Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAAnPYQ7NcW7PGAuiX6LSiUAbD9LPhwhXWypjGmWYG3FnGz4R4A@mail.gmail.com>
Date: Thu, 20 Nov 2014 17:54:20 +0100
From: Gynvael Coldwind <gynvael@...dwind.pl>
To: oss-security@...ts.openwall.com
Subject: Re: Fuzzing project brainstorming

>
> Since they are coming from fuzzing a copy of the exact input which led
> to it is also valuable. There is nothing worse than having to guess at
> what might have led to a crash when the input could literally have
> been anything at all.


I would argue that "is also valuable" is underplaying it a little ;)
IMO having the input (and information on how was it loaded in some cases)
is much more valuable than having anything else (be it stack traces or
whatever) as it allows devs to actually look at the crashing app in using
any tool they like to use (be it gdb, valgrind, windbg, or what not), which
speeds things up.

If it came from a mutation-based fuzzer, the original (not-mutated) sample
can be useful too.

In most* cases the above is enough for the devs to reproduce the problem
even without a detailed report.
* - in case of weird environment/context setting sometimes a report is a
must

So, personally I would phrase it like this "crashing sample is a must;
everything else is good to have".

ym2c :)
--
Gynvael Coldwind

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.