Third-party cyber evaluations involving OpenAI models
openai.com·13h ago
Security
Trail of Bits Blog·May 12·5 min read
Go fuzzing was missing half the toolkit. We forked the toolchain to fix it.
TL;DR
Go's native fuzzing (automated testing that generates random inputs to find bugs) lacks capabilities standard in Rust and C++ ecosystems, missing detection of integer overflows, goroutine leaks, data races, and timeouts. Trail of Bits built gosentry, a fuzzing-oriented fork of the Go toolchain that extends Go's testing.F workflow with enhanced bug detection.
✦ Why It Matters
Engineers can now detect critical bugs in Go code that native fuzzing misses, improving reliability without rewriting tests.
Key Takeaways
- Integrate gosentry into your Go projects for better fuzzing results.
- Utilize grammar-based fuzzing to improve input quality.
- Leverage existing Go fuzz harnesses without rewriting code.
- Run fuzzing campaigns to detect critical bugs in your applications.
How It Works
Gosentry enhances Go fuzzing by using LibAFL as its underlying engine, allowing for structured and grammar-based fuzzing. It captures fuzz callbacks and builds Go archives with libFuzzer-style entry points, enabling developers to work within a familiar API while benefiting from advanced fuzzing techniques.