4 ms·
It looks more like they disabled a feature of oss-fuzz that would've caught the exploit, no?
by packetlost 3y ago
It looks more like they disabled a feature of oss-fuzz that would've caught the exploit, no?
- metzmanj 3y agoThat's what people are saying though I haven't had the chance to look into this myself. Fuzzing isn't really the best tool for catching bugs the maintainer intentionally inserted though.
- bombcar 3y agoIt's more likely that fuzzing would blow up on new code and they wanted an excuse to remove it. After all, if it hadn't had a performance regression (someone could submit a PR fixing whatever slowed it down, heh) it still wouldn't be known.