AFL++ Fuzzing Reproduces a libwebp Huffman Table Overflow

Summary

A LiveOverflow tutorial uses AFL++ persistent-mode fuzzing to reproduce a libwebp Huffman-table buffer overflow. Broad fuzzing did not find it; the video explains how shared table allocation obscured the overflowing condition.

Key points

• Fuzzing the full DWebP program did not trigger a crash; the presenter says that campaign remained in progress after more than 100 days.
• Another tester later said a corrupted WebP file had accidentally entered the campaign behind his apparent two-day discovery, correcting the initial result.
• A focused harness for libwebp’s Huffman-table function produced crashes in an AddressSanitizer build in under a minute; the regular build did not crash.
• The presenter validated a generated input that required 414 table entries against a 410-entry allocation, and another test reached 520 entries with a 500-entry table.
• The video attributes the difficulty to multiple Huffman tables sharing a buffer: earlier tables affect the offset and size needed for a later overflow.
• The tutorial recommends precise fuzz targets and code that is easier to fuzz, while stressing that fuzzing is not a silver bullet.