一句话：提出 WASMaker，通过反汇编与重组真实 Wasm 二进制生成高质量测试用例，对 Wasm 运行时做差分测试并定位根因。
Wasm 运行时是 WebAssembly 生态的核心组件，其缺陷会直接影响 Wasm 应用的执行。已有自动化测试框架受限于测试用例质量，难以生成既语义丰富又语法正确的 Wasm 二进制，因而无法有效触发复杂缺陷。本文提出 WASMaker，一种新型差分测试框架：它通过反汇编和重新组装真实世界的 Wasm 二进制来构造复杂测试用例，从而暴露不同 Wasm 运行时之间隐藏的行为不一致。为进一步定位异常行为的根本原因，作者设计了与运行时无关的根因定位方法。大量评估表明，WASMaker 在效率与效果上均优于现有最先进技术，并在流行 Wasm 运行时中发现了 33 个独特缺陷，其中 25 个已得到确认。
A fundamental component of the Wasm ecosystem is the Wasm runtime, as it directly impacts whether Wasm applications can be executed as expected. Bugs in Wasm runtimes are frequently reported, so the research community has made a few attempts to design automated testing frameworks to detect bugs in Wasm runtimes. However, existing testing frameworks are limited by the quality of test cases, i.e., they face challenges in generating Wasm binaries that are both semantically rich and syntactically correct. As a result, complicated bugs cannot be triggered effectively. In this work, we present WASMaker, a novel differential testing framework that can generate complicated Wasm test cases by disassembling and assembling real-world Wasm binaries, which can trigger hidden inconsistencies among Wasm runtimes. To further pinpoint the root causes of unexpected behaviors, we design a runtime-agnostic root cause location method to locate bugs accurately. Extensive evaluation suggests that WASMaker outperforms state-of-the-art techniques in terms of both efficiency and effectiveness. We have uncovered 33 unique bugs in popular Wasm runtimes, among which 25 have been confirmed.
DOI 原文 ·
@inproceedings{paperbot8525,
title = {WASMaker: Differential Testing of WebAssembly Runtimes via Semantic-Aware Binary Generation},
author = {Shangtong Cao and Ningyu He and Xinyu She and Yixuan Zhang and Mu Zhang and Haoyu Wang},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3680358}
}