News for hackers. Stuff that matters.

A comment on AFLFast vs. Erlang. Parent comment

Re:AFLFast vs. Erlang by fulafel on Wednesday August 24, 2016 @01:25AM (#12349857)
The marshal format used by pyc files is explicitly documented[1] to be unsafe, just a fast way to cache the compiled byte code to a .pyc file next to the .py source file. The Python VM is not a sandbox so there has been no need for an untrusted bytecode format.

[1] see big red warning box at https://docs.python.org/3/library/marshal.html

[ Parent | on HN ]
Re:AFLFast vs. Erlang by sokoowdevops on Wednesday August 24, 2016 @02:29AM (#12350128)
That's true, but looking at crashes, the 'exploitable' marks some of them as exploitable, there are also heap errors. Might be an easy entry point to do... something ;)

We did similar excercise a year ago with zpaq, and Matt and community was able to fix it so well that now you can fuzz it pretty much forever :)

[ Parent | on HN ]