|
|
Every fuzz so far issued independent invokes with a freshly built buffer, which cannot
reach defects needing a sequence of create, use, destroy and use again, precisely the
shape of the known lifetime defects, and an earlier pass recorded that the generic handle
test was too coarse to rediscover them.
The new fuzzer carries state instead, leaving the buffer exactly as the previous invoke
left it so handles the application emits are fed straight back to it on the next command,
including after whatever command might free them, with half the steps additionally
perturbing a few dwords of the carried content. Detection covers non-benign status,
stalls, writes past the window and drift in a periodic fixed re-probe, drift being the
signature of corrupted internal state.
Across six applications and seventy-five hundred state-carrying invokes there is no status
anomaly, no stall, no out-of-bounds write and no drift, so no observable internal-state
corruption accumulates over long sequences. The axis on which coverage was weakest is now
the same as the others, with a working control established before each run and re-checked
periodically. The objective is not met.
|
