About Archive Tags RSS Feed


If line-noise is a program, all fuzzers are developers

29 February 2016 21:50

Recently I had a conversation with a programmer who repeated the adage that programming in perl consists of writing line-noise. This isn't true but it reminded me of my love of fuzzers. Fuzzers are often used to generate random input files which are fed to tools, looking for security problems, segfaults, and similar hilarity.

To the untrained eye the output of most fuzzers is essentially line-noise, since you often start with a valid input file and start flipping bits, swapping bytes, and appending garbage.

Anyway this made me wonder what happens if you fed random garbage into a perl interpreter? I wasn't brave enough to try it, because knowing my luck the fuzzer would write a program like so:

system( "rm -rf /home/steve" );

But I figured it was still an interesting idea, and I could have a go at fuzzing something else. I picked gawk, the GNU implementation of awk because the codebase is pretty small, and I understand it reasonably well.

Almost immediately my fuzzer found some interesting segfaults and problems. Here's a nice simple example:

 $ gawk 'for (i = ) in steve kemp rocks'
 gawk: cmd. line:1: fatal error: internal error: segfault

I look forward to seeing what happens when other people fuzz perl..



Comments on this entry

icon mirabilos at 14:02 on 29 February 2016

Usually, 'perl </dev/arandom' aborts with a syntax error.

One day I had it actually do something before doing so. That scared me.

icon Jakub Wilk at 15:09 on 29 February 2016

See http://lcamtuf.coredump.cx/afl/#bugs, grep for "perl".

icon Olly Betts at 20:24 on 1 March 2016

This is also a valid program for gawk:

system( "rm -rf /home/steve" );

icon Faheem Mitha at 15:18 on 10 April 2016

Hi Steve,

Your post is missing the crucial detail of how you implemented your fuzzer.

Regards, Faheem Mitha

icon Steve Kemp at 17:17 on 10 April 2016

Faheem, as per the previous entry I used the well-known fuzzer American Fuzzy Lop.