一句话：系统研究 Markdown 编译器的性能缺陷，指出上下文敏感特性的处理是主要根因，并提出模糊测试框架 MdPerfFuzz 检测未知缺陷。
Markdown 编译器被广泛用于将纯文本 Markdown 转换为格式化文本，但它们存在会导致性能下降与资源耗尽的性能缺陷，而学界对这类真实缺陷尚缺乏认识。本文首先对 Markdown 编译器中已知的性能缺陷展开系统性研究，发现编译器处理 Markdown 语言上下文敏感特性（context-sensitive features）的方式是性能缺陷的主要根因。为检测未知性能缺陷，作者实现了 MdPerfFuzz：一个采用基于语法树的变异策略的模糊测试框架，能够高效生成可触发此类缺陷的测试用例；框架还配有执行轨迹相似度算法，用于对缺陷报告去重。借助 MdPerfFuzz，作者在真实世界的 Markdown 编译器与应用中成功发现 216 个此前未知的性能缺陷。该工作表明，性能缺陷是一种常见、严重但此前被忽视的安全问题。
Markdown compilers are widely used for translating plain Markdown text into formatted text, yet they suffer from performance bugs that cause performance degradation and resource exhaustion. Currently, there is little knowledge and understanding about these performance bugs in the wild. In this work, we first conduct a comprehensive study of known performance bugs in Markdown compilers. We identify that the ways Markdown compilers handle the language’s context-sensitive features are the dominant root cause of performance bugs. To detect unknown performance bugs, we develop MdPerfFuzz, a fuzzing framework with a syntax-tree based mutation strategy to efficiently generate test cases to manifest such bugs. It equips an execution trace similarity algorithm to de-duplicate the bug reports. With MdPerfFuzz, we successfully identified 216 new performance bugs in real-world Markdown compilers and applications. Our work demonstrates that the performance bugs are a common, severe, yet previously overlooked security problem.
DOI 原文 ·
@inproceedings{paperbot6550,
title = {Understanding and Detecting Performance Bugs in Markdown Compilers},
author = {Penghui Li and Yinxi Liu and Wei Meng},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678611}
}