LCA2016 Revisited - Fuzz all the things

I actually saw this talk by Erik de Castro Lopo but didn't write about it as I arrived late and ended up sitting within arm's reach of the lectern... that and to be honest it's taken me this second viewing for it to sink in anyway.

With focus a on C / C++ Erik used his experiences with libsndfile and FLAC to provide examples of fuzzing.

The fuzzing technique provides:

• A method to test a program with random input.
• Provide a great leap forward in effectiveness.
• Allows you to find bugs before they're reported.
• Recommends AFL (American Fuzzy Lop)
• Spends some time walking through how AFL works and how to use it.
• Walked through sanitizers.
• Provides a demo you can clone from git and use.
• Covered the pro and cons rather extensively.
• Took a walk through some SSH code as example of code not designed to be fuzzed and to underscore coding with fuzzing in mind from the start.
• Provided a live demo and other cases.

An excellent talk, well worth watching if this is your field of endeavour.