I ended up "cheating" a little bit by providing a valid JPEG header - I found that rust-fuzz seemed to take far too long to generate any valid JPEG at all by starting from eg. an empty file. But maybe I just wasn't patient enough, after all I was only running it on my laptop :)
Re:Pulling JPEGs out of thin air (2014)
by lachenmayer on Monday March 25, 2019 @05:12PM
(#19486777)
Yeah definitely, a BMP doesn't really have any "interesting" structure though because it's more or less just an array of pixels. The visual artifacts in JPEG files come from all the downsampling / blocks / cosine transform stuff which is really what I wanted to explore.
Re:Pulling JPEGs out of thin air (2014)
by Twirrim on Sunday March 24, 2019 @07:14PM
(#19479307)
I've used this in the past (inspired by this) to produce some valid json. Of course, a jpeg is at least pretty. Valid JSON is still just boring old JSON.
Re:Pulling JPEGs out of thin air (2014)
by hannob on Monday March 25, 2019 @04:27AM
(#19481014)
It's a redirect.
The link goes to the HTTP version of blogspot. This redirects you to HTTPS. If you click "back" you are back at the HTTP version, which will redirect you again.
Re:Pulling JPEGs out of thin air (2014)
by jorams on Monday March 25, 2019 @05:30AM
(#19481190)
> Yeah, browsers could be smarter about this
I'm not sure they could. If the http:// URL would have responded with a redirect to https://, the back button would have worked just fine. Instead it responds with a perfectly normal page that then does this:
if (location.protocol == 'http:') location.protocol = 'https:';
Blogspot is such a mess, it's the perfect example of Google not necessarily being technically competent.
Re:Pulling JPEGs out of thin air (2014)
by Cthulhu_ on Monday March 25, 2019 @08:01AM
(#19481777)
Yeah that should be a proper permanent redirect on a webserver level. Did Google make Blogspot themselves or did they buy it and never made it conform to normal web page practices?
If you're interested, my notes are here: https://github.com/lachenmayer/insta-fuzz
I ended up "cheating" a little bit by providing a valid JPEG header - I found that rust-fuzz seemed to take far too long to generate any valid JPEG at all by starting from eg. an empty file. But maybe I just wasn't patient enough, after all I was only running it on my laptop :)
> Note that by default, afl-fuzz runs on a single core, so it may take several days to get results
The link goes to the HTTP version of blogspot. This redirects you to HTTPS. If you click "back" you are back at the HTTP version, which will redirect you again.
Yeah, browsers could be smarter about this.
I'm not sure they could. If the http:// URL would have responded with a redirect to https://, the back button would have worked just fine. Instead it responds with a perfectly normal page that then does this:
Blogspot is such a mess, it's the perfect example of Google not necessarily being technically competent.