Re: [libvirt] [GSOC] project libvirt fuzzing

On Thu, Mar 16, 2017 at 1:29 PM, Daniel P. Berrange <berrange(a)redhat.com&gt; wrote: Hi all, I am reviewing the feedbacks of this thread, and I would like to revisit some topics. I think this project is more about finding bugs in libvirt, when using fuzzing, especially the implications would be security vulnerabilities. Thus the input file could be anything that pretend to be legitimate xml, which potentially would crash the target program, such as virsh. Depending on the exact fuzzer, being either mutational or generational, or even hybrid, the fuzzer engine and the executor will take care most of the work including input file generation, mutation, testing, recording, and reporting. Fuzzing will allow us to reproduce the bugs with the recorded culprit xml file, then we have a case where we find a bug. It is totally a lazy person's tool to do software testing, without writing much code. Therefore, I am modifying this project a little towards be a CI fuzzing testing framework, potentially a deliverable product presenting a centralized real-time status of online fuzzing information, integrated with libvirt existing toolchain. The components of the framework incorporates fuzzer manager, a panel of open source fuzzer engines, executor, CI and dashboard system. There are related works such as oss-fuzz. However, the most obvious difference is that here it can be potentially closely integrated into existing libvirt community workflow, or any other open source community of the like who would like to have their own fuzzing CI with flexible and version-ed configuration. Dan |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/