How fuzzing helps to find bugs
summary
Shows how to add a tiny entry-point that takes a byte blob and run it under coverage-guided fuzzers (afl, libFuzzer, honggfuzz) and sanitizers; builds are packaged in a Docker target so OSS-Fuzz can run OSS-Fuzz jobs automatically. Compiling with AddressSanitizer/ASAN or valgrind makes memory bugs crash fast; fuzzing finds crashes, use-after-free, leaks and surprising performance bugs (a config parser becomes quadratic past a few hundred headers). Evidence: cluster runs feed two million samples and produce real, fixable bug reports.
AI-written summary · about
chapters (13)
- 0:00Intro
- 6:57How it works
- 10:04What kind of bugs do we find
- 12:33Two ways to fuzz
- 14:09Fasting engines
- 16:39Build target
- 17:10Entry point
- 17:39Compression function
- 19:49Testing
- 20:16Dockerfile
- 20:53Docker helper
- 21:31Example output
- 22:53Conclusion
related talks
24mWhy you should be using automated fuzzing to test for security issues in your code
53mFuzzing 101
01h 15mMake your programs more reliable with Fuzzing
39mMaking Fuzzing Part of Your Software Development Lifecycle
31m“Fuzz or lose..."
01h 39mFuzzing in the open: Integrate your project in OSS-Fuzz for continuous fuzzing
59mBeyond Sanitizers...
44mOSS-Fuzz - Google's continuous fuzzing service for open source software