3 ms·
I'm not sure! Maybe someone can encourage the authors to submit to Fuzzbench. My intuition for the results so far is that (a) converting generator functions to
by cjbprime 4y ago
I'm not sure! Maybe someone can encourage the authors to submit to Fuzzbench.
My intuition for the results so far is that (a) converting generator functions to bitstrings is very computationally expensive (since the comparison is coverage found per unit of time), and (b) perhaps most memory safety vulnerabilities may be occuring in technically invalid or grammatically inconsistent inputs that the grammar will never find.
- planetis 4y agoI think we need fuzzers for more uses than file formats, like method fuzzing and in that case garbage data just doesn't work.
- cjbprime 4y agoThis is also a testable claim! File formats and RPC do not seem that dissimilar to me, especially when using a fuzzer like aflplusplus, which will automatically build a symbol dictionary by pulling strings out of the binary, and perform some light symbolic transformation (laf-intel and cmplog), see https://lafintel.wordpress.com/2016/08/15/circumventing-fuzzing-roadblocks-with-compiler-transformations/ https://lafintel.wordpress.com/2016/08/15/circumventing-fuzz...
- planetis 4y agoIt's just sound weird to me because depending of who you ask, they will tell you generator fuzzers work the best. However defining what's a good benchmark and what to measure other than code coverage is even more complicated. But I guess we are talking about google they might have figured it out.
- cjbprime 4y agoYes, that's why I described the empirical results as surprising.