一句话：提出 RPG，用池化搜索生成多样化、偏重 unsafe 的 API 序列，支持泛型并校验有效性，自动合成 Rust 库模糊测试目标。
Rust 库被广泛使用，其正确性保障需要充分测试，但模糊测试依赖人工编写 fuzz target。现有自动生成方法难以生成多样化且优先覆盖 unsafe 代码与交互的 API 序列，也难以支持泛型 API 并保证目标的语法与语义有效性。本文提出 RPG，一种自动 fuzz target 合成技术：它使用基于池的搜索生成多样化、偏重 unsafe 的 API 序列，并在合成时提供泛型支持与有效性检查。实验表明，RPG 在生成目标质量和 bug 发现能力上显著优于当前最优方法，并从 Crates.io 的 50 个知名 Rust 库中发现 25 个此前未知的 bug。
Rust libraries are ubiquitous in Rust-based software development. Guaranteeing their correctness and reliability requires thorough analysis and testing. Fuzzing is a popular bug-finding solution, yet it requires writing fuzz targets for libraries. Recently, some automatic fuzz target generation methods have been proposed. However, two challenges remain: (1) how to generate diverse API sequences that prioritize unsafe code and interactions to reveal bugs in Rust libraries; (2) how to provide support for the generic APIs and verify both syntactic and semantic validity of the fuzz targets to enable more comprehensive testing of Rust libraries. In this paper, we propose RPG, an automatic fuzz target synthesis technique to support Rust library fuzzing. RPG uses a pool-based search to generate diverse and unsafe API sequences, and synthesizes fuzz targets with generic support and validity check. The experimental results demonstrate that RPG enhances both the quality of the generated fuzz targets and the bug-finding ability through pool-based generation and generic support, substantially outperforming the state-of-the-art. Moreover, RPG has discovered 25 previously unknown bugs from 50 well-known Rust libraries available on Crates.io.
@inproceedings{paperbot11276,
title = {RPG: Rust Library Fuzzing with Pool-based Fuzz Target Generation and Generic Support},
author = {Zhiwu Xu and Bohao Wu and Cheng Wen and Bin Zhang and Shengchao Qin and Mengda He},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639102}
}