[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    Re: [oss-security] Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz
From:       Bob Friesenhahn <bfriesen () simple ! dallas ! tx ! us>
Date:       2019-06-24 16:42:17
Message-ID: alpine.GSO.2.20.1906241135310.23351 () scrappy ! simplesystems ! org
[Download RAW message or body]

On Mon, 24 Jun 2019, Stuart D. Gathman wrote:
>
> Question: is fuzzing useful for languages like Java/python?  Obviously,
> you eventually reach a native code module in both cases, but fuzzing the 
> entire virtual machine is cumbersome.  Maybe native code libraries
> for "safe" languages should include fuzzing as part of testing.

There is nothing about languages like Java and Python which 
necessarily makes them safe.  Access outside of memory bounds is just 
one issue which often afflicts C/C++.  Java and Python can easily do 
something wrong such as use all available resources or never finish. 
In the case of Python, Python can easily make arbitrary calls into C 
code under control of the script.

Bob
-- 
Bob Friesenhahn
bfriesen@simple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/
Public Key,     http://www.simplesystems.org/users/bfriesen/public-key.txt
[prev in list] [next in list] [prev in thread] [next in thread]