4 ms·
I've had very good experiences with AFL on a medium sized C++ code base. I ran it for 8 CPU months on the code base and was reasonably confident with the result
by jonhohle 10y ago
I've had very good experiences with AFL on a medium sized C++ code base. I ran it for 8 CPU months on the code base and was reasonably confident with the results. It generates samples for you, making the bugs easy to reproduce. Along with valgrind, most ended up being reasonably shallow - lots of out of bounds, uninitialized use, use after free, and incorrectly handles return codes from 3ᴿᴰ party libraries.
I recall getting false positives around hangs, but replaying all the generated test files made that easy to confirm.
Fortunately, the code base I was testing had an extensive set of input files for testing already.
- jonhohle 10y agoAs a quick follow up, one of the things I found surprising were that some of these bugs could have resulted in DOS for some significantly important systems, and that the code was written by some of the smartest people I have ever worked with. If these people were unable to write secure C++, it really made me question whether anyone could reliably do it in a business environment.
- microcolonel 10y agoI think good code and a business environment just don't go hand-in-hand. I work for a company where one of our core values is writing clean code. We have fired clients who compromise too much on quality. But despite this, corners are always cut when there's an arbitrary deadline; and in enterprise, there is always an arbitrary deadline.