Fuzzing GUI applications: AbiWord

It's relatively easy to run fuzzing for a headless application. A headless application doesn't have any GUI, and can be simply run in a terminal. You can use your favorite fuzzer, and feed fuzzed data to the application. Normally, a headless application just processes data, and then quits or crashes right away. But it may be a little different if you are trying to run fuzzing for an application with GUI. This blog post explains how to run fuzzing for AbiWord - an open source text editor.

Read more about Fuzzing GUI applications

Quick fuzzing of MessagePack

MessagePack is a serialization protocol. It has an implementation on C/C++. Let's check if it has any memory corruption issues. We'll use American Fuzzy Lop and AddressSanitizer for it.

More about MessagePack fuzzing

Fuzzing Python marshal protocol

Python's marshal module provides a serialization protocol for Python objects. It provides functionality for writing/reading Python objects in a binary format. This module is used by other Python components, for example, in .pyc files (pseudo-compiled Python code). But Python also has public API to access this serialization protocol.

Here is some results of fuzzing marshal protocol which show why it should not be used with untrusted data.