[x0]

if you can be bothered, rebuild it with debug symbols, run it, dump core and try and find exactly where the bug is.

I vaguely remember doing this with wget, there was a way to make it think the terminal's width is (unsigned)-4, then when printing the download status to stdout, it clears a buffer with a memset(ptr, ' ', -4). Of course -4 in this context is a huge number. It overwrote its whole self until segfault. (this issue was fixed, btw)

great learning experience, for anyone who knows enough C to understand what they're looking at.

[tptacek]

If I'd done anything significant, I would, but all I did was confirm the suspicion that this old c-language GNU tool hadn't been exhaustively fuzzed. I'm sure the recutils team can do a perfectly fine job fuzzing it themselves.

[intc]

Or perhaps you could write a blog post on how to use a fuzzer so we can all learn from your findings?

[jcims]

Something about this request gets under my skin like nothing I've read on HN in a very long time.

[tptacek]

It was weird. I decided to take it as a compliment. But as it's an unearned one, I think I probably won't write a blog post about it.

[intc]

Indeed it's a compliment. And also a humble request because I'm interested in this subject. Perhaps my way of expression was not the best? But I'll take some time to see what other resources are available there.

[tptacek]

I'm serious that you can read the (excellent) Quick Start for AFL, pick a C program (try recutils!) and get afl-fuzz running very quickly, and it's really sort of self-explanatory once it's running. It's a really well-built piece of software.

[cpach]

Sometimes people write strange things ¯\_(ツ)_/¯

[tptacek]

The Github page for afl-fuzz has a really excellent Getting Started doc.

[intc]

Sounds cool. Could you share the link to their official git repo?

[tptacek]

https://github.com/google/AFL

[intc]

Hmm. Doesn't look like very "hands on" to me (README.md). Or then I just couldn't find the document you mentioned in the previous post. But I guess one has to learn these things by trial and error then.