一句话：提出 RULF，通过 API 依赖图遍历自动生成 Rust 库的 fuzz target，提升 API 覆盖率并发现新 bug。
Rust 库开发重视鲁棒性，但库 API 缺少 fuzz target，现有模糊测试工具难以直接应用，人工编写成本高。本文提出自动生成 fuzz target 的方法 RULF，通过遍历 API 依赖图构造有效且高效的 API 调用序列。为满足有效性、高 API 覆盖与效率需求，先用带剪枝的广度优先搜索生成长度阈值内的序列，再为未覆盖 API 反向搜索更长序列，最后将序列集合优化为集合覆盖问题。作者实现工具并用 AFL++ 在多个真实 Rust 项目上实验，每库生成 7–118 个 target，API 覆盖率达 0.92，并以 24 小时阈值运行，从 7 个库中发现 30 个先前未知缺陷。
Robustness is a key concern for Rust library development because Rust promises no risks of undefined behaviors if developers use safe APIs only. Fuzzing is a practical approach for examining the robustness of programs. However, existing fuzzing tools are not directly applicable to library APIs due to the absence of fuzz targets. It mainly relies on human efforts to design fuzz targets case by case which is labor-intensive. To address this problem, this paper proposes a novel automated fuzz target generation approach for fuzzing Rust libraries via API dependency graph traversal. We identify several essential requirements for library fuzzing, including validity and effectiveness of fuzz targets, high API coverage, and efficiency. To meet these requirements, we first employ breadth-first search with pruning to find API sequences under a length threshold, then we backward search longer sequences for uncovered APIs, and finally we optimize the sequence set as a set covering problem. We implement our fuzz target generator and conduct fuzzing experiments with AFL++ on several real-world popular Rust projects. Our tool finally generates 7 to 118 fuzz targets for each library with API coverage up to 0.92. We exercise each target with a threshold of 24 hours and find 30 previously-unknown bugs from seven libraries.
DOI 原文 ·
@inproceedings{paperbot6621,
title = {RULF: Rust Library Fuzzing via API Dependency Graph Traversal},
author = {Jianfeng Jiang and Hui Xu and Yangfan Zhou},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678813}
}