Why you should be using automated fuzzing to test for security issues in your code
summary
Argues that automated fuzzing finds real C/C++ memory bugs fast and cheaply using clang sanitizers plus libFuzzer and oss-fuzz rather than slow Valgrind. Shows a working workflow: build static binaries in oss-fuzz docker images, provide a seed corpus, run libFuzzer with asan ubsan msan enabled, and get minimized crashes and tracked issues. Reports OSS-Fuzz projects growing (≈240→260) and a concrete result: a 25 byte minimized PSD file that reproduces a crash in the image parser and is fixed via regression tests.
AI-written summary · about
chapters (12)
- 0:00Introduction and background
- 1:47Security issues in C++ code
- 3:37Tools for memory error detection
- 5:48What is fuzzing?
- 7:16Targeting exposed inputs
- 8:42Coverage-guided fuzzing
- 10:48Setting up libFuzzer
- 13:38OSS-Fuzz overview
- 15:12Demo: Fuzzing a TGA parser
- 19:11Handling found bugs
- 20:36Results in KDE
- 21:41Summary and Q&A
related talks
25mHow fuzzing helps to find bugs
53mFuzzing 101
39mMaking Fuzzing Part of Your Software Development Lifecycle
29mSecuring C code that seems to work just fine
31m“Fuzz or lose..."
01h 15mMake your programs more reliable with Fuzzing
01h 39mFuzzing in the open: Integrate your project in OSS-Fuzz for continuous fuzzing
59mBeyond Sanitizers...