News for hackers. Stuff that matters.
Re:New differential fuzzing tool reveals novel HTTP request ... by Joker_vD on Thursday November 25, 2021 @03:43PM (#29344804)
Or at least a bunch of examples in the RFC itself. Don't you just love reading a long description of a convoluted data format with literally zero examples of how the full thing looks and what it is supposed to mean? Sadly, leaving the validation undocumented is pretty common across formats/protocol descriptions, and RFCs actually seem to generally be on the "more specific" end of scale, thanks to the ubiquitous use of MUST/SHOULD language. But I've recently wrote a toy ELF parser and it's amazing how many things in its spec are left implicit: e.g. you probably should check that calculating a segment's end (base+size) doesn't overflow and wrap over zero... should you? Maybe you're supposed to support segments that span over the MAX_MEMORY_ADDRESS into the lower memory, who knows? The spec does not say.
Re:New differential fuzzing tool reveals novel HTTP request ... by toomim on Thursday November 25, 2021 @04:03PM (#29344974)
You know, the IETF is an open group, and you can write some examples and submit them as a pull request:

https://httpwg.org/CONTRIBUTING.html