计算机科学

计算机科学 ›› 2026, Vol. 53 ›› Issue (10): 376-383.doi: 10.11896/jsjkx.251000107

• 计算机软件 • 上一篇    下一篇

基于线程执行序列反馈的模糊测试方法

王安祺1, 陈哲1,2, 殷家乐1   

  1. 1 南京航空航天大学计算机科学与技术学院 南京 211106
    2 软件新技术与产业化协同创新中心 南京 211106
  • 收稿日期:2025-10-23 修回日期:2026-01-29 发布日期:2026-10-13
  • 通讯作者: 陈哲(zhechen@nuaa.edu.cn)
  • 作者简介:(897647999@qq.com)
  • 基金资助:
    国家自然科学基金(62172217);国家自然科学基金委员会-中国民航局民航联合研究基金(U1533130)

Feedback-guided Fuzzing Based on Thread Execution Sequences

WANG Anqi1, CHEN Zhe1,2, YIN Jiale1   

  1. 1 Country College of Computer Science and Technology,Nanjing University of Aeronautics and Astronautics,Nanjing 211106, China
    2 Collaborative Innovation Center of Novel Software Technology and Industrialization,Nanjing 211106, China
  • Received:2025-10-23 Revised:2026-01-29 Online:2026-10-13
  • About author:WANG Anqi,born in 2001,postgra-duate.Her main research interests include software verification and program analysis.
    CHEN Zhe,born in 1981,Ph.D,professor,is a member of CCF(No.22234M).His main research interests include software verification,software engineering and network security.
  • Supported by:
    National Natural Science Foundation of China(62172277) and Joint Research Funds of National Natural Science Foundation of China and Civil Aviation Administration of China(U1533130).

PDF (PC)

64

摘要： C语言因其高效性与灵活性在内核与嵌入式等关键领域被广泛使用,但手动内存管理使其容易存在内存安全缺陷。当前主流的覆盖率制导模糊测试可以在单线程程序中有效挖掘内存安全漏洞,然而在多线程环境下,由于模糊测试不关注线程交错,部分漏洞隐藏于复杂的程序流程难以被挖掘。针对这一挑战,提出一种基于线程执行序列反馈的增强型灰盒模糊测试方法,通过将动态分析工具Movec与模糊测试器AFL深度协同,创新性地收集线程执行的时序信息进行反馈,并结合线程上下文信息与指针元数据进行种子的筛选与优先级调整。通过与覆盖率引导的模糊测试器进行对比实验,结果表明,以线程执行序列为额外反馈的模糊测试方法在多线程环境下挖掘内存漏洞的能力优秀,并且平均缩短了38.21%的挖掘耗时。

关键词: 内存安全, 模糊测试, 多线程, 源代码插桩

Abstract: C programming language is widely used in critical domains such as operating systems and embedded systems due to its efficiency and flexibility.However,its manual memory management mechanism makes it prone to memory safety vulnerabilities.Current mainstream coverage-guided fuzzing techniques are effective in detecting such vulnerabilities in single-threaded programs.Nevertheless,in multithreaded environments,many vulnerabilities remain undiscovered because traditional fuzzers do not account for thread interleaving,causing defects to hide within complex execution flows.To address this challenge,this paper proposes an enhanced grey-box fuzzing approach based on thread execution sequence feedback.This method tightly integrates the dynamic analysis tool Movec with the fuzzer AFL,innovatively collecting and leveraging thread execution order information as additional feedback.Moreover,it incorporates thread context and pointer metadata to guide seed selection and adjust mutation priorities.Comparative experiments with conventional coverage-guided fuzzers demonstrate that the proposed method significantly improves memory vulnerability detection in multithreaded programs,while reducing the average detection time by 38.21%.

Key words: Memory safety, Fuzzing, Multithreading, Source code instrument

中图分类号: 

