Date: Wed, 6 Feb 2019 09:41:02 +0100 From: Hanno Böck <hanno@...eck.de> To: Alex Gaynor <alex.gaynor@...il.com> Cc: oss-security@...ts.openwall.com Subject: Re: Notes on fuzzing ImageMagick and GraphicsMagick On Tue, 5 Feb 2019 17:28:03 -0500 Alex Gaynor <alex.gaynor@...il.com> wrote: > Both ImageMagick and GraphicsMagick had been widely fuzzed and audited > before > this. Hanno Böck [#]_ observed: "In the past it was pretty easy to > bugs in > imagemagick, but after some review by Google most of them have been > fixed and > these days there are at least no more trivial to find fuzzing issues." Even though you had a disclaimer I feel I want to give a short answer. That quote probably comes from a page that I removed a while ago and now says " I'm no longer maintaining this list, as it was extremely outdated." It's at least 3 years old and back then we were in a state where you could pick a random command line tool, run afl+asan against it and crashes would fall out within seconds. My intent back then was to establish some baseline robustness, so take my words there as "it's not that easy any more to find bugs in IM/GM within very short timeframes and very simple methods". Which I guess is still true and not in contradiction that with more involved methods you'll find more. These days my remaining worries about fuzzing-related bugs are primarily targets that don't fit into the libfuzzer/oss-fuzz framework, e.g. networking-software that has no easy way to abstract their parser code into a function call. -- Hanno Böck https://hboeck.de/ mail/jabber: hanno@...eck.de GPG: FE73757FA60E4E21B937579FA5880072BBB51E42
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.