Lightning Talk: Securing Envoy: Catching Vulnerabilities With Continuous Fuzz Testing
Lightningat KubeCon + CloudNativeCon North America 2022 · on Tuesday, 2022-10-25· at 17:30· Grand Riverview Ballroom AB·
summary
An out of bounds bug in an unescape routine is reproduced by a one-parameter fuzz input that exposes a trailing backslash causing undefined behavior in C++ when an index is incremented twice. A three-line libFuzzer harness feeding a protocol buffer string schema runs 24/7 with C++ sanitizers and coverage-guided feedback, integrated with OSS-Fuzz or self-hosted ClusterFuzz, and surfaces real parser crashes so fixes land before releases.
AI-written summary · about
related talks
28mFuzz Testing of Envoy
01h 15mMake your programs more reliable with Fuzzing
31m“Fuzz or lose..."
25mHow fuzzing helps to find bugs
52mStructure aware fuzzing
53mThree Colours of Fuzzing: Reflections and Open Challenges
39mMaking Fuzzing Part of Your Software Development Lifecycle
33mDifferential Fuzzing on Lightning Network