Re: Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less

[Alexander Cherepanov <cherepan () mccme ru>]

On 2014-11-17 16:52, Jakub Wilk wrote:
> * Hanno Böck <hanno () hboeck de>, 2014-11-17, 13:33:
> > I wasn't able to fuzz a crash out of 7z, arj, msgunfmt (gettext),
>
> https://bugs.debian.org/763820
> https://bugs.debian.org/769901
>
> I don't remember the exact details, but I'm pretty sure it took at most
> a few hours of afl-fuzzing to find these crashers.

Everybody wants to play with a shiny new toys but old ones are also good 
sometimes:

$ printf 'msgid "a"\nmsgstr "b"' > test.po
$ msgfmt test.po -o test.mo
$ time zzuf -qcs: msgunfmt test.mo
zzuf[s=93318,r=0.004]: signal 11 (SIGSEGV)

real    6m30.636s
user    0m1.212s
sys     0m14.853s

Actually, afl-fuzz found a crash in it in 1 min 33 sec.

--
Alexander Cherepanov