  • TP311
[1] NSA,CISA,FBI,et al.The Case for Memory Safe Roadmaps [R].Washington,DC:Cybersecurity and Infrastructure Security Agency,2023.
[2] CHEN Z,TAO C Q,ZHANG Z Y,et al.BeyondSpatial andTemporal Memory Safety[C]//Proceedings of the 40th International Conference on Software Engineering.New York:ACM,2018:189-190.
[3] NETHERCOTE N,SEWARD J.Valgrind:A Framework forHeavyweight Dynamic Binary Instrumentation[J].SIGPLAN Notices,2007,42(6):89-100.
[4] NAGARAKATTE S,ZHAO J,MARTIN M M K,et al.SoftBound:Highly Compatible and Complete Spatial Memory Safety for C[J].SIGPLAN Notices,2009,44(6):245-258.
[5] SEREBRYANY K,BRUENING D,POTAPENKO A,et al.Ad-dressSanitizer:A Fast Address Sanity Checker[C]//Proceedings of the 2012 USENIX Annual Technical Conference(USENIX ATC 12).Boston,MA:USENIX Association,2012:309-318.
[6] WOLFF D,SHI Z,DUCK G J,et al.GreyboxFuzzing for Concurrency Testing [C]//Proceedings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems(ASPLOS 2024).New York:ACM,2024:482-498.
[7] CAI Y,ZHU B Y,MENG R J,et al.Detecting ConcurrencyMemory Corruption Vulnerabilities[C]//Proceedings of the 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering(ESEC/FSE ’19).New York:ACM,2019:706-717.
[8] LIU C M,ZOU D Q,LUO P,et al.A Heuristic Framework to Detect Concurrency Vulnerabilities[C]//Proceedings of the 34th Annual Computer Security Applications Conference(ACSAC ’18).New York:ACM,2018:529-541.
[9] BÖHME M,PHAM V T,ROYCHOUDHURY A.Coverage-Based Greybox Fuzzing as Markov Chain[C]//Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security(CCS’16).New York:ACM,2016:1032-1043.
[10] LEMIEUX C,SEN K.FairFuzz:A Targeted Mutation Strategy for Increasing Greybox Fuzzing Coverage[C]//Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering(ASE ’18).Piscataway,NJ:IEEE,2018:475-485.
[11] FIORALDI A,MAIER D,EISSFELDT H,et al.AFL++:Combining Incremental Steps of Fuzzing Research[C]//Proceedings of the 14th USENIX Workshop on Offensive Technologies(WOOT 2020).Berkeley,CA:USENIX Association,2020.
[12] YU Y P,JIA X K,LIU Y W,et al.HTFuzz:Heap Operation Sequence Sensitive Fuzzing [C]//Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering(ASE’22).New York:ACM,2022:1-13.
[13] ZHENG H,ZHANG J Y,HUANG Y H,et al.FishFuzz:Catch Deeper Bugs by Throwing Larger Nets [C]//Proceedings of the 32nd USENIX Security Symposium(USENIX Security 23).Anaheim,CA:USENIX Association,2023:1343-1360.
[14] CHEN Z,WANG C,YAN J Q,et al.Runtime Detection ofMemory Errors with Smart Status[C]//Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis.New York:ACM,2021:296-308.
[15] CHEN Z,YAN J Q,KAN S L,et al.Detecting Memory Errors at Runtime with Source-Level Instrumentation[C]//Procee-dings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis.New York:ACM,2019:341-351.
[16] CHEN Z,YAN J Q,LI W M,et al.Runtime Verification ofMemory Safety via Source Transformation[C]//Proceedings of the 40th International Conference on Software Engineering:Companion Proceedings(ICSE’18).New York:ACM,2018:264-265.
[17] CHEN Z,YAN R,MA Y Z,et al.A Smart Status Based Monitoring Algorithm for the Dynamic Analysis of Memory Safety[J].ACM Transactions on Software Engineering and Methodo-logy,2024,33(4):1-47.
[18] SEREBRYANY K,ISKHODZANOV T.ThreadSanitizer:DataRace Detection in Practice[C]//Proceedings of the Workshop on Binary Instrumentation and Applications(WBIA ’09).New York:ACM,2009:62-71.
[19] XU M,KASHYAP S,ZHAO H,et al.Krace:Data Race Fuzzing for Kernel File Systems[C]//Proceedings of the 2020 IEEE Symposium on Security and Privacy(SP).San Francisco,CA:IEEE,2020:1643-1660.
[20] JIANG Z M,BAI J J,LU K J,et al.Context-Sensitive and Directional Concurrency Fuzzing for Data-Race Detection[C]//Proceedings of the Network and Distributed System Security Symposium(NDSS 2022).San Diego,CA:Internet Society,2022.
[21] KLEES G,RUEF A,COOPER B,et al.Evaluating Fuzz Testing[C]//Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security.New York:ACM,2018:2123-2138.
Viewed
Full text


Abstract

Cited
  Shared   
  Discussed   
No Suggested Reading articles found!
渝ICP备16013121号-4
地址：重庆市两江新区洪湖西路18号    邮编：401121  
电话：023-63500828（编辑部） 023-67039612（会议/专题） 023-67039623（财务/发票）
E-mail：jsjkx12@163.com
本系统由北京玛格泰克科技发展有限公司设计开发