Fuzzing rust-minidump for Embarrassment and Crashes – Part 2

Going into this project I was very high on the idea of "different architectures should get completely independent stackwalker backend implementations" (although they call in to some agnostic machinery for CFI/symbols/registers). There are lots of platform-specific hacks and making everything super abstract is a big mess!

But geez I have been burned a few too many times on the parts that are the same between some arches accidentally diverging because I forgot to copy-paste between them. :(

(breakpad also has this approach and you can reaaaallly see the pain of this approach as every stackwalker has gotten wildly inconsistent TLC so some have tons of fancy machinery and some are super barebones. Makes it hard to tell if the divergence is intentional or just an artifact of independent code.)

It's crazy how much fuzzing has changed in a decade. The fact that you can just write some code in your native language and get top quality fuzzing is incredible. You used to have to put 'pits' together and run peach or honestly just roll your own, no way you'd have access to the instrumentation at the level we do now.

The 'rust fuzzing' experience is really solid. You just 'derive' your way through it and you're 99% done.

> It’s quite natural and more efficient to start this process with something like Vec::with_capacity(list_length). Usually this is fine, but if the minidump is corrupt (or malicious), then this length could be impossibly large and cause us to immediately OOM.

That's a fun one. I `with_capacity` all the time and I guess I hadn't really thought too much about whether the value I pass in is strictly valid every time. Food for though.

Anyway, awesome write up, and great nod to Mario universes, which itself is a wild ride.

This is now one of my favorite blogs on the punchy and hilarious writing alone (the technical subject matter seems serious as hell too).

“360 dunked on from outer space”, we’ve all been there but still, /r/brandnewsentence.