Re: Notes on fuzzing ImageMagick and GraphicsMagick

[Hanno Böck <hanno () hboeck de>]

On Tue, 5 Feb 2019 17:28:03 -0500
Alex Gaynor <alex.gaynor () gmail com> wrote:

> Both ImageMagick and GraphicsMagick had been widely fuzzed and audited
> before
> this. Hanno Böck [#]_ observed: "In the past it was pretty easy to
> bugs in
> imagemagick, but after some review by Google most of them have been
> fixed and
> these days there are at least no more trivial to find fuzzing issues."

Even though you had a disclaimer I feel I want to give a short answer.
That quote probably comes from a page that I removed a while ago and
now says " I'm no longer maintaining this list, as it was extremely
outdated."

It's at least 3 years old and back then we were in a state where you
could pick a random command line tool, run afl+asan against it and
crashes would fall out within seconds.
My intent back then was to establish some baseline robustness, so take
my words there as "it's not that easy any more to find bugs in IM/GM
within very short timeframes and very simple methods". Which I guess is
still true and not in contradiction that with more involved methods
you'll find more.


These days my remaining worries about fuzzing-related bugs are
primarily targets that don't fit into the libfuzzer/oss-fuzz framework,
e.g. networking-software that has no easy way to abstract their parser
code into a function call.

-- 
Hanno Böck
https://hboeck.de/

mail/jabber: hanno () hboeck de
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42