Software Testing

Exercise Question

How can we make sure that vulnerabilities that do not lead to a program crash (non-crashing vulnerabilities) are not overlooked during fuzzing?

Use 'sanitizers' to detect vulnerabilities that don't lead to program crashes:
  • Address sanitizer: Detect memory-related vulnerabilities
  • UB sanitizer: Detect undefined behavior in C/C++ programs
  • Thread sanitizers: Help to reveal concurrency-related bugs

Diskussion