Hacker GitHub

← All repos

rust-fuzz/trophy-case

View on GitHub ↗ ★ 456

🏆 Collection of bugs uncovered by fuzzing Rust code

14 mentions on Hacker News by 8 people: 1 story, 13 comments · first 2017-07-12 · latest 2026-07-03

Mentions per year 14 mentions · busiest year 2021 (4)
20082026
AllStoriesComments NewestTopOldest
  1. …https://infosec.exchange/@littlealex/116838684458539473 ) It's better to look at broader data, e.g. https://github.com/rust-fuzz/trophy-case - look how much lower typical severity is there. And you can look at data from Google where they…
    comment by pornel · 2026-07-03 · in The C to Rust migration book
  2. …improvement isn't disproven by contradiction. Anecdote is not data. Look at a bigger dataset, e.g. https://github.com/rust-fuzz/trophy-case there's a ton of overflows that result in caught panics or OOMs, and not bypasses. It works to…
    comment by pornel · 2026-06-14 · in Twenty One Zero-Days in FFmpeg
  3. …checks were redundant, and they weren't. This overprotectiveness by default turns out to be useful: https://github.com/rust-fuzz/trophy-case Look how many of the crashes are panics and unwraps that could have been buffer overflows or wild…
    comment by pornel · 2024-02-28 · in Rewrite the VP9 codec library in Rust
  4. …And it delivers: see how memory unsafety is rare compared to assertions and uncaught exceptions: https://github.com/rust-fuzz/trophy-case • Many of the memory-unsafety issues are on the C FFI boundary, which is unsafe due to C lacking…
    comment by pornel · 2021-12-02 · in This shouldn't have happened: A vulnerability postmortem
  5. …or logic errors leading to resource exhaustion, but plain old memory corruption is quite rare: https://github.com/rust-fuzz/trophy-case
    comment by pornel · 2021-07-16 · in Is Rust Used Safely by Software Developers?
  6. …still very relevant in Rust. It tends to find panics rather than segfaults, but that's still bugs. https://github.com/rust-fuzz/trophy-case
    comment by steveklabnik · 2021-02-24 · in Add experimental fuzz test support for Go 1.17
  7. To add data on the Rust side: https://github.com/rust-fuzz/trophy-case there are a few Rust ASN implementations. They've been caught running out of memory and having arithmetic overflows, but no segfaults or use-after-frees. Rust doesn't…
    comment by pornel · 2021-02-09 · in Dependency on rust removes support for a number of platforms
  8. …safety issues; by contrast, very few of the Rust issues were, with most being safe panics. [1]: https://github.com/rust-fuzz/trophy-case [2]: http://lcamtuf.coredump.cx/afl/
    comment by pcwalton · 2019-08-30 · in Linux kernel drivers in Rust might become an option in the future
  9. …code is far less vulnerable than C or C++ code. For example this list of bugs found via fuzzing: https://github.com/rust-fuzz/trophy-case Almost none of those bugs were security-sensitive. Compare to similar lists for C and C++ projects,…
    comment by roca · 2019-08-30 · in Linux kernel drivers in Rust might become an option in the future
  10. …rust-fuzz trophy list includes only one UAF, one uninitialized memory read, and no segfaults. :) https://github.com/rust-fuzz/trophy-case
    comment by cpeterso · 2018-11-05 · in Generating Software Tests: Breaking Software for Fun and Profit
  11. …(AFL, LibFuzzer, and Honggfuzz). [1] https://github.com/rust-fuzz/targets [2] see the trophy case: https://github.com/rust-fuzz/trophy-case [3] https://github.com/rust-fuzz/targets/blob/master/common/src/... Disclaimer: I'm a member of…
    comment by paulgdp · 2018-11-05 · in Generating Software Tests: Breaking Software for Fun and Profit
  12. …billion(!) fuzz iterations, I found 5 bugs (see the 'vobsub' section of the trophy case for a list https://github.com/rust-fuzz/trophy-case ). Happily, not one of those bugs could actually be escalated into an actual exploit. In each case,…
    comment by ekidd · 2017-09-27 · in Chrome OS KVM - A component written in Rust
  13. …better than C in this case. You can find a list of my vobsub bugs in the Rust Fuzz Trophy Case: https://github.com/rust-fuzz/trophy-case They are: 1. The shift overflow: This was harmless in both C and Rust, I believe. 2. The arithmetic…
    comment by ekidd · 2017-07-12 · in Why you should, actually, rewrite some of it in Rust