April 28, 2012

Testing Firefox and Chrome on fuzzed SVG files

Fuzzer: My first SVG fuzzer (called SVGz)
Options: Switch two randomly selected tags (which is the only one mode at the moment)
Number of template files: 659
Size of the smallest template file: 140 byte
Size of the largest template file: 32M
Number of mutated files to test with: 222,888

Firefox: One crash - Bug 747661
Chrome: Some crashes with similar state - Issue 124585

Neither of crashes are exploitable for code execution.

The SVG files were processed in the same browser instance until crash occurred, to save some time that bootstrap and shutdown would require. Firefox and Chrome were tested simultaneously, and the test took about 4 days to complete.
  This blog is written and maintained by Attila Suszter. Read in Feed Reader.