4 ms·

Would it really have caught it?

• formerly_proven 3y ago
  No
  • pas 3y ago
    ... why?
    • filleokus 3y ago
      Did the artefact produced [0] for fussing even include the backdoored .so? My understanding was that the compromised build-scripts had measures to only run when producing deb/rpms. https://github.com/google/oss-fuzz/blob/5f70676a6c9050b9cb687cdb1543354702a8c757/projects/xz/build.sh https://github.com/google/oss-fuzz/blob/5f70676a6c9050b9cb68...
    • ycombinatrix 3y ago
      my understanding is that fuzzing "caught" the issue by crashing with ifunc disabled but it wouldn't have "caught" the backdoor which uses public key cryptography