Structure aware fuzzing
summary
Slides and demos show concrete results: coverage‑guided fuzzers like AFL and lip buzzer instrument code and save minimal crashing inputs; a protocol buffer mutator generates valid syntax trees that quickly reveal a division‑by‑zero and UB caught by sanitizers. Large operators run billions of DOM manipulations or thousands of cores on Chromium; white‑box tools like C Smith and projects such as Springfield synthesize deep corner cases but need heavy effort. The takeaway is which tool finds what bug and how long it takes.
AI-written summary · about
chapters (14)
- 0:00Introduction to fuzzing
- 2:00Standard quality practices
- 3:33Industry use of fuzzing
- 5:38History of random testing
- 7:23Advanced fuzzing tools
- 8:57How fuzzing works
- 12:33Fuzzer taxonomy
- 16:03Getting started with fuzzing
- 19:14Using AFL
- 22:21Introduction to libFuzzer
- 26:50Demo: Fuzzing a calculator
- 34:31Debugging found issues
- 36:01Demo: AFL in action
- 39:14Q&A and conclusion
related talks
01h 15mMake your programs more reliable with Fuzzing
25mGoing Beyond Coverage-Guided Fuzzing with Structured Fuzzing
53mThree Colours of Fuzzing: Reflections and Open Challenges
31m“Fuzz or lose..."
25mHow fuzzing helps to find bugs
53mFuzzing 101
39mMaking Fuzzing Part of Your Software Development Lifecycle
59mBeyond Sanitizers...