You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Apr 30, 2021. It is now read-only.
Repository navigation
This repository was archived by the owner on Apr 30, 2021. It is now read-only.
While fuzzing some python stuff, I've found several heap-corruption issues. Unfortunately, since the whole Python thingy is crashing in a weird way, the crashing input isn't saved, and this is annoying.
It would be nice to have a way (maybe hidden behind a flag) to keep this kind of crashes.
heap-corruption issues in the runtime itself? this is cool!(would love to see that when possible/fixed). The only way I can think of saving those kind of crashes are saving each time the last input on disk but that will kind of slow the whole thing down. Do you have some kind of reproduction for this? maybe it's just running out of memory?
I thought about keeping everything, but it would murder the performances.
A better way would be to have a better monitoring of the fuzzee's process, to detect this kind of issues, and dump the input.
I'm currently trying to run my fuzzer in an ASAN environment, to see if I can reproduce this.
Activity
yevgenypats commentedon Dec 18, 2019
heap-corruption issues in the runtime itself? this is cool!(would love to see that when possible/fixed). The only way I can think of saving those kind of crashes are saving each time the last input on disk but that will kind of slow the whole thing down. Do you have some kind of reproduction for this? maybe it's just running out of memory?
jvoisin commentedon Dec 18, 2019
I thought about keeping everything, but it would murder the performances.
A better way would be to have a better monitoring of the fuzzee's process, to detect this kind of issues, and dump the input.
I'm currently trying to run my fuzzer in an ASAN environment, to see if I can reproduce this.
yevgenypats commentedon Dec 18, 2019
If you have a reproduction you can share I'll be happy to take a look at this. sounds like an interesting case-study.
jvoisin commentedon Dec 18, 2019
You can always use something like this I guess:
yevgenypats commentedon Dec 19, 2019
Ah got it, you meant code that uses cbindings. That makes more sense now.