| 摘要: |
| 模糊测试技术在软件质量保障、软件安全测试等领域起到重要作用. 然而, 在面对编译器这样输入语义复杂的系统时, 现有的模糊测试工具由于其变异策略中缺乏对语义的感知能力, 导致生成的程序难以通过编译器前端检查. 提出了一种语义可感知的灰盒模糊测试方法, 旨在提高模糊测试工具在编译器测试领域的效能. 设计并实现了一系列可保持输入语义合法性并探索上下文多样性的变异操作符, 并针对这些操作符的特点开发了高效的选择策略. 将这些策略与传统的灰盒模糊测试工具相结合, 实现了灰盒模糊测试工具SemaAFL. 实验结果表明, 通过应用这些变异操作符, SemaAFL在GCC和Clang编译器上的代码覆盖率相比AFL++和同类工具GrayC提高了约14.5%和11.2%. 在为期一周的实验期间, SemaAFL发现并报告了6个以前未被发现的GCC和Clang缺陷. |
| 关键词: 编译器测试 语义可感知的模糊测试 灰盒模糊测试 |
| DOI：10.13328/j.cnki.jos.007333 |
| 分类号: |
| 基金项目:国家重点研发计划(2022YFB4501801); 国家自然科学基金(62025202, 62272218); 江苏省前沿引领技术基础研究专项(BK20202001) |
|
| Semantic Aware Greybox Compiler Fuzz Testing |
|
OU Xian-Fei1,2, JIANG Yan-Yan1,2, XU Chang1,2
|
|
1.State Key Laboratory for Novel Software Technology (Nanjing University), Nanjing 210023, China;2.School of Computer Science, Nanjing University, Nanjing 210023, China
|
| Abstract: |
| Fuzz testing techniques play a significant role in software quality assurance and software security testing. However, when dealing with systems like compilers that have complex input semantics, existing fuzz testing tools often struggle as a lack of semantic awareness in their mutation strategies leads to the generated programs failing to pass compiler frontend checks. This study proposes a semantically-aware greybox fuzz testing method, aiming at enhancing the efficiency of fuzz testing tools in the domain of compiler testing. It designs and implements a series of mutation operators that can maintain input semantic validity and explore contextual diversity, and develops efficient selection strategies according to the characteristics of these operators. The greybox fuzz testing tool SemaAFL is developed by integrating these strategies with traditional greybox fuzz testing tools. Experimental results indicate that by applying these mutation operators, SemaAFL achieves approximately 14.5% and 11.2% higher code coverage on GCC and Clang compilers compared to AFL++ and similar tools like GrayC. During a week-long experimental period, six previously unknown bugs in GCC and Clang are discovered and reported by SemaAFL. |
| Key words: compiler testing semantic aware fuzz testing greybox fuzz testing |
