Hacker News Reader

Comment by pixelbeat__ | Hacker News Reader

I'm the GNU coreutils maintainer and have fuzzed them extensively. For example a recent bad bug in TZ handling was found using AFL and fixed by: http://git.sv.gnu.org/gitweb/?p=gnulib.git;a=commitdiff;h=94...

We put a lot of effort into the test suite which makes it easy for others to test various experimental security checkers. This has been detailed in the "third party testing" section at: http://www.pixelbeat.org/docs/coreutils-testing.html

View on HN

wow pretty awesome to see such a QA pipeline in Open Source projects. I'm used to this in expensive R&D pipelines in the Telco space[0]. Is there a reason you're not using oss-fuzz[1]?

I recently did a lot of work using AFL-fast[2] (poking mostly Perl & Lua and crappy IoT products). My experience is that AFL-fast yielded far better results (in a fraction of the time) when compared to AFL.

[0] http://www.syssec-project.eu/m/page-media/3/johansson_tfuzz_...

[1] https://github.com/google/oss-fuzz

[2] https://github.com/mboehme/aflfast

aflfast is mentioned in my second link and was the most used fuzzing implementation to find bugs in coreutils.

We've had a quick look at using oss-fuzz, which will need a bit of work since it's more suited to libraries rather than standalone utils.

My bad, another commenter pointed out that GNU Patch is not part of coreutils. The GNU umbrella is quite wide these days...

Reply on news.ycombinator.com