Thu 18 Jul 2024 16:18 - 16:36 at Sapoti - Fuzzing Chair(s): Maxime Lamothe

Compiler correctness is a cornerstone of reliable software development. However, systematic testing of compilers is infeasible, given the vast space of possible programs and the complexity of modern programming languages. In this context, differential testing offers a practical methodology as it addresses the oracle problem by comparing the output of alternative compilers given the same set of programs as input. In this paper, we investigate the effectiveness of differential testing in finding bugs within the Kotlin compilers developed at JetBrains. We propose a black-box generative approach that creates input programs for the K1 and K2 compilers. First, we build workable models of Kotlin semantic (semantic interface) and syntactic (enriched context-free grammar) language features, which are subsequently exploited to generate random code snippets. Second, we extend random sampling by introducing two genetic algorithms (GAs) that aim to generate more diverse input programs. Our case study shows that the proposed approach effectively detects bugs in K1 and K2; these bugs have been confirmed and (some) fixed by JetBrains developers. While we do not observe a significant difference w.r.t. the number of defects uncovered by the different search algorithms, random search and GAs are complementary as they find different categories of bugs. Finally, we provide insights into the relationships between the size, complexity, and fault detection capability of the generated input programs.

Thu 18 Jul

Displayed time zone: Brasilia, Distrito Federal, Brazil change

16:00 - 18:00
FuzzingDemonstrations / Journal First / Ideas, Visions and Reflections / Research Papers / Industry Papers at Sapoti
Chair(s): Maxime Lamothe Polytechnique Montreal, Montreal, Canada
16:00
18m
Talk
Dodrio: Parallelizing Taint Analysis Based Fuzzing via Redundancy-Free Scheduling
Industry Papers
Jie Liang , Mingzhe Wang Tsinghua University, Chijin Zhou Tsinghua University, Zhiyong Wu Tsinghua University, China, Jianzhong Liu ShanghaiTech University, Yu Jiang Tsinghua University
16:18
18m
Talk
Evolutionary Generative Fuzzing for Differential Testing of the Kotlin Compiler
Industry Papers
Călin Georgescu Delft University of Technology, Mitchell Olsthoorn Delft University of Technology, Pouria Derakhshanfar JetBrains Research, Marat Akhin JetBrains Research, Annibale Panichella Delft University of Technology
16:36
18m
Talk
Evaluating Directed Fuzzers: Are We Heading in the Right Direction?
Research Papers
Tae Eun Kim KAIST, Jaeseung Choi Sogang University, Seongjae Im KAIST, Kihong Heo KAIST, Sang Kil Cha KAIST
Pre-print Media Attached
16:54
9m
Talk
When Fuzzing Meets LLMs: Challenges and Opportunities
Ideas, Visions and Reflections
Yu Jiang Tsinghua University, Jie Liang , Fuchen Ma Tsinghua University, Yuanliang Chen Tsinghua University, Chijin Zhou Tsinghua University, Yuheng Shen Tsinghua University, Zhiyong Wu Tsinghua University, China, Jingzhou Fu Tsinghua University, Mingzhe Wang Tsinghua University, Shanshan Li National University of Defense Technology, Quan Zhang Tsinghua University
Pre-print
17:03
9m
Talk
Look Ma, No Input Samples! Mining Input Grammars from Code with Symbolic Parsing
Ideas, Visions and Reflections
Leon Bettscheider CISPA Helmholtz Center for Information Security, Andreas Zeller CISPA Helmholtz Center for Information Security
Link to publication DOI
17:12
9m
Talk
VinJ: An Automated Tool for Large-Scale Software Vulnerability Data Generation
Demonstrations
Yu Nong Washington State University, Haoran Yang Washington State University, Feng Chen University of Texas at Dallas, Haipeng Cai Washington State University
DOI Pre-print Media Attached
17:30
18m
Talk
The Human Side of Fuzzing: Challenges Faced by Developers During Fuzzing Activities
Journal First
Olivier Nourry Kyushu University, Yutaro Kashiwa Nara Institute of Science and Technology, Bin Lin Radboud University, Gabriele Bavota Software Institute @ Università della Svizzera Italiana, Michele Lanza Software Institute - USI, Lugano, Yasutaka Kamei Kyushu University