still have some more bugs,
even though there was some effort to unify the CPU and GPU format
implementations of valid(), prepare(), etc.
Plus, LUKS format is probably still buggy, but there are more important
things to be addressed for this format, see


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.