Making Fuzzing Part of Your Software Development Lifecycle
summary
Explains how coverage-guided fuzzing plus sanitizers finds deep bugs by spending compute not developer time, and how libFuzzer/AFL++ feed harnesses into ClusterFuzz for continuous builds, deduplication, minimized testcases and bisection. Describes OSS-Fuzz as a free ClusterFuzz service used by open source projects and claims OSS-Fuzz (40,000 bugs, 9,000 security). Covers kernel tools Syzkaller/Syzbot, differential fuzzing (crypto_fuzz), and a lighter CI workflow ClusterFuzzLite 10-minute CI that runs targeted fuzzers on pull requests.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:41Who Cares?
- 3:18What is Fuzzing?
- 4:09The Early Days
- 5:12First Generation Fuzzers
- 6:54Hacker Technique
- 7:53Good Tests
- 12:53Unittest-style Fuzzing
- 14:28Sanitizers
- 16:40Non-C++ Bugs: Denial of Service
- 17:43Non-C++ Bugs: Differential Fuzzing
- 18:54Non-C++ Bugs: Other Vulnerability Classes
- 23:24Coverage Reports
- 23:56How To Get a ClusterFuzz Style Workflow
- 25:28Running Your Own Full Scale Infrastructure
- 29:39ClusterFuzzLite: Build Integration
- 30:55Smart Fuzzer Selection
- 32:46Questions?
related talks
25mHow fuzzing helps to find bugs
01h 15mMake your programs more reliable with Fuzzing
01h 00mClusterFuzz: Fuzzing at Google Scale
53mFuzzing 101
31m“Fuzz or lose..."
24mWhy you should be using automated fuzzing to test for security issues in your code
01h 39mFuzzing in the open: Integrate your project in OSS-Fuzz for continuous fuzzing
44mOSS-Fuzz - Google's continuous fuzzing service for open source software