oss-sec mailing list archives
Re: Fuzzing project brainstorming
From: Gynvael Coldwind <gynvael () coldwind pl>
Date: Thu, 20 Nov 2014 17:54:20 +0100
Since they are coming from fuzzing a copy of the exact input which led to it is also valuable. There is nothing worse than having to guess at what might have led to a crash when the input could literally have been anything at all.
I would argue that "is also valuable" is underplaying it a little ;) IMO having the input (and information on how was it loaded in some cases) is much more valuable than having anything else (be it stack traces or whatever) as it allows devs to actually look at the crashing app in using any tool they like to use (be it gdb, valgrind, windbg, or what not), which speeds things up. If it came from a mutation-based fuzzer, the original (not-mutated) sample can be useful too. In most* cases the above is enough for the devs to reproduce the problem even without a detailed report. * - in case of weird environment/context setting sometimes a report is a must So, personally I would phrase it like this "crashing sample is a must; everything else is good to have". ym2c :) -- Gynvael Coldwind
Current thread:
- Fuzzing project brainstorming Hanno Böck (Nov 20)
- Re: Fuzzing project brainstorming Kurt Seifried (Nov 20)
- Re: Fuzzing project brainstorming Hanno Böck (Nov 20)
- Re: Fuzzing project brainstorming Sven Kieske (Nov 20)
- Re: Fuzzing project brainstorming Amos Jeffries (Nov 20)
- Re: Fuzzing project brainstorming Gynvael Coldwind (Nov 20)
- Re: Fuzzing project brainstorming Michal Zalewski (Nov 20)
- Re: Fuzzing project brainstorming Alexander Cherepanov (Nov 20)
- Re: Fuzzing project brainstorming Gynvael Coldwind (Nov 20)
- Re: Fuzzing project brainstorming Hanno Böck (Nov 20)
- Re: Fuzzing project brainstorming Hanno Böck (Nov 20)
- Re: Fuzzing project brainstorming Kurt Seifried (Nov 20)
- Re: Re: Fuzzing project brainstorming Hanno Böck (Nov 20)
- Re: Re: Fuzzing project brainstorming Daniel Kahn Gillmor (Nov 20)
- Re: Fuzzing project brainstorming M.T. Roebuck (Nov 21)