3 ms·
Surely that's the manufacturer's job. Since it's caused by a specific byte at a specific place, surely you'd only need to fuzz an average of 256 packets (of th
by Jabbles 14y ago
Surely that's the manufacturer's job.
Since it's caused by a specific byte at a specific place, surely you'd only need to fuzz an average of 256 packets (of the required length) to find it... which suggests it wasn't done at all... zero...
- fusiongyro 14y agoIt is, but your clients are going to complain to you.
- deleted 14y ago[deleted]
- wglb 14y agoWell, my feeling is that if you are going to ship it, you better fuzz it. And if you are assembling something with this card, you are the manufacturer. A true fuzzing run for something like this ought to run in the tens of millions of packets.
- arnsholt 14y agoThat's assuming you know the magical position. If you need to test all positions, it's 256 to the power of the number of bytes in the message.
- DuskStar 14y agoBut couldn't you test all the positions at once, by having the entire packet be random data? Unless the packet has to be a particular length for this to happen, which I didn't notice in the article.
- wisty 14y agoOr it was done once, and the "inoculation" byte came first. There were 4 buggy bytes. 3 would crash the card. 1 would fix the card ("inoculating" it). If they only fuzzed once, or fuzzed with the same dataset (random.seed(1) // seed chosen at random), then they wouldn't catch it. Even then, it's pretty sloppy.