4 ms·
With the massive increase in fuzzing, especially around core projects like OpenSSL, I'm surprised that there was still a crash reachable from an x509 cert in th
by cjbprime 6y ago
With the massive increase in fuzzing, especially around core projects like OpenSSL, I'm surprised that there was still a crash reachable from an x509 cert in the x509 parser. Anyone have any insight on why it wasn't found sooner?
- hannob 6y agoit doesn't look like you can find it by fuzzing x509 cert parsing alone, only in certain combinations like by checking a cert against a CRL list. If you created a combined X.509 + CRL parser fuzzer you might have found it. Probably nobody has done that.