News for hackers. Stuff that matters.

A comment on Remote code execution vulnerability in SQLite. Parent comment

Re:Remote code execution vulnerability in SQLite by Frizi on Friday December 14, 2018 @08:27PM (#18686429)
Fuzzing isn't really practical if all you do is just generate a totally random bit stream for input. There are many much more clever and robust strategies to hit as many edge cases as possible. Check AFL[1] for some details on generating smart random input files. You can also combine that with pretty advanced dynamic execution analysis to fuzz against unknown processor instruction sets, like in sandsifter[2].

[1]: http://lcamtuf.coredump.cx/afl/

[2]: https://github.com/xoreaxeaxeax/sandsifter

[ Parent | on HN ]
Re:Remote code execution vulnerability in SQLite by tptacek on Friday December 14, 2018 @08:31PM (#18686448)
On the contrary, for years, the most prolific fuzzers basically did just generate random bitstreams, and that technique will still find vulnerabilities in all the memory-unsafe software that hasn't been fished out by those same dumb fuzzers.
[ Parent | on HN ]