LLVM's LibFuzzer Is Uncovering New Bugs With Fuzzing

[phoronix]

Phoronix: LLVM's LibFuzzer Is Uncovering New Bugs With Fuzzing

LibFuzzer was recently added to LLVM as a library for in-process fuzzing. LibFuzzer combined with other open-source fuzzing capabilities make it easy for uncovering new bugs within LLVM and other projects...

http://www.phoronix.com/scan.php?page=news_item&px=LLVM-LibFuzzer-Fuzzing

[kernelOfTruth]

The more (advanced) fuzzers we have - the better

but we need security researchers that use it in the "right" way to spot security issues


according to the following article: http://www.golem.de/news/fuzzing-wie...04-113345.html , https://blog.hboeck.de/archives/868-...een-found.html

american fuzzy lop and address-sanitizer seem to be also a viable option


references:

http://www.dwheeler.com/essays/heartbleed.html

http://lcamtuf.coredump.cx/afl/

https://code.google.com/p/address-sanitizer/

http://blog.leafsr.com/2014/04/11/my-heart-is-ok-but-my-eyes-are-bleeding/

https://fuzzing-project.org/

[uid313]

Fuzz everything!

I wish someone fuzzed all of the Debian and Fedora repositories then made the fuzz result available online, and also mailed the developers.

I wish someone fuzzed all the projects hosted on GitHub and then automatically filed issues or contacted the developers.

[Marc Driftmeyer]

I wish someone fuzzed all of the Debian and Fedora repositories then made the fuzz result available online, and also mailed the developers.

I wish someone fuzzed all the projects hosted on GitHub and then automatically filed issues or contacted the developers.

Hopefully when all of Debian can be built with Clang they leverage it to then reflect improved projects upstream.

[asdfblah]

I wish someone fuzzed all of the Debian and Fedora repositories then made the fuzz result available online, and also mailed the developers.

I wish someone fuzzed all the projects hosted on GitHub and then automatically filed issues or contacted the developers.

I remember reading that, indeed, Debian had (still has?) a bunch of people (volunteers?) doing just that. But as kernelOfTruth said, "The more (advanced) fuzzers we have - the better".

[Michael]

I wish someone fuzzed all of the Debian and Fedora repositories then made the fuzz result available online, and also mailed the developers.

I wish someone fuzzed all the projects hosted on GitHub and then automatically filed issues or contacted the developers.

I do own http://imposq.com/ - "Improving Open-Source Quality" as yet another PTS add-on down the pipe for running automated tests of the *Sans, *Clang utilities, and various compilers on many open-source projects on a per-commit/daily basis. Albeit only so much time in the day to get things ready.

[asdfblah]

I remember reading that, indeed, Debian had (still has?) a bunch of people (volunteers?) doing just that. But as kernelOfTruth said, "The more (advanced) fuzzers we have - the better".

I was wrong, this is what I was talking about: Debian's Automated Code Analysis