Version 4.1

Presentation: Testing your code for security issues with automated fuzzing

Event large

Writing secure code that deals with potentially untrusted data (parsers, importers, etc) is always hard since there are many potential cases to take into account.

One of the techniques used to improve the security of such code is fuzzing.

Fuzzing involves providing invalid or random data to a given piece of code to test its behaviour.

Modern fuzzers are smart enough to understand what needs to be changed in the input to make the code go through a different code path making testing faster and more complete.

oss-fuzz is a Free set of tools to make fuzzing of C/C++ code easier.
It is comprised of various scripts and docker images, which, for example, have the base system libraries already compiled with the sanitizers.

Coupling a fuzzer with the compiler sanitizers (asan, ubsan, msan) gives even better results since these sanitizers will make sure the code is run more strictly.

In this session we'll show how to fuzz a C++ codebase, as well as give you an update on how we're using these tools.

Info

Day: 2019-09-07
Start time: 14:35
Duration: 00:30
Room: U4-01
Track: Development

Links:

Files

Concurrent Events