Date: Thu, 20 Nov 2014 17:54:20 +0100 From: Gynvael Coldwind <gynvael@...dwind.pl> To: oss-security@...ts.openwall.com Subject: Re: Fuzzing project brainstorming > > Since they are coming from fuzzing a copy of the exact input which led > to it is also valuable. There is nothing worse than having to guess at > what might have led to a crash when the input could literally have > been anything at all. I would argue that "is also valuable" is underplaying it a little ;) IMO having the input (and information on how was it loaded in some cases) is much more valuable than having anything else (be it stack traces or whatever) as it allows devs to actually look at the crashing app in using any tool they like to use (be it gdb, valgrind, windbg, or what not), which speeds things up. If it came from a mutation-based fuzzer, the original (not-mutated) sample can be useful too. In most* cases the above is enough for the devs to reproduce the problem even without a detailed report. * - in case of weird environment/context setting sometimes a report is a must So, personally I would phrase it like this "crashing sample is a must; everything else is good to have". ym2c :) -- Gynvael Coldwind
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.