一句话：FRIES 遍历编码生态使用模式的加权 API 依赖图并保证所有权合规，高效生成 fuzz target 以测试 Rust 库交互。
Rust 库是生态系统的核心组件，但其 API 交互测试面临挑战：现有方法缺乏符合所有权规则的 API 测试手段，难以应对函数依赖的巨大搜索空间，且受限于预选代码库，查错效率低。本文提出模糊测试技术 FRIES，高效合成并测试复杂 API 交互以发现 Rust 库缺陷。其核心是遍历加权 API 依赖图，该图既编码函数间的语法依赖，也编码从 Rust 生态挖掘的常见使用模式，从而显著缩小搜索空间，聚焦常见应用场景中的隐藏缺陷；同时设计所有权保证算法确保生成程序有效，提高 fuzz target 的编译成功率。实验表明，FRIES 能以极少计算资源生成高质量 fuzz target，并更高效地发现对实际开发影响更大的错误。在 20 个知名 Rust 库的最新版本中，FRIES 共发现 130 个 bug，其中 84 个为先前未知，54 个已被确认。
Rust has been extensively used in software development in the past decades due to its memory safety mechanisms and gradually matured ecosystems. Enhancing the quality of Rust libraries is critical to Rust ecosystems as the libraries are often the core component of software systems. Nevertheless, we observe that existing approaches fall short in testing Rust API interactions - they either lack a Rust ownership-compliant API testing method, fail to handle the large search space of function dependencies, or are limited by pre-selected codebases, resulting in inefficiencies in finding errors. To address these issues, we propose a fuzzing technique, namely FRIES, that efficiently synthesizes and tests complex API interactions to identify defects in Rust libraries, and therefore promises to significantly improve the quality of Rust libraries. Behind our approach, a key technique is to traverse a weighted API dependency graph, which encodes not only syntactic dependency between functions but also the common usage patterns mined from the Rust ecosystem that reflect the programmer’s thinking. Combined with our efficient generation algorithm, such a graph structure significantly reduces the search space and lets us focus on finding hidden bugs in common application scenarios. Meanwhile, an ownership assurance algorithm is specially designed to ensure the validity of the generated Rust programs, notably improving the success rate of compiling fuzz targets. Experimental results demonstrate that this technique can indeed generate high-quality fuzz targets with minimal computational resources, while more efficiently discovering errors that have a greater impact on actual development, thereby mitigating the impact on the robustness of programs in the Rust ecosystem. So far, FRIES has identified 130 bugs, including 84 previously unknown bugs, in 20 well-known latest versions of Rust libraries, of which 54 have been confirmed.
DOI 原文 ·
@inproceedings{paperbot8556,
title = {FRIES: Fuzzing Rust Library Interactions via Efficient Ecosystem-Guided Target Generation},
author = {Xizhe Yin and Yang Feng and Qingkai Shi and Zixi Liu and Hongwang Liu and Baowen Xu},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3680348}
}