search

pion / sdp

A Go implementation of the SDP
https://pion.ly/
MIT License
148 stars 56 forks source link

Port old fuzzing code to Go's new fuzzing tools #148

Closed stv0g closed 1 year ago

stv0g commented 1 year ago

As introduced by Go 1.18

See: https://go.dev/security/fuzz/

tanghaowillow commented 1 year ago

Hi, I am new to this project. May I have a try on this? @stv0g

stv0g commented 1 year ago

Yes definitely! Just let me know if I can guide you or you need some other support.

tanghaowillow commented 1 year ago

Yes definitely! Just let me know if I can guide you or you need some other support.

Thanks! Actually I do have several questions：

  1. I found that some of inputs generated by go-fuzzing did make sdp Unmarshaling crash in the 'parseTimeUnits' function. I believe it is a bug here so am I supposed to fix it in the same PR? or I should make it a new issue?
  2. Does it also need fuzzing test for sdp marshaling? If it is needed, there are so many fields in the sdp which makes the fuzzing test needs many arguments. I couldn't find a proper way to implement it.
stv0g commented 1 year ago

I would do it in the same PR. Ideally in a separate commit.

And I think fuzzing is only really useful to test against maliciously crafted input data. Like SDPs received over the network.

So whenever we must process some external data..