Trophy case?
Ekleog opened this issue · 6 comments
Hey!
I just incidentally found a panic inside chrono, while fuzzing my web server: chronotope/chrono#941
So I'm wondering if you'd want to introduce a trophy case to cargo-bolero, similar to the one cargo-fuzz has? :)
(sorry for misclicking and creating the issue without any contents, this is now fixed)
And a follow-up commit to my own code, which even after the chrono fix was still panicking on certain remote user input (so it was a DoS): Ekleog/risuto@9c23cc8
I think I would prefer adding to https://github.com/rust-fuzz/trophy-case and just specifying the engine used and bolero. Something like:
libfuzzer + [bolero](https://camshaft.github.io/bolero/)
Nice find, BTW!
Sounds good to me! I'll submit there. Just so I don't forget about it, another one in my code this time, though related to lack of a proper API from chrono: chronotope/chrono#948 / the panic DoS fix at Ekleog/risuto@1a43970 (turns out Havana has timezone shifts that make midnight an invalid time on some dates)
Ok, I've opened rust-fuzz/trophy-case#121 ; and can now close this :)