Parser-directed fuzzing

Mathis, Björn; Gopinath, Rahul; Mera, Michaël; Kampmann, Alexander; Höschele, Matthias; Zeller, Andreas

doi:10.1145/3314221.3314651

Cited by 40 publications

(41 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…1, is to systematically create inputs that cover all branches of a tokenizerÐthat is, a program part that composes characters into tokens. Our approach extends our earlier work [12], especially our tool pFuzzer. To this end, we dynamically track the comparisons made on input characters and tokens.…”

Section: Introductionmentioning

confidence: 65%

“…As already mentioned, parsing makes an intensive use of implicit data conversions while also being hard to test with state-of-the-art fuzzers. Thus, we demonstrate the effectiveness of our approach by improving parser-directed fuzzing [12]. We extend our opensource implementation by Mathis et.…”

Section: Parser-directed Fuzzingmentioning

confidence: 79%

“…Still, for many input formats no such model is available. 1 The technique of parser-directed fuzzing [12] aims to strike a compromise between the two, specifically generating inputs for parsers that process one element at a time. Thus, the key idea of our work is to (1) Extend dynamic tainting to implicit data transformations, using them to (2) Apply parser-directed fuzzing specifically to tokenizers, covering all branches and, consequently, all lexical elements (tokens) of the input language; and subsequently (3) Extract these tokens as dictionaries for effective fuzzing.…”

Section: Extracting Input Tokensmentioning

confidence: 99%

“…Parser-directed fuzzing [12] assumes that a parser processes inputs character by character, comparing each character against all expected characters at this position. Our earlier tool pFuzzer executes valid prefixes with random extensions and uses dynamic tainting to collect the comparisons done on the input characters.…”

Section: Parser-directed Fuzzingmentioning

confidence: 99%

“…In [12], we already mentioned tokenization as a strong limitation to fuzzing parsers and hence our approach. In the presence of a tokenization the character comparisons are shifted from the parser into the tokenizer.…”

Section: Parser-directed Fuzzingmentioning

confidence: 99%

See 4 more Smart Citations

Learning input tokens for effective fuzzing

Mathis

Gopinath

Zeller

2020

Proceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analysis

Self Cite

View full text Add to dashboard Cite

Modern fuzzing tools like AFL operate at a lexical level: They explore the input space of tested programs one byte after another. For inputs with complex syntactical properties, this is very inefficient, as keywords and other tokens have to be composed one character at a time. Fuzzers thus allow to specify dictionaries listing possible tokens the input can be composed from; such dictionaries speed up fuzzers dramatically. Also, fuzzers make use of dynamic tainting to track input tokens and infer values that are expected in the input validation phase. Unfortunately, such tokens are usually implicitly converted to program specific values which causes a loss of the taints attached to the input data in the lexical phase. In this paper, we present a technique to extend dynamic tainting to not only track explicit data flows but also taint implicitly converted data without suffering from taint explosion. This extension makes it possible to augment existing techniques and automatically infer a set of tokens and seed inputs for the input language of a program given nothing but the source code. Specifically targeting the lexical analysis of an input processor, our lFuzzer test generator systematically explores branches of the lexical analysis, producing a set of tokens that fully cover all decisions seen. The resulting set of tokens can be directly used as a dictionary for fuzzing. Along with the token extraction seed inputs are generated which give further fuzzing processes a head start. In our experiments, the lFuzzer-AFL combination achieves up to 17% more coverage on complex input formats like json, lisp, tinyC, and JavaScript compared to AFL. CCS CONCEPTS • Software and its engineering → Software testing and debugging; Parsers; • Theory of computation → Regular languages.

show abstract

Section: Introductionmentioning

confidence: 65%

Section: Parser-directed Fuzzingmentioning

confidence: 79%

Section: Extracting Input Tokensmentioning

confidence: 99%

Section: Parser-directed Fuzzingmentioning

confidence: 99%

Section: Parser-directed Fuzzingmentioning

confidence: 99%

See 3 more Smart Citations

Learning input tokens for effective fuzzing

Mathis

Gopinath

Zeller

2020

Proceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analysis

Self Cite

View full text Add to dashboard Cite

show abstract

The progress, challenges, and perspectives of directed greybox fuzzing

Wang,

Zhou,

Yue

et al. 2023

Software Testing Verif & Rel

View full text Add to dashboard Cite

SummaryGreybox fuzzing is a scalable and practical approach for software testing. Most greybox fuzzing tools are coverage‐guided as reaching high code coverage is more likely to find bugs. However, since most covered codes may not contain bugs, blindly extending code coverage is less efficient, especially for corner cases. Unlike coverage‐guided greybox fuzzing which increases code coverage in an undirected manner, directed greybox fuzzing (DGF) spends most of its time allocation on reaching specific targets (e.g. the bug‐prone zone) without wasting resources stressing unrelated parts. Thus, DGF is particularly suitable for scenarios such as patch testing, bug reproduction, and special bug detection. For now, DGF has become an active research area. However, DGF has general limitations and challenges that are worth further studying. Based on the investigation of 42 state‐of‐the‐art fuzzers that are closely related to DGF, we conducted the first in‐depth study to summarize the empirical evidence on the research progress of DGF. This paper studies DGF from a broader view, which takes into account not only the location‐directed type that targets specific code parts but also the behavior‐directed type that aims to expose abnormal program behaviors. By analyzing the benefits and limitations of DGF research, we try to identify gaps in current research, meanwhile, reveal new research opportunities and suggest areas for further investigation.

show abstract

Maximizing Branch Coverage with Constrained Horn Clauses

Zlatkin

Fedyukovich

2022

Tools and Algorithms for the Construction and Analysis of Systems

View full text Add to dashboard Cite

State-of-the-art solvers for constrained Horn clauses (CHC) are successfully used to generate reachability facts from symbolic encodings of programs. In this paper, we present a new application to test-case generation: if a block of code is provably unreachable, no test case can be generated allowing to explore other blocks of code. Our new approach uses CHC to incrementally construct different program unrollings and extract test cases from models of satisfiable formulas. At the same time, a CHC solver keeps track of CHCs that represent unreachable blocks of code which makes the unrolling process more efficient. In practice, this lets our approach to terminate early while guaranteeing maximal coverage. Our implementation called Horntinuum exhibits promising performance: it generates high coverage in the majority of cases and spends less time on average than state-of-the-art.

show abstract

Parser-directed fuzzing

Cited by 40 publications

References 19 publications

Learning input tokens for effective fuzzing

Learning input tokens for effective fuzzing

The progress, challenges, and perspectives of directed greybox fuzzing

Maximizing Branch Coverage with Constrained Horn Clauses

Contact Info

Product

Resources

About