Curl audit: How a joke led to significant findings

[2021-02-12] &lt;Daniel Stenberg&gt; Will I ever rewrite curl in rust? I don&#x27;t believe in rewrites, no matter which language. I believe in replacing code and fixing components gradually over time. That <i>could</i> mean that we have a curl written mostly in rust in 10 years. Or in 20 years. Or not. -- <a href="https:&#x2F;&#x2F;twitter.com&#x2F;bagder&#x2F;status&#x2F;1360131939794042884" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;bagder&#x2F;status&#x2F;1360131939794042884</a><p>[2023-02-14] &lt;The article&gt; the fuzzer quickly uncovered memory corruption bugs, specifically use-after-free issues, double-free issues, and memory leaks

Memory, memory, memory, and memory again. All 4 of them.<p>Yet everyone’s idea of safety still seems to be “just write bug-free C code, bro”.

TLDR: We fuzzed something that wasn&#x27;t previously fuzzed — specifically, CLI arguments — and found some good bugs. Lesson: Don&#x27;t forget to fuzz all the methods people might use to interface with your software.

Boy if they only used Rust, then these curl commands that no one would ever enter would have been memory safe.