Fuzzing PostgreSQL

on YouTube ↗24m

" summary

Shows applying fuzzing to Postgres’ client library libpq, building minimal harnesses that feed mutated protocol inputs directly into library entry points, and running AFL and honggfuzz; an experiment hits ~40 execs/sec with full coverage instrumentation versus a faster run at ~7,000 execs/sec. Describes practical pitfalls: PostgreSQL is stateful with one-process-per-connection, TCP setup slows fuzzing, and hardcoded length parameters must be included in fuzzer input to reach deeper branches. Prior work finds a few real bugs; continuous fuzzing on PG remains an open effort.

AI-written summary · about

" chapters (12)

1. 0:00Music & introduction
2. 0:47Speaker intro: security and systems background
3. 1:39What is fuzzing? From random to coverage feedback
4. 5:00Toy C program: 6 branches to a hidden crash
5. 8:28Fuzzers in action: AFL and Honggfuzz
6. 10:36Pulling JPEGs out of thin air: fuzzers as learners
7. 11:56Testing is polite, fuzzing is rude
8. 13:37Why fuzz PostgreSQL? An attack-surface map
9. 16:33Networking protocol and libpq as the high-value target
10. 17:00Prior talks and the challenges of fuzzing Postgres
11. 20:21A simpler harness approach and live demo
12. 22:20Lessons learned and what's next

" related talks

• 50mHacking on Postgres: An OverviewJames Coleman · PGConf NYC 2022
• 13mWingFuzz: Implementing Continuous Fuzzing for DBMSsYu Jiang, Jie Liang, Zhiyong Wu, Jingzhou Fu, Yiyuan Bai, Qiang Zhang · USENIX ATC 2024
• 53mFuzz Testing for Fun and ProfitMELISSA BENUA · BSides Huntsville 2021
• 45mFuzzing with AFLErlend Oftedal · NDC TechTown 2018
• 51mHow does PostgreSQL actually workPeter Eisentraut · PGConf Silicon Valley 2016
• 18mAccelerating Fuzzing through Prefix-Guided ExecutionShaohua Li, Zhendong Su · OOPSLA 2023
• 48mWho's the Fairest of Them All? Postgres Interface PerformanceJoe Conway · PostgresOpen 2014
• 53mFuzzing 101Kamil Frankowicz · 4Developers 2022 Online