What is the relationship between fuzzing and buffer overflow and does fuzzing leads to buffer overflow? Is buffer overflow a subset of fuzzing?
To understanding the relationship one has to first understand what fuzzing and buffer overflow are in the first place. In short:
- Fuzzing is (automatically) trying to trigger various program path usually using variations of input - in the hope to stumble into something which was not properly implemented like missing or incomplete input checks.
- Buffer overflow is a very specific vulnerability which can be triggered by unexpected input. But buffer overflow is not the only kind of vulnerability for unexpected input.
Based on this fuzzing can be used to detect buffer overflows - but also other vulnerabilities. And not all buffer overflows might be detected by fuzzing. And neither is fuzzing the only way to detect buffer overflows.