4 ms·
Why the OpenSSL punycode vulnerability was not detected by fuzz testing. (2022)
- cratermoon 3y agoThe OpenSSL code is famously a mess[1]. This article demonstrates ways awful code is hard to test. There are multiple convoluted call chains, and fuzzing could only reach the problem code indirectly and incompletely. Even when it can reach it, the setup is complex and expensive because it's going through so much other code. 1 https://news.ycombinator.com/item?id=7556407 https://news.ycombinator.com/item?id=7556407