3 ms·
Yes, I know. My question was more if or why a sanitizer doesn't help.
by mk89 4y ago
Yes, I know. My question was more if or why a sanitizer doesn't help.
- pjmlp 4y agoNot always, see https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html https://googleprojectzero.blogspot.com/2021/12/this-shouldnt...
- mk89 4y agoMy understanding though is that the ASAN would have done its job, had the test checked for the results. Quoting from the post: > This fuzzer might have produced a SECKEYPublicKey that could have reached the vulnerable code, but as the result was never used to verify a signature, the bug could never be discovered. If the result had been used, the ASAN would have kicked in, I guess, or?
- pjmlp 4y agoWell, it is a lot of conditionals, and in any case binaries are seldom shipped with ASAN into production, so it would still be a lottery outcome if the fuzzer would have generated that specific use case.
- saagarjha 4y agoSanitizers do help, but they can't catch all bugs. They need to execute a buggy code path to catch issues, and even then they're not perfect.