Fuzzing Ruby and C Extensions
summary
Fuzzing Ruby C extensions with AFL and dockerized builds finds real bugs fast: a double-free in a CSV C parser that crashes in ~20s, null-pointer and a stack buffer overflow in the Ox XML extension (one crash from minutes, another in hours), and multiple crashes in the yajl JSON gem; AddressSanitizer (ASAN) confirms memory corruption. Setup uses persistent AFL harnesses that require compiling Ruby with AFL and grammar‑aware generation via ANTLR/Grammarinator to produce syntactically valid Ruby inputs; fixes were submitted and deployed.
AI-written summary · about
chapters (17)
- 0:00Introduction and background
- 3:20Ruby gems and C extensions
- 8:08Why start fuzzing
- 9:17What is fuzzing
- 13:54AFL instrumentation and setup
- 15:40Fuzzing C extensions in Ruby
- 18:14First findings: BC CSV double free
- 21:05Double free vulnerabilities explained
- 21:27OX parser null pointer crash
- 22:09OX parser stack overflow
- 23:38YAJL JSON parser crashes
- 25:22GitHub dependency security
- 27:10Crash impact on Rails apps
- 28:57Memory leaks in Ruby libraries
- 30:00Fuzzing Ruby itself
- 30:41Grammar-based fuzzing
- 32:09Final thoughts and Q&A
related talks
45mFuzzing with AFL
43mThe Aftermath of a Fuzz Run: What to do about those Crashes?
25mHow fuzzing helps to find bugs
01h 15mMake your programs more reliable with Fuzzing
52mStructure aware fuzzing
20mAFL++ : Combining Incremental Steps of Fuzzing Research
24mWhy you should be using automated fuzzing to test for security issues in your code
53mFuzz Testing for Fun and Profit