Defensive Programming at cURL
summary
cURL claims deployment in 10 billion installations and remains C code with tightened limits on string growth and unified buffer handling to avoid integer overflows. The project runs 90+ CI builds per commit, about 1,400 test cases and ~170k LOC, uses oss-fuzz plus a 40 minutes of fuzzing per PR ci-fuzz window, eight+ static analyzers, Valgrind/sanitizers, and a torture test that forces each alloc to fail once; a bug bounty offers up to $12k (paid so far $2,800).
AI-written summary · about
chapters (11)
- 0:00Start
- 2:30Safe Defaults
- 14:54Running All the Test Servers on Random Port Numbers
- 16:07Inspection Tools
- 17:11Fuzzers
- 17:45The Ci Fast Project
- 18:27Torture Tests
- 20:07Third-Party Dependencies
- 20:36Curl Bag Bounty
- 26:08If You Were To Start Curt from Scratch Nowadays Would You Consider a More Memory Safe Language or Do You Absolutely Need C for Portability
- 31:20Did You Ever Think Curl Will Be Used As Much as It Is as It Is Used Today
related talks
29mSecuring C code that seems to work just fine
22mWriting safe and secure code
38mcurl | bash | hacked: The Unseen Dangers in Your Dev Lifecycle
17mTools & training for more secure software
01h 06mDefensive Programming Done Right, Part II
42mContemporary Automatic Program Analysis
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
25mThe Art of Defensive Programming