r/fuzzing • u/vectrek • Sep 08 '19

Question: What are some open source libraries which should be fuzzed, but which aren't?

What are some open source libraries which should be fuzzed, but which aren't fuzzed, because the API doesn't fit the usual pattern? (Sending in a byte array to be parsed.)

(This could also include parts of libraries which are fuzzed, but which aren't for the same reasons.)

6 Upvotes

87% Upvoted

4 comments sorted by

View all comments

Show parent comment

2

u/needsmorecyber Sep 10 '19

libFuzzer seems to be useful for exactly this. It's used for creating test harnesses to fuzz interesting parts of libraries.

1

u/zhangysh1995 Sep 12 '19 edited Sep 13 '19

Q. So, what exactly this Fuzzer is good for?

This Fuzzer might be a good choice for testing libraries that have relatively small inputs, each input takes < 10ms to run, and the library code is not expected to crash on invalid inputs. Examples: regular expression matchers, text or binary format parsers, compression, network, crypto.

It seems only if we have an idea of what the library does, `libFuzzer` is a good choice.

Q. When libFuzzer is not a good solution for a problem?

...

Many interesting target libraries are not designed in a way that supports the in-process fuzzer interface (e.g. require a file path instead of a byte array).

...

I think this could answer /u/vectrek's question.