Security audit, fuzzing, and more testing

[DemiMarie]

Markdown implementations are often used to process untrusted input. md4c is written in C, which makes it very easy to introduce a security vulnerability. Hence, it is imperative that md4c is hardened against all possible exploits.

This includes:

• Adding always-on assertions about things like array bounds
• Intensive, repeated fuzzing with tools like afl-fuzz.
• Security auditing

[mity]

Adding always-on assertions about things like array bounds

What exactly are you calling for?

I don't think anything similar to the following snippet would really help as it would be just duplicity and would not provide any additional value:

for(i = 0; i < n; i++) {
     assert(i < n);
     ...
}

(Accessing any array outside similar loop is very rare, if present at all, in the source code.)

Intensive, repeated fuzzing with tools like afl-fuzz.

I take code correctness seriously, so I registered MD4C on Coverity Scan to perform static analysis of the code, and also collecting coverage info from the unit testing so we get an idea what code is covered by tests and what not.

Yes, I also scrutinized MD4C with afl-fuzz and with valgrind for several days on my Linux box, and I plan to repeat that after any substantial change in the source code. It already identified some bugs (e.g. #10 and numerous others found & fixed before upstreaming some patches).

On the other side, I cannot dedicate a machine for some ongoing/continuous fuzzing. It's more or less one-person pet project and I have also other projects.

I hope that in the future, MD4C could be added to Google's OSS Fuzz, when it gets open to broader set of projects.

Any better ideas? Or are you willing to provide run-time on your machine?

Security auditing

Yes. That would be cool. But I cannot do it, as it would hardly be an independent audit. So we need another (highly competent) volunteer to do it, or someone willing to pay for it. Are you any of those?

[mity]

Closing. This is kind of meta-bug, which can never be really completely fulfilled.