3 ms·
it looks like the single character was made up of 4 utf8 code points. so might have been trickier to detect from fuzzing than it looks.
by benmmurphy 9y ago
it looks like the single character was made up of 4 utf8 code points. so might have been trickier to detect from fuzzing than it looks.
- q3k 9y agoDon't knock instrumentation-based fuzzing when it comes to discovering complex edgecases and code paths. I've used AFL [1] to generate semantically valid, crashing multi-statement SQL queries when given ~50 CPU days and a simplistic SQL-like database. All from thin air, with an empty text file as the initial testcase. It can also come up with valid JPEGs [2] given enough time. [1] - http://lcamtuf.coredump.cx/afl/ http://lcamtuf.coredump.cx/afl/ [2] - https://lcamtuf.blogspot.ie/2014/11/pulling-jpegs-out-of-thin-air.html https://lcamtuf.blogspot.ie/2014/11/pulling-jpegs-out-of-thi...