Practical Fuzzing in Go
summary
Shows that Go fuzzing uncovers real, surprising bugs: a tiny atoi-like function yields 3 crashes in 3 seconds from inputs with leading zeros; fuzzing also finds a JSON panic fixed before Go 1.13 and sent Chrome a parser bug that earned $8,000. Uses byte-slice targets that transform into inputs, returns relevance codes, and adds crashes to unit tests. Recommends using a saved corpus, OSS-Fuzz or local go fuzz tooling, watch out for >5000 branches coverage limits, and run continuous fuzzing for long-lived projects.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:50What is unit tests
- 6:17Crashes
- 7:23Why fuzz
- 13:06Toolschain
- 14:56Monitoring
- 15:47Overstate
- 18:30Fuzzing
- 24:15Questions
related talks
18mFuzzing in Go
39mFuzzing Session: Finding Bugs and Vulnerabilities Automatically
31m“Fuzz or lose..."
44mFuzzing in Go: Fear, Despair, Acceptance and the Long-Awaited Success
53mFuzzing 101
44mFuzzing in Go: Fear, Despair, Acceptance and Long-Awaited Success ☠️
25mHow fuzzing helps to find bugs
01h 15mMake your programs more reliable with Fuzzing