News for hackers. Stuff that matters.

A comment on Google pushes emergency Chrome update to fix 8th zero-day in 2022. Parent comment

Re:Google pushes emergency Chrome update to fix 8th zero-day... by mk89 on Friday November 25, 2022 @02:38PM (#33746005)
My understanding though is that the ASAN would have done its job, had the test checked for the results. Quoting from the post:

> This fuzzer might have produced a SECKEYPublicKey that could have reached the vulnerable code, but as the result was never used to verify a signature, the bug could never be discovered.

If the result had been used, the ASAN would have kicked in, I guess, or?

[ Parent | on HN ]
Re:Google pushes emergency Chrome update to fix 8th zero-day... by pjmlp on Friday November 25, 2022 @02:46PM (#33746066)
Well, it is a lot of conditionals, and in any case binaries are seldom shipped with ASAN into production, so it would still be a lottery outcome if the fuzzer would have generated that specific use case.
[ Parent | on HN ]