|
|
Log in / Subscribe / Register

A fuzzy issue of responsible disclosure

A fuzzy issue of responsible disclosure

Posted Aug 17, 2022 9:22 UTC (Wed) by taladar (subscriber, #68407)
In reply to: A fuzzy issue of responsible disclosure by developer122
Parent article: A fuzzy issue of responsible disclosure

> There is not an infinite number of fuzzer-detectable bugs in any given software.

Maybe not, but there is a for all practical purposes infinite number of ways to reproduce even simple bugs. If the fuzzer reports are low effort enough and just report every reproduction instead of deduplicating the ones that cause issues in the same line with the same branches taken you might get lots and lots of effort-creating reports for every bug.

Lets say a bug is that an integer is used as a boolean and it crashes if that integer is neither 0 nor 1. Do you really want one bug report for 2,3,4,5,... each or do you want one that tells you it crashes for all values other than 0 or 1?


to post comments


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds