FIXREVERTER: A Realistic Bug Injection Methodology for Benchmarking Fuzz Testing
FIXREVERTER: A Realistic Bug Injection Methodology for Benchmarking Fuzz Testing
复制标题
DOI：
--
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Zenong Zhang;Zach Patterson;M. Hicks;Shiyi Wei
中科院分区：
文献类型：
--
作者：
Zenong Zhang;Zach Patterson;M. Hicks;Shiyi Wei
模糊测试是一个活跃的研究领域，其改进建议以快速的速度发布。这样的建议是经验性的评估：它们能比现状表现得更好吗？这样的评估需要一个目标程序的基准，这些目标程序具有明确的、艾德的、现实的bug。为了简化这样一个基准的建设，本文介绍了F IX R的EVERTER，一个工具，自动注入现实的错误在程序中。F IX R EVERTER将包含代码语法和语义条件的bug修复模式作为输入。任何与艾德语法匹配的代码站点，如果语义条件得到萨蒂斯，就会被撤销，正如静态分析所检查的那样，因此（重新）引入了一个可能的bug。本文重点关注三种bug修复模式，我们称之为条件中止，条件执行和条件分配，基于对常见漏洞和暴露（CVE）语料库中修复的研究。使用F IX R EVERTER，我们构建了R EV B UG B ENCH，它由10个程序组成，我们已经注入了近8,000个错误;这些程序来自FuzzBench和Binutils，代表了模糊评估的常见目标。我们已经将R EV B UG B ENCH集成到FuzzBench服务中，并使用它来评估五个模糊器。模糊性能因模糊器和程序而异，如所期望的那样。总体而言，报告了219个独特的错误，其中19%仅被一个模糊器检测到。
Fuzz testing is an active area of research with proposed improvements published at a rapid pace. Such proposals are assessed empirically : Can they be shown to perform better than the status quo? Such an assessment requires a benchmark of target programs with well-identified, realistic bugs. To ease the construction of such a benchmark, this paper presents F IX R EVERTER , a tool that automatically injects realistic bugs in a program. F IX R EVERTER takes as input a bugfix pattern which contains both code syntax and semantic conditions. Any code site that matches the specified syntax is undone if the semantic conditions are satisfied, as checked by static analysis, thus (re)introducing a likely bug. This paper focuses on three bugfix patterns, which we call conditional-abort , conditional-execute , and conditional-assign , based on a study of fixes in a corpus of Common Vulnerabilities and Exposures (CVEs). Using F IX R EVERTER we have built R EV B UG B ENCH , which consists of 10 programs into which we have injected nearly 8,000 bugs; the programs are taken from FuzzBench and Binutils, and represent common targets of fuzzing evaluations. We have integrated R EV B UG B ENCH into the FuzzBench service, and used it to evaluate five fuzzers. Fuzzing performance varies by fuzzer and program, as de-sired/expected. Overall, 219 unique bugs were reported, 19% of which were detected by just one fuzzer.