News for hackers. Stuff that matters.
Re:Why did the OpenSSL punycode vulnerability happen by tux3 on Wednesday November 02, 2022 @07:24PM (#33444254)
There are naturally lots of edge cases when you parse a format, because you have to constrain the combination of all the different fields.

Some formats are simple and the fields don't interact with each other at all, some are complex and the format changes depending on other values.

Parsing is hard because you have to handle all the possible inputs someone could throw at you, and depending on the format that can leave hundreds of very rare edge case no reasonable human would normally think of.

This is also why fuzzing is so effective on parser, fuzzers are great at throwing many different combinations at the wall until they find a new interesting edge case, and jumping off from there to see if they can mutate it into more.

Re:Why did the OpenSSL punycode vulnerability happen by ahartmetz on Wednesday November 02, 2022 @07:34PM (#33444370)
You are of course correct. This also ties into my sibling comment - the cleverness in clever low-level parsing code is based on assumptions that may be wrong for some part of the huge input space.