4 ms·
It sounds like the fuzzer would have had to use an arbitrary number of bytes containing '.' and the cert would've had to pass chain of trust verification. A fuz
by bink 4y ago
It sounds like the fuzzer would have had to use an arbitrary number of bytes containing '.' and the cert would've had to pass chain of trust verification. A fuzzer is only as strong as its implementation.
- contravariant 4y agoI hope they're not just fuzzing random bytes, in theory that would take forever to trigger any code other than just rejecting the certificate.
- whizzter 4y agoIirc fuzzers would add randomness and measure occurences of newly entered codepaths and build out from previous randomness to reach more codepaths. However as you noted, in this case the cryptographic verification code would in practice always be hit before any sany progress could be done in fuzzing any deeper. To catch this they would've needed to make a specific fuzzing setup where the process prepared random certificates that are THEN signed and passed further and make the fuzzer short-circuit anything where the random cerificate failed the signing to actually test verification.