一句话：提出 Fudge，利用已有客户端代码自动生成库的 fuzz driver，并在工业界大规模部署发现漏洞。
模糊测试 C/C++ 库需要 fuzz driver 来调用库代码并传入输入，但手动编写 driver 是推广 fuzzing 的主要障碍。本文提出 Fudge 系统，用于自动生成 fuzz driver：它基于库已有的客户端代码生成候选 driver，每个候选包含合成的 C/C++ 程序和对应构建脚本，并自动进行质量分析。作者在 Google 用 Fudge 为多种库生成数千个新 driver，其中 200 多个被开发者集成到持续模糊测试服务，部分上游化到开源项目并进入 OSS-Fuzz 基础设施。运行这些 driver 已促成 150 多个缺陷修复，并消除多个可利用的安全漏洞。
At Google we have found tens of thousands of security and robustness bugs by fuzzing C and C++ libraries. To fuzz a library, a fuzzer requires a fuzz driver—which exercises some library code—to which it can pass inputs. Unfortunately, writing fuzz drivers remains a primarily manual exercise, a major hindrance to the widespread adoption of fuzzing. In this paper, we address this major hindrance by introducing the Fudge system for automated fuzz driver generation. Fudge automatically generates fuzz driver candidates for libraries based on existing client code. We have used Fudge to generate thousands of new drivers for a wide variety of libraries. Each generated driver includes a synthesized C/C++ program and a corresponding build script, and is automatically analyzed for quality. Developers have integrated over 200 of these generated drivers into continuous fuzzing services and have committed to address reported security bugs. Further, several of these fuzz drivers have been upstreamed to open source projects and integrated into the OSS-Fuzz fuzzing infrastructure. Running these fuzz drivers has resulted in over 150 bug fixes, including the elimination of numerous exploitable security vulnerabilities.
@inproceedings{paperbot5113,
title = {FUDGE: fuzz driver generation at scale},
author = {Domagoj Babić and Stefan Bucur and Yaohui Chen and Franjo Ivančić and Tim King and Markus Kusano and Caroline Lemieux and László Szekeres and Wei Wang},
booktitle = {FSE},
year = {2019},
doi = {10.1145/3338906.3340456}
}