一句话：提出HTFuzz，通过集成堆操作序列反馈来引导模糊测试，高效发现堆时序漏洞。
基于堆的时序漏洞（如释放后使用、双重释放、空指针解引用）对堆操作序列高度敏感，传统代码覆盖率引导的模糊测试难以有效触发此类漏洞。现有序列敏感方案在实践中存在局限。本文提出 HTFuzz，将堆操作序列反馈整合到模糊测试中，通过设计序列反馈机制来引导测试用例生成，以更高效地探索可能触发时序漏洞的堆操作序列。摘要未提供具体评估结果，但该工作旨在克服现有方法的不足，提升堆时序漏洞的发现能力。
Heap-based temporal vulnerabilities (i.e., use-after-free, double-free and null pointer dereference) are highly sensitive to heap operation (e.g., memory allocation, deallocation and access) sequences. To efficiently find such vulnerabilities, traditional code coverage-guided fuzzing solutions could be promoted by integrating heap operation sequence feedback. But current sequence sensitive solutions have limitations in practice.
@inproceedings{paperbot7253,
title = {HTFuzz: Heap Operation Sequence Sensitive Fuzzing},
author = {Yuanping Yu and Xiangkun Jia and Yuwei Liu and Yanhao Wang and Qian Sang and Chao Zhang and Purui Su},
booktitle = {ASE},
year = {2022},
doi = {10.1145/3551349.3560415}
}