Re: RE: [security-vendor] Re: [oss-security] Fuzzing findings (and maybe CVE requests) - Image/GraphicsMagick, elfutils, GIMP, gdk-pixbuf, file, ndisasm, less

[Michal Zalewski <lcamtuf () coredump cx>]

> Speaking of fuzzing so that clamav issue, was triggered by a file that
> existed in public since 2010 or so (at least that's what virustotal had
> for the first submission date). So you'd think based on what people use
> clamav for it would have been heavily fuzzed by now (scanning all sorts
> of random/malicious input) but I guess people don't report stuff upstream.

Tavis looked at several commercial AV engines some time ago, I think
it wasn't pretty. I suspect that clamav may be very much worth fuzzing
or auditing.

/mz