Re:Why CVE-2022-3602 was not detected by fuzz testing
by stefan_ on Monday November 21, 2022 @11:27AM
(#33694365)
No one is asking for that. But this is code that did one thing: punycode decoding, with millions of well documented test vectors. The code had zero dependencies on anything OpenSSL related. It is a very simple "text in, text out" problem, the most trivial thing to write unit tests for. At the same time, it's code that parses externally provided buffers and has to deal with things like unicode in C - there should be a massive red flashing warning light in every developers head here.
[ Parent
| on HN ]
There are no comments on this comment yet.