Improving the state of go-fuzz

Summary: A Trail of Bits winternship project made three improvements to go-fuzz, the coverage-based fuzzer for Go: fixing a crash tied to Go 1.16's change of os.FileMode into a type alias for fs.FileMode, adding AFL/libFuzzer-format dictionary support via a -dict parameter, and developing new mutation strategies including repeated-byte insertion, byte shuffling, and LEB128 integer literal encoding. The tool has helped find more than 200 bugs highlighted on GitHub, and the author notes go-fuzz has reached end of life following Go 1.18's first-party fuzzing support, with future work likely limited to bug fixes.
Why it matters: The crash fix matters because the bug only appeared with Go 1.16 and higher and broke instrumentation for any project touching the file system through the os package, and the only workarounds were manually editing code or downgrading to Go 1.15. With Go 1.18 shipping native fuzzing, teams still running go-fuzz in older projects inherit a tool whose upstream future is now bug fixes only.

Read the original at Trail of Bits Blog ↗