News for hackers. Stuff that matters.

A comment on Fuzzing FFmpeg for fun and profit.

Re:Fuzzing FFmpeg for fun and profit by cottonseed on Sunday November 01, 2015 @10:06PM (#10489741)
afl [0] is awesome. I have it running right now. It found some of bugs in arachne-pnr [1].

I wish someone would do a JVM version (combined with the lines of QuickCheck and typed generators).

[0] http://lcamtuf.coredump.cx/afl/

[1] https://github.com/cseed/arachne-pnr

[ Parent | on HN ]
Re:Fuzzing FFmpeg for fun and profit by MBCook on Sunday November 01, 2015 @10:13PM (#10489762)
As a Java programmer I would love a version of afl. The JVM certainly exposes enough information for other profilers/tracers and things dynamically adding code (spring/hibernate) that it seems like it should be possible.
[ Parent | on HN ]
Re:Fuzzing FFmpeg for fun and profit by rainforest on Monday November 02, 2015 @05:42AM (#10491072)
There's a tool that does similar to AFL called EvoSuite (http://www.evosuite.org). It uses a genetic algorithm like AFL and generates JUnit suites for the target classes. It doesn't look for crashes like AFL - it's closer to MS's IntelliTest tool but uses metaheuristics instead of SMT to break conditions.
[ Parent | on HN ]
Re:Fuzzing FFmpeg for fun and profit by agumonkey on Sunday November 01, 2015 @10:59PM (#10489930)
Completely random, but every time I read lcamtuf ... I read camltuf and think it's a caml subproject.
[ Parent | on HN ]