2 ms·

Oh my, I finished this quite late last night and forgot to add a conclusion. I thought the post was getting a bit lengthy, and the next step is to use gdb to di

by orf 11y ago

Oh my, I finished this quite late last night and forgot to add a conclusion. I thought the post was getting a bit lengthy, and the next step is to use gdb to dive into the crashes + make a patch, which I feel is too much for one post. So tune in next week :)

masklinn 11y ago
Would the core team really be interested in that? The bytecode interpreter relies on implicit invariants from the codegen, re-checking these invariants on the bytecode means slowing down the interpreter for very little value.
- orf 11y ago
  Nope they wouldn't, making the patch is just for completeness sake I guess. Also the afl tool to narrow down segfaults seems to always result in the same fault, so maybe if I patch it it will narrow down some more interesting ones.
- electrum 11y ago
  That's interesting, because bytecode verification is extremely well-defined for the JVM: https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.html#jvms-4.10 https://docs.oracle.com/javase/specs/jvms/se8/html/jvms-4.ht...
  - lmm 11y ago
    The JVM is explicitly designed to run untrusted bytecode.
stevekemp 11y ago
I started something similar recently, but figured a simpler target would be more usable. Bug reports here, along with possible patches, for GNU Awk: * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816277 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816277 * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816271 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816271 Writeup was pretty simple: * https://blog.steve.org.uk/If_line_noise_is_a_program__all_fuzzers_are_developers.html https://blog.steve.org.uk/If_line_noise_is_a_program__all_fu...