Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix crashes in ParseHeaders #411

Merged
merged 1 commit into from
Dec 27, 2016
Merged

Fix crashes in ParseHeaders #411

merged 1 commit into from
Dec 27, 2016

Conversation

buger
Copy link
Owner

@buger buger commented Dec 27, 2016

This PR should fix panics inside HTTP protocol code #408, and this case is quite interesting.

I could not replicate bug manually and decided to try a fuzzing.

Fuzzing or fuzz testing is a software testing technique, often automated or semi-automated, that involves providing invalid, unexpected, or random data to the inputs of a computer program.
https://en.wikipedia.org/wiki/Fuzzing

The basic idea that it is that fuzzer is massively scaled random generator, which tries to run your function with all possible combinations. And Golang have a really nice one: https://github.com/dvyukov/go-fuzz

It's quite easy to use it, for testing proto library command was:

// Creates zip file with binary
go-fuzz-build github.com/buger/gor/proto

// Runs the fuzzer and in current directory creates 3 directories: corpus, crashers, suppressions
go-fuzz -workdir ./ -bin ./proto-fuzz.zip

After it finished, we need to look at crashers directory, which will contain file with panic trace, and actual input which caused the issue.

Take a look PR itself to understand what it does.

@buger buger changed the title Fix #408 Fix crashes in ParseHeaders Dec 27, 2016
@buger buger merged commit db1e3d7 into master Dec 27, 2016
@slimus slimus deleted the fix-proto-crash branch June 3, 2020 04:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant