Fuzzing Configurations of Program Options
Fuzzing Configurations of Program Options
复制标题
DOI：
10.1145/3580597
复制
发表时间：
2023-02
影响因子：
4.4
通讯作者：
Zenong Zhang;George Klees;E. Wang;M. Hicks;Shiyi Wei
中科院分区：
文献类型：
--
作者：
Zenong Zhang;George Klees;E. Wang;M. Hicks;Shiyi Wei
虽然许多真实世界的程序都带有启用/禁用功能的配置，但模糊器大多用于测试这些程序的单个配置。在这项工作中，我们首先进行了实证研究，以了解程序配置如何影响模糊性能。我们发现，将一个活动限制在一个单一的配置可能会导致无法覆盖大量的代码。我们还观察到，不同的程序配置贡献不同数量的代码覆盖率，挑战的想法，每一个可以有效地单独模糊。受这两个观察结果的启发，我们提出了ConfigFuzz，它可以沿着正常输入模糊配置。ConfigFuzz将目标程序转换为在可模糊输入的一部分中编码其程序选项，因此可以重用现有模糊器的变异操作符来模糊程序配置。我们实例化ConfigFuzz上六个可配置的，常见的模糊目标，并将其执行FuzzBench。在我们的评估中，ConfigFuzz在四个目标中优于两个基线模糊器，而由于程序大小和配置空间，结果在其他目标中混合。我们还分析了ConfigFuzz模糊化的选项以及它们如何影响性能。
While many real-world programs are shipped with configurations to enable/disable functionalities, fuzzers have mostly been applied to test single configurations of these programs. In this work, we first conduct an empirical study to understand how program configurations affect fuzzing performance. We find that limiting a campaign to a single configuration can result in failing to cover a significant amount of code. We also observe that different program configurations contribute differing amounts of code coverage, challenging the idea that each one can be efficiently fuzzed individually. Motivated by these two observations, we propose ConfigFuzz , which can fuzz configurations along with normal inputs. ConfigFuzz transforms the target program to encode its program options within part of the fuzzable input, so existing fuzzers’ mutation operators can be reused to fuzz program configurations. We instantiate ConfigFuzz on six configurable, common fuzzing targets, and integrate their executions in FuzzBench. In our evaluation, ConfigFuzz outperforms two baseline fuzzers in four targets, while the results are mixed in the other targets due to program size and configuration space. We also analyze the options fuzzed by ConfigFuzz and how they affect the performance.