3 ms·
This testing-based approach is great at finding buffer overflows that occur within your test suite. But especially for code like curl that runs on untrusted da
by mbrubeck 6y ago
This testing-based approach is great at finding buffer overflows that occur within your test suite. But especially for code like curl that runs on untrusted data, you need a more adversarial mindset. Unless your tests cover every possible input, a clever attacker might always find input data that you didn't think to test.
- deleted 6y ago[deleted]
- mbrubeck 6y agoHere's an example from one of your own projects, where code that works fine on normal input has a buffer overrun on malicious or corrupted data: https://github.com/quelsolaar/HxA/issues/4 https://github.com/quelsolaar/HxA/issues/4