3 ms·

> The dangers of pointers and explicit memory management are overrated Hummm, not my experience. The first time I ran AFL on one of my C library (parser/conve

by kakwa_ 8y ago

> The dangers of pointers and explicit memory management are overrated Hummm, not my experience. The first time I ran AFL on one of my C library (parser/converter of EMF files, really easy to mess up), the result was quite frightening. IIRC, it took only 20 seconds for AFL to find 10 crashes. Ever since, first I'm more careful, second I run AFL from time to time, and it happens regularly that it catches some edge cases I was not able to see. I love programing in C, but I definitively know it's easy to make mistakes in it.

phendrenad2 8y ago
What's AFL?
- cytzol 8y ago
  I think it’s American Fuzzy Lop, a fuzzer that’s good at finding bugs in your code: http://lcamtuf.coredump.cx/afl/ http://lcamtuf.coredump.cx/afl/
- deleted 8y ago
  [deleted]
- kakwa_ 8y ago
  American Fuzzy Lop. http://lcamtuf.coredump.cx/afl/ http://lcamtuf.coredump.cx/afl/ And no, it's not the rabbit ^^. It's an 'intelligent' (as opposed to purely random) fuzzer that is quite good at finding edge cases (it's a very/too short summery, please read the link for more details).
josephg 8y ago
I have that experience in pretty much every language, the first time I run a fuzzer on my code to check an invariant. I'm honestly surprised fuzzers aren't more widely used - they're far more effective per line of code compared with classic unit test suites, and easier to extend. I'm not sure I've ever run a fuzzer on virgin code and not found new bugs. Even when the code in question already had allegedly comprehensive unit tests. The one time I tried AFL, I didn't find any new bugs beyond the embarrassingly large number my own fuzzer had already pointed out. But I agree with your point. Some double-digit percentage of bugs in a C library will be memory related, with all the remote execution implications that brings. This is arguably not a big issue for games or webassembly code. But for networked services it seems increasingly irresponsible now that Rust, Pony & friends are maturing.

by kakwa_ 8y ago

phendrenad2 8y ago

What's AFL?

cytzol 8y ago
I think it’s American Fuzzy Lop, a fuzzer that’s good at finding bugs in your code: http://lcamtuf.coredump.cx/afl/ http://lcamtuf.coredump.cx/afl/
deleted 8y ago
[deleted]
kakwa_ 8y ago
American Fuzzy Lop. http://lcamtuf.coredump.cx/afl/ http://lcamtuf.coredump.cx/afl/ And no, it's not the rabbit ^^. It's an 'intelligent' (as opposed to purely random) fuzzer that is quite good at finding edge cases (it's a very/too short summery, please read the link for more details).

josephg 8y ago

I have that experience in pretty much every language, the first time I run a fuzzer on my code to check an invariant. I'm honestly surprised fuzzers aren't more widely used - they're far more effective per line of code compared with classic unit test suites, and easier to extend. I'm not sure I've ever run a fuzzer on virgin code and not found new bugs. Even when the code in question already had allegedly comprehensive unit tests. The one time I tried AFL, I didn't find any new bugs beyond the embarrassingly large number my own fuzzer had already pointed out. But I agree with your point. Some double-digit percentage of bugs in a C library will be memory related, with all the remote execution implications that brings. This is arguably not a big issue for games or webassembly code. But for networked services it seems increasingly irresponsible now that Rust, Pony & friends are maturing.