Hacker News Reader

Comment by tptacek | Hacker News Reader

This is really neat. But before you integrate it into anything else you build, consider that it appears to be a very old blob of C code. It took afl-fuzz something like 2 minutes to start finding wild free crashes†. This seems like a worthwhile thing to reimplement in a higher-level language.

† I don't know, maybe they've already done this work and ruled out anything bad from the dozens of unique crashes AFL trivially finds? I wouldn't want to pretend that I've done any serious inspection here.

View on HN

For anyone else reading thread and wondering if someone has reported this issue yet: as of 10:35 UTC 27 Jan, nothing seems to have been posted to the bugs mailing list [1]. I'd encourage anyone who has even minimal knowledge about fuzzing and security and AFL (I don't) to make a post there. Don't let the combination of bystander effect + impostor syndrome stop you from doing it.

[1] https://lists.gnu.org/archive/html/bug-recutils/

I think that a blog post with the details (exactly what to install, exactly what to run) will get a few upvotes here. (At least, I promise my upvote.)

Sometimes the manuals seam clear, but when you actually want to run the program you discover that it needs a library, or that the directories must have some specific names, or ...

For context, afl can take weeks to find crashes in nontrivial binaries.

The maintainer it's active still with a bugs mailing list and chat in IRC. Your findings would surely be well received.

My "findings" here would just be "take the first recins example from your blog post and feed it to afl-fuzz, then wait 2 minutes".

A good follow-up to this would be to get the afl-fuzz error report and send it to the maintainers. Maybe they're not even aware of those problems.

Honestly, I don’t think it’s fair to request from 'tptacek to do this. It was just a friendly heads-up from him. We are many here who could do it. So if anyone has some time over and feel free to dig in :) (Or feel free to refrain.)

s/and feel/feel/

if you can be bothered, rebuild it with debug symbols, run it, dump core and try and find exactly where the bug is.

I vaguely remember doing this with wget, there was a way to make it think the terminal's width is (unsigned)-4, then when printing the download status to stdout, it clears a buffer with a memset(ptr, ' ', -4). Of course -4 in this context is a huge number. It overwrote its whole self until segfault. (this issue was fixed, btw)

great learning experience, for anyone who knows enough C to understand what they're looking at.

If I'd done anything significant, I would, but all I did was confirm the suspicion that this old c-language GNU tool hadn't been exhaustively fuzzed. I'm sure the recutils team can do a perfectly fine job fuzzing it themselves.

Or perhaps you could write a blog post on how to use a fuzzer so we can all learn from your findings?

The Github page for afl-fuzz has a really excellent Getting Started doc.

Sounds cool. Could you share the link to their official git repo?

https://github.com/google/AFL

Hmm. Doesn't look like very "hands on" to me (README.md). Or then I just couldn't find the document you mentioned in the previous post. But I guess one has to learn these things by trial and error then.

> Or then I just couldn't find the document you mentioned in the previous post.

There you go: https://github.com/google/AFL/blob/master/docs/QuickStartGui...

It did not take me much time to find https://github.com/google/AFL/blob/master/docs/QuickStartGui... which I guess is the doc he referenced.

For those looking for tutorials; in addition to the one already linked, I’m quite sure there are quite a few decent YouTube videos about fuzzing with AFL.

https://llvm.org/docs/LibFuzzer.html might also be quite interesting due to the potentially significantly higher fuzzing speed (no fork(2) for each try).

Something about this request gets under my skin like nothing I've read on HN in a very long time.

It was weird. I decided to take it as a compliment. But as it's an unearned one, I think I probably won't write a blog post about it.

Indeed it's a compliment. And also a humble request because I'm interested in this subject. Perhaps my way of expression was not the best? But I'll take some time to see what other resources are available there.

I'm serious that you can read the (excellent) Quick Start for AFL, pick a C program (try recutils!) and get afl-fuzz running very quickly, and it's really sort of self-explanatory once it's running. It's a really well-built piece of software.

Sometimes people write strange things ¯\_(ツ)_/¯

I give it a couple of months before it is rewritten in Rust, just like bat and ripgrep.

I think Rust is not a choice for everyone / everything. Learning to debug and master C is still very much a valuable skill.

There is something here: https://github.com/aisamanra/rrecutils

Reply on news.ycombinator.com