Lingolol

0 posts0 participants0 posts today

danzinAnother tidbit from the report I'm writing about <a href="https://mastodon.social/tags/fusil" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fusil</a>:The 52 issues filled correspond roughly to 30% of all the crashes (issues with "type-crash" label) and 2% of all issues (features requests, bugs and invalid issues) reported in the <a href="https://mastodon.social/tags/CPython" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CPython</a> issue tracker during the six months period covered by the report.Hits and new issues don't appear at a steady pace. It seems that there are long periods of no or nearly no new issues, followed by rapid finding of new results.<a href="https://mastodon.social/tags/fuzzing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fuzzing</a> <a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Python</a>

danzin<a href="https://mastodon.social/tags/Fusil" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fusil</a> works by generating source files with random calls, using interesting arguments, then monitoring their execution and output. It usually finds crashes resulting from the processing of invalid objects and unexpected call patterns.Fusil was created by <a href="https://mamot.fr/@vstinner" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@vstinner</a>.Features added by me include running generated code in parallel threads, testing class instances in addition to classes and functions, and using new interesting objects/values as inputs.<a href="https://github.com/issues/created?q=is%3Aissue%20author%3Adevdanzin%20-repo%3Adevdanzin%2Ffusil%20fusil%20%20sort%3Acreated-asc" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/issues/created?q=is%3Aissue%20author%3Adevdanzin%20-repo%3Adevdanzin%2Ffusil%20fusil%20%20sort%3Acreated-asc</a><a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Python</a> <a href="https://mastodon.social/tags/fuzzing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fuzzing</a>

danzinWriting about <a href="https://mastodon.social/tags/fusil" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fusil</a>. Some bits:Fuzzing <a href="https://mastodon.social/tags/CPython" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CPython</a> with fusil shows it to be a valuable tool for finding and fixing crashers. It started in October 2024 and is ongoing, using free tier cloud instances and personal computers.Results: - Fuzzing time: > 25.000 hours - Fuzzing sessions: > 1.000.000 - Hits: > 50.000 - Issues filled: 52The original design of fusil makes it well-suited for fuzzing CPython, finding both deep, relevant bugs as well as shallow, low value crashes.<a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Python</a> <a href="https://mastodon.social/tags/fuzzing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fuzzing</a>

danzinDo you maintain or contribute to a <a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Python</a> package that includes a C extension? Would you like to run a fuzzer against it?If so, let me know and I will run it, or help you to get it running. The fuzzer is <a href="https://mastodon.social/tags/fusil" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fusil</a>, which generates random code calling into your functions and methods. It's useful to check for crashes on invalid inputs or unexpected call patterns.It has found about 50 crashes in <a href="https://mastodon.social/tags/CPython" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CPython</a>, 20 in <a href="https://mastodon.social/tags/PyPy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PyPy</a>, 6 in <a href="https://mastodon.social/tags/Numpy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Numpy</a> etc.<a href="https://mastodon.social/tags/fuzzing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fuzzing</a> <a href="https://mastodon.social/tags/fuzzer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fuzzer</a> <a href="https://mastodon.social/tags/testing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#testing</a> See here: <a href="https://github.com/devdanzin/fusil/issues/37" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/devdanzin/fusil/issues/37</a>

danzinWe're up to 30 <a href="https://mastodon.social/tags/CPython" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CPython</a> crashers found using <a href="https://mastodon.social/tags/Fusil" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fusil</a> this year, about 90% of them considered valid.In 2008, I had reported 5 cases using the same <a href="https://mastodon.social/tags/fuzzer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fuzzer</a>, 4 of which were release blockers.<a href="https://mamot.fr/@vstinner" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@vstinner</a>, Fusil's creator, also reported a bunch of issues with it.After running for a while (on free AWS and Oracle cloud tiers), crash hits are getting harder to find.We need new fuzzing inputs. Feel free to suggest improvements that could find new crashers.<a href="https://github.com/devdanzin/fusil" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/devdanzin/fusil</a> <a href="https://mastodon.social/tags/Python" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Python</a> <a href="https://mastodon.social/tags/Fuzzing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fuzzing</a>

Recent searches

Search options

Administered by:

Server stats:

#fusil