{"id":7593,"date":"2017-07-12T14:49:09","date_gmt":"2017-07-12T18:49:09","guid":{"rendered":"http:\/\/esr.ibiblio.org\/?p=7593"},"modified":"2017-07-12T17:34:50","modified_gmt":"2017-07-12T21:34:50","slug":"fuzzbombing-abort-calls-for-great-justice","status":"publish","type":"post","link":"http:\/\/esr.ibiblio.org\/?p=7593","title":{"rendered":"Fuzzbombing: abort() calls for great justice!"},"content":{"rendered":"<p>The <a href=\"https:\/\/gitlab.com\/esr\/open-adventure\">Colossal Cave Adventure restoration<\/a> is pretty much done now.  One thing we&#8217;re still working on is getting test coverage of the last few corners in the code.  Because when you&#8217;re up to <a href=\"http:\/\/esr.gitlab.io\/open-adventure\/coverage\/\">99.7%<\/a> the temptation to push for that last 0.3% is really strong even if the attempt is objectively fairly pointless.<\/p>\n<p>What&#8217;s more interesting is the technique one of our guys came up with for getting us above about 85% coverage.  After that point it started to get quite difficult to hand-craft test logs to go to the places in the code that still hadn&#8217;t been exercised.<\/p>\n<p>But NHorus, aka Petr Vorpaev, is expert at fuzz testing; we&#8217;ve been using American Fuzzy Lop, a well-designed, well-documented, and tasteful tool that I highly recommend. And he had an idea.<\/p>\n<p>Want to get a test log that hits a particular line?  Insert an abort() call right after it and rebuild. Then unleash the fuzzer.  If you&#8217;ve fed it a good test corpus that gets somewhere near your target, it will probably not take long for the fuzzer to random-walk into your abort() call and record that log.<\/p>\n<p>Then watch your termination times. For a while we&#8217;d generally get a result within hours, but we eventually hit a break after which the fuzzer would run for days without result.  That knee in the curve is your clue that the fuzzer has done everything it can.<\/p>\n<p>I dub this technique &#8220;fuzzbombing&#8221;.  I think it will generalize well.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Colossal Cave Adventure restoration is pretty much done now. One thing we&#8217;re still working on is getting test coverage of the last few corners in the code. Because when you&#8217;re up to 99.7% the temptation to push for that last 0.3% is really strong even if the attempt is objectively fairly pointless. What&#8217;s more&hellip; <a class=\"more-link\" href=\"http:\/\/esr.ibiblio.org\/?p=7593\">Continue reading <span class=\"screen-reader-text\">Fuzzbombing: abort() calls for great justice!<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[],"class_list":["post-7593","post","type-post","status-publish","format-standard","hentry","category-software","entry"],"_links":{"self":[{"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=\/wp\/v2\/posts\/7593","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7593"}],"version-history":[{"count":2,"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=\/wp\/v2\/posts\/7593\/revisions"}],"predecessor-version":[{"id":7597,"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=\/wp\/v2\/posts\/7593\/revisions\/7597"}],"wp:attachment":[{"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7593"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7593"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/esr.ibiblio.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7593"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}