If line-noise is a program, all fuzzers are developers

Monday, 29 February 2016

Recently I had a conversation with a programmer who repeated the adage that programming in perl consists of writing line-noise. This isn't true but it reminded me of my love of fuzzers. Fuzzers are often used to generate random input files which are fed to tools, looking for security problems, segfaults, and similar hilarity.

To the untrained eye the output of most fuzzers is essentially line-noise, since you often start with a valid input file and start flipping bits, swapping bytes, and appending garbage.

Anyway this made me wonder what happens if you fed random garbage into a perl interpreter? I wasn't brave enough to try it, because knowing my luck the fuzzer would write a program like so:

system( "rm -rf /home/steve" );

But I figured it was still an interesting idea, and I could have a go at fuzzing something else. I picked gawk, the GNU implementation of awk because the codebase is pretty small, and I understand it reasonably well.

Almost immediately my fuzzer found some interesting segfaults and problems. Here's a nice simple example:

 $ gawk 'for (i = ) in steve kemp rocks'
 gawk: cmd. line:1: fatal error: internal error: segfault

I look forward to seeing what happens when other people fuzz perl..



Comments On This Entry

[gravitar] Jakub Wilk

Submitted at 15:09:57 on 29 February 2016

See http://lcamtuf.coredump.cx/afl/#bugs, grep for "perl".

[gravitar] mirabilos

Submitted at 14:02:56 on 29 February 2016

Usually, 'perl </dev/arandom' aborts with a syntax error.

One day I had it actually do something before doing so. That scared me.

[gravitar] Olly Betts

Submitted at 20:24:20 on 1 March 2016

This is also a valid program for gawk:

system( "rm -rf /home/steve" );

[gravitar] Faheem Mitha

Submitted at 15:18:18 on 10 April 2016

Hi Steve,

Your post is missing the crucial detail of how you implemented your fuzzer.

Regards, Faheem Mitha

[gravitar] Steve Kemp

Submitted at 17:17:01 on 10 April 2016

Faheem, as per the previous entry I used the well-known fuzzer American Fuzzy Lop.


Comments are closed on posts which are more than ten days old.