Fuzzing is fun, and still there are easy-to-discover issues lurking in even widely used tools. For example I setup a site where I require users to upload an SS

Fuzzing is fun, and still there are easy-to-discover issues lurking in even widely used tools. For example I setup a site where I require users to upload an SSH key (for access to a git repository), and figured I'd do what github, etc, do in the display - show the fingerprint. Given an SSH key you can get a fingerprint like so: deagol ~ $ ssh-keygen -l -f ~/.ssh/id_rsa 2048 4d:19:f2:de:ba:f6:06:31:98:af:9e:2a:di:ce:ca:b2 ~/.ssh/id_rsa.pub (RSA) Can you imagine an SSH key causing ssh-keygen, or ssh to segfault? I found one over a weekend: https://blog.steve.fi/so_about_that_idea_of_using_ssh_keygen_on_untrusted_input_.html https://blog.steve.fi/so_about_that_idea_of_using_ssh_keygen... I found similar issues with other well-known tools, for example a program that would cause GNU awk to segfault. Really I should do more..