This is the mail archive of the mailing list for the glibc project.

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: is there a fuzzer for libc?

Quick update: I found regfuzz, a fuzzer for regular expressions.
A short run revealed a least 3 somewhat scary situations in regcomp:
infinite loop, quick memory exhaustion and a memory leak:
I've submitted two bugs so far; if they are considered interesting and
get fixed I can file more :)

I also wrote a naive fuzzer for wildcards and it found a buffer
overflow in fnmatch: (already fixed).


On Tue, Jun 3, 2014 at 10:34 PM, Rich Felker <> wrote:
> On Tue, Jun 03, 2014 at 11:00:44AM +0400, Konstantin Serebryany wrote:
>> Thanks for the answer -- it confirms what I concluded from a quick web search.
>> There are however some libc functions that might be easier to fuzz
>> (e.g. gethostbyname),
>> so I thought that there could be at least something.
> Sure, one class of functions that aren't too hard to fuzz is functions
> which take only integer and pointer-to-string arguments with no
> constraints on them. However it still may be hard to hit the
> meaningful cases. I think fuzzing gethostbyname would be pretty slow
> since you'd end up waiting for the dns request to fail for nearly
> every random string you generated.
> Rich

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]