From c42e54780cafa2a9b39ba22b0662fa674e58b112 Mon Sep 17 00:00:00 2001 From: Alex Hultman Date: Wed, 13 Mar 2019 17:41:54 +0100 Subject: [PATCH] Update README.md --- fuzzing/README.md | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/fuzzing/README.md b/fuzzing/README.md index 64f20fc..4660ade 100644 --- a/fuzzing/README.md +++ b/fuzzing/README.md @@ -1,5 +1,15 @@ -# Fuzz-testing of parsers +# libFuzzer/AddressSanitizer fuzz-testing of various parsers Here we do coverage-based fuzzing of code responsible for parsing arbitrary network data. -A secure web server must be capable of receiving mass amount of malicious input without showing signs of weakness. Test code is being bombarded with evolving random data, with fitness determined by coverage - the goal of seeking out as much of the program state space as possible. This is done while AddressSanitizer monitors the program for memory correctness. \ No newline at end of file +A secure web server must be capable of receiving mass amount of malicious input without misbehaving or performing illegal actions. Test code is being bombarded with evolving random data, with fitness determined by coverage - that is we aim to seek out as much of the "branching space" of the program as possible. This is done while AddressSanitizer monitors the program for memory correctness. + +Currently the following parts are individually tested: + +* WebSocket handshake generator +* WebSocket message parser +* WebSocket extensions parser & negotiator +* Http parser +* Http method/url router + +No defects or issues are left unfixed.