一句话:提出面向DSP软件的覆盖率引导模糊测试器SBFUZZ,通过DSP自主执行与主机协同提升吞吐和覆盖率并发现大量缺陷。
模糊测试已广泛用于软件测试,但在数字信号处理器(DSP)软件上应用有限。DSP处于软硬件边界,接口受限、架构特殊,并可能产生崩溃类软件缺陷和执行发散却继续运行的硬件式缺陷。作者提出覆盖引导的DSP模糊测试器SBFUZZ:采用以DSP为中心的任务分解,让DSP自主执行大部分模糊测试任务,并周期性借助主机协调、分析和存储,支持单主机并发测试多台设备以及物理/模拟DSP。作者在TI TMS320C5515上用15个基准评估。相比已有方法,吞吐率提高17.4倍、覆盖率提高2.6倍,发现2491个唯一崩溃和34个唯一缺陷。
Fuzzing is one of the most effective techniques for discovering software vulnerabilities. Fuzzers use feedback from prior executions to generate new test cases via random mutation,executing these inputs to uncover bugs. Fuzzing has been successfully applied to applications, operating systems, processors, and network protocols, making it one of the most widely adopted software testing methodologies. Despite this success, fuzzing has seen little adoption for Digital Signal Processor (DSP) software. DSPs occupy a unique position at the boundary of hardware and software: they ingest signals from the physical world, execute software instructions, and are tightly integrated into data-processing pipelines. Many safety- and security-critical domains, including telecommunications, transportation, and defense, rely heavily on DSPs, making robust DSP testing essential. To address this gap, we introduce SBFUZZ, a coverage-guided fuzzer designed specifically for DSP software. SBFUZZ is driven by three key observations: (1) DSPs expose limited and high-latency execution control and communication interfaces, and (2) DSPs have unique architectures that necessitate new instrumentation and mutation routines, and (3) DSP fuzzing must detect both traditional software bugs manifested as crashes and hardware-style bugs manifested as divergent yet continuing execution. Based on these insights, SBFUZZ advocates a DSP-centric fuzzer decomposition, where the DSP executes most fuzzing tasks autonomously while periodically leveraging a more powerful host for coordination, analysis, and storage. This design allows a single host to concurrently fuzz multiple end devices and supports both physical DSPs and simulated DSPs for re-hosted fuzzing. We implement SBFUZZ on a Texas Instruments TMS320C5515 DSP and evaluate it on 15 DSP benchmark programs.Our results show that SBFUZZ achieves 17.4x higher throughput and 2.6x greater code coverage than prior embedded fuzzing approaches applied to DSPs, uncovering 2491 unique crashes, yielding 34 unique bugs