We gratefully acknowledge support from
the Simons Foundation and member institutions.
Full-text links:

Download:

Current browse context:

cs.SE

Change to browse by:

cs

References & Citations

DBLP - CS Bibliography

Bookmark

(what is this?)
CiteULike logo BibSonomy logo Mendeley logo del.icio.us logo Digg logo Reddit logo ScienceWISE logo

Computer Science > Software Engineering

Title: RULF: Rust Library Fuzzing via API Dependency Graph Traversal

Abstract: Robustness is a key concern for Rust library development because Rust promises no risks of undefined behaviors if developers use safe APIs only. Fuzzing is a practical approach for examining the robustness of programs. However, existing fuzzing tools are not directly applicable to library APIs due to the absence of fuzz targets. It mainly relies on human efforts to design fuzz targets case by case which is labor-intensive. To address this problem, this paper proposes a novel automated fuzz target generation approach for fuzzing Rust libraries via API dependency graph traversal. We identify several essential requirements for library fuzzing, including validity and effectiveness of fuzz targets, high API coverage, and efficiency. To meet these requirements, we first employ breadth-first search with pruning to find API sequences under a length threshold, then we backward search longer sequences for uncovered APIs, and finally we optimize the sequence set as a set covering problem. We implement our fuzz target generator and conduct fuzzing experiments with AFL++ on several real-world popular Rust projects. Our tool finally generates 7 to 118 fuzz targets for each library with API coverage up to 0.92. We exercise each target with a threshold of 24 hours and find 30 previously-unknown bugs from seven libraries.
Comments: This paper has been accepted in Proc. of The 36th IEEE/ACM International Conference on Automated Software Engineering (ASE), November, 2021
Subjects: Software Engineering (cs.SE)
Cite as: arXiv:2104.12064 [cs.SE]
  (or arXiv:2104.12064v3 [cs.SE] for this version)

Submission history

From: Jianfeng Jiang [view email]
[v1] Sun, 25 Apr 2021 05:16:08 GMT (790kb,D)
[v2] Sun, 19 Sep 2021 07:03:22 GMT (853kb,D)
[v3] Fri, 22 Oct 2021 08:41:07 GMT (855kb,D)

Link back to: arXiv, form interface, contact.