Valid
data[0] ─┐
data[1] │
data[2] │
data[3] ─┘

Invalid
data[10] → Out of bounds

We call this situation "out of bounds read"

That is, the program is reading from outside the range intended for the array

Now from the perspective of a reverse engineer

Suppose we have a Crash and the Stack Trace shows this

Process number 0
Original number 1

So we go into "process"

Empty process (int index) {

int data[4];

printf("%d\n", data[index]);
}

Here we quickly look for patterns like this

Array[index]

Next we need to figure out where "index" came from

Index
↓
Where did it come from
↓
Confirmed
↓
Was the upper bound checked?

For example, if there is access to such a check

if (index < 0 || index >= 4)
return;

The program will prevent this situation before accessing invalid

But if there are no such checks

Index
↓
Array[index]
↓
Check without restrictions
↓
Access out of bounds

The probability of a bug is much higher

The main goal of Crash Triage

In the end, we want to reduce thousands of crashes to a few limited and checkable ones

For example

1000 crashes
↓
250 crash groups
↓
20 unique crashes
↓
7 root causes
↓
7 bugs

That is, the job of the Fuzzer is to try a lot of different inputs and find unusual behaviors

But then we need to understand what exactly these behaviors are

This is where we get into the story

Fuzzer
↓
Crash
↓
Crash triage
↓
Crash non-recurrence
↓
Root cause analysis

In essence, the Fuzzer says

Something strange happened somewhere in the program

We need to understand

Where

Why

And exactly what caused it This is exactly where Fuzzing and we connect

@reverseengine