3 ms·
It doesn't look like bc uses fuzzing? It'd be interesting to see the outcome there since even in mature projects it consistently leads to novel memory safety bu
by sweetjuly 3y ago
It doesn't look like bc uses fuzzing? It'd be interesting to see the outcome there since even in mature projects it consistently leads to novel memory safety bugs every few days [1]. Fuzzing find a lot of really weird and unintuitive bugs in my experience, especially as it relates to use-after-frees and races.
[1] Linux syzkaller bug tracker https://groups.google.com/g/syzkaller-bugs https://groups.google.com/g/syzkaller-bugs
- gavinhoward 3y agoAuthor here. My bc does use fuzzing. [1] I love fuzzing. In my new project, fuzzing generates my test suite that I then go through by hand and verify. In bc, if I change the source code before a release, I run a fuzzer for two weeks on both bc and dc. [2] and [3] are directories of error tests, almost all of which were found by AFL(++). If you run the following on my bc repo: commits1=$(git log --oneline --grep=afl) commits2=$(git log --oneline --grep=AFL) printf '%s\n%s\n' "$commits1" "$commits2" | uniq | wc -l You will get 148 as of 53832b884b5c. Not all of those are bugs found by AFL(++) because some are tending to my fuzzing infrastructure, but at least 2/3 probably are. [1]: https://git.gavinhoward.com/gavin/bc/src/branch/master/tests/fuzzing https://git.gavinhoward.com/gavin/bc/src/branch/master/tests... [2]: https://git.gavinhoward.com/gavin/bc/src/branch/master/tests/bc/errors https://git.gavinhoward.com/gavin/bc/src/branch/master/tests... [3]: https://git.gavinhoward.com/gavin/bc/src/branch/master/tests/dc/errors https://git.gavinhoward.com/gavin/bc/src/branch/master/tests...