Beautiful Testing

Future Considerations

So, what comes next? As the Excel vulnerability illustrates, it’s hard to tell when you have fuzzed certain parts of your program enough. Once you reach diminishing returns, though, you should start fuzzing other parts of the program, like the user interface and scripting and macro languages, to make sure they’re as stable and reliable as other features. Likewise, new features will create opportunities to extend existing fuzzing tools or develop new ones. By monitoring incoming bug reports, you can notice and correct the omissions that make your fuzzing less effective. In fact, this is exactly how I noticed a missing function in my formula fuzzer: a user submitted a bug report that included a function that I had failed to include in my testing. After adding it to the list, my custom fuzzer triggered a crash that I had previously missed.

In addition to monitoring your own project, be on the lookout for new tools that can assist you in your testing. I have done most of my fuzzing with zzuf, but it contains a number of limitations that bias my testing. For example, it cannot add or remove bytes or truncate input, which makes it more difficult to truly simulate certain forms of corruption. Integrating new fuzzing tools and techniques will help you overcome these deficiencies and likely uncover further bugs.

Fuzz testing is a great technique to make office software more reliable and useful. It allows for creative and elegant solutions to many complicated problems ...