Add minimal truncation-based image fuzzing harness #42
Conversation
Summary of ChangesHello @Pragnasri-363, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a new, minimal fuzzing harness designed for developers to manually test the robustness of BHV's image handling logic. By systematically truncating valid image files and feeding these malformed inputs into the system, the harness aims to uncover potential vulnerabilities, crashes, or unexpected behaviors in image parsing and validation. This initiative strengthens the application's security posture by ensuring graceful error handling for corrupted or adversarial image uploads, without relying on complex, production-level fuzzing infrastructure. Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a minimal but effective truncation-based fuzzing harness for image uploads. This is a great initiative to improve the robustness and security of image parsing logic. The implementation is straightforward and well-documented in the new security/README.md.
My review includes a critical fix for the instructions in the README to ensure they are runnable, and a refactoring suggestion for the truncate_image function in the Python script to improve its clarity, documentation, and adherence to Python conventions. Overall, this is a valuable addition.
| print(f"[!] Bad seed image {image_path}: {e}") | ||
| return None | ||
|
|
||
| def truncate_image(ip_path,op_path): |
There was a problem hiding this comment.
The truncate_image function can be improved for clarity and adherence to Python conventions:
- Inconsistent Return Types: The function returns
Falseon one path andbyteson another. Since the caller doesn't use the return value, it's more idiomatic for functions that primarily cause side effects (like writing a file) to have no return value. - Code Formatting: There are extra blank lines that can be removed for conciseness.
- Documentation: The explanatory comment on line 64 is very helpful but contains a typo ('alway'). It would be better as a docstring inside the
truncate_imagefunction. This makes the documentation directly part of the function and accessible via tools likehelp().
Here is a suggested refactoring that addresses these points and would replace lines 48-64:
def truncate_image(ip_path, op_path):
"""Truncates an image by removing a random number of bytes from the end.
This helps find cases where the program assumes data will always be a
certain length. It can also be used to shrink massive inputs that crash
the program.
"""
with open(ip_path, "rb") as f:
data = f.read()
if len(data) < 2:
return
cut = random.randint(1, len(data) - 1)
truncated = data[:-cut]
with open(op_path, "wb") as f:
f.write(truncated)
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
2 participants
This PR introduces a minimal, developer run fuzzing harness for BHV.
Why Fuzz?
Fuzzing helps us feed the program with malformed input images to check if anything crashes or if there are any vulnerabilities in program.
What this does?
The harness intentionally truncates valid image seeds at the byte level and passes the resulting files through existing image verification logic.
In practice, the flow is:
In simple terms: verify --> truncate --> test
How this helps?
This helps us find unsafe assumptions in image parsing and ensures malformed uploads are handled gracefully, without introducing production dependencies or coverage-guided fuzzing infrastructure.