Hacker News Reader

Comment by tptacek | Hacker News Reader

My "findings" here would just be "take the first recins example from your blog post and feed it to afl-fuzz, then wait 2 minutes".

View on HN

A good follow-up to this would be to get the afl-fuzz error report and send it to the maintainers. Maybe they're not even aware of those problems.

Honestly, I don’t think it’s fair to request from 'tptacek to do this. It was just a friendly heads-up from him. We are many here who could do it. So if anyone has some time over and feel free to dig in :) (Or feel free to refrain.)

s/and feel/feel/

if you can be bothered, rebuild it with debug symbols, run it, dump core and try and find exactly where the bug is.

I vaguely remember doing this with wget, there was a way to make it think the terminal's width is (unsigned)-4, then when printing the download status to stdout, it clears a buffer with a memset(ptr, ' ', -4). Of course -4 in this context is a huge number. It overwrote its whole self until segfault. (this issue was fixed, btw)

great learning experience, for anyone who knows enough C to understand what they're looking at.

If I'd done anything significant, I would, but all I did was confirm the suspicion that this old c-language GNU tool hadn't been exhaustively fuzzed. I'm sure the recutils team can do a perfectly fine job fuzzing it themselves.

Or perhaps you could write a blog post on how to use a fuzzer so we can all learn from your findings?

The Github page for afl-fuzz has a really excellent Getting Started doc.

Sounds cool. Could you share the link to their official git repo?

https://github.com/google/AFL

Hmm. Doesn't look like very "hands on" to me (README.md). Or then I just couldn't find the document you mentioned in the previous post. But I guess one has to learn these things by trial and error then.

> Or then I just couldn't find the document you mentioned in the previous post.

There you go: https://github.com/google/AFL/blob/master/docs/QuickStartGui...

It did not take me much time to find https://github.com/google/AFL/blob/master/docs/QuickStartGui... which I guess is the doc he referenced.

For those looking for tutorials; in addition to the one already linked, I’m quite sure there are quite a few decent YouTube videos about fuzzing with AFL.

https://llvm.org/docs/LibFuzzer.html might also be quite interesting due to the potentially significantly higher fuzzing speed (no fork(2) for each try).

Something about this request gets under my skin like nothing I've read on HN in a very long time.

It was weird. I decided to take it as a compliment. But as it's an unearned one, I think I probably won't write a blog post about it.

Indeed it's a compliment. And also a humble request because I'm interested in this subject. Perhaps my way of expression was not the best? But I'll take some time to see what other resources are available there.

I'm serious that you can read the (excellent) Quick Start for AFL, pick a C program (try recutils!) and get afl-fuzz running very quickly, and it's really sort of self-explanatory once it's running. It's a really well-built piece of software.

Sometimes people write strange things ¯\_(ツ)_/¯

Reply on news.ycombinator.com