News for hackers. Stuff that matters.

A comment on Why CVE-2022-3602 was not detected by fuzz testing. Parent comment

Re:Why CVE-2022-3602 was not detected by fuzz testing by cryptonector on Monday November 21, 2022 @03:08PM (#33697250)
The OpenSSL team is actually very good and they do very good work, and they even have funding. The problem is that legacy never goes away, and OpenSSL is a huge pile of legacy code, and it will take a long long time to a) fix all the issues (e.g., code coverage), b) migrate OpenSSL to not-C or the industry to not-OpenSSL.
[ Parent | on HN ]
Re:Why CVE-2022-3602 was not detected by fuzz testing by cjbprime on Tuesday November 22, 2022 @12:45AM (#33702473)
This vulnerable parser of attacker-controlled remote input was written from scratch in C in 2020, without a fuzz harness even though OpenSSL is critical infrastructure and is already hooked up to oss-fuzz.

It is simply difficult to reconcile these facts with the idea that it is a very good team doing very good work.

[ Parent | on HN ]