一句话：针对多用途程序受额外选项控制、现有 fuzzer 覆盖不佳的问题，提出基于输入验证的模糊测试工具 CrFuzz。
本文关注模糊测试在一类重要软件上的适用性问题。作者观察到，当前最先进的 fuzzer 设计并不适合服务多种用途的程序，这类程序的每种用途由额外选项控制，因而现有 fuzzer 在对此类程序进行模糊测试时存在局限。基于这一观察，论文提出 CrFuzz，标题表明其核心思路是通过输入验证（input validation）来对多用途程序开展模糊测试。摘要仅陈述了问题观察与工具名称/思路，未展开具体实现机制、覆盖率引导策略、输入验证与选项控制的交互方式，也未给出实验设置、对比基线或漏洞发现数量等评估结果。
Fuzz testing has been proved its effectiveness in discovering software vulnerabilities. Empowered its randomness nature along with a coverage-guiding feature, fuzzing has been identified a vast number of vulnerabilities in real-world programs. This paper begins with an observation that the design of the current state-of-the-art fuzzers is not well suited for a particular (but yet important) set of software programs. Specifically, current fuzzers have limitations in fuzzing programs serving multiple purposes, where each purpose is controlled by extra options.
DOI 原文 ·
@inproceedings{paperbot5771,
title = {CrFuzz: fuzzing multi-purpose programs through input validation},
author = {Suhwan Song and Chengyu Song and Yeongjin Jang and Byoungyoung Lee},
booktitle = {FSE},
year = {2020},
doi = {10.1145/3368089.3409769}
}