Simplest Fuzz Testing Find Issues

We just completed your very first fuzzer; more specifically, your very own BMP file fuzzer. In most cases, you would probably wonder what such a simple fuzzer could do. Well, you won’t believe it but Kuickshow (KDE image/slideshow viewer) version 4:3.5.7-2 is actually vulnerable to one of the BMP files generated by the previous fuzzer.

The vulnerability isn’t an exploitable buffer overflow; rather, it appears to be a form of a DoS where the BMP parser appears to enter an endless loop. If you copied the previous code exactly, data28.bmp is the culprit that causes the endless loop.