Computer Science

Computer Science ›› 2026, Vol. 53 ›› Issue (10): 376-383.doi: 10.11896/jsjkx.251000107

• Computer Software • Previous Articles     Next Articles

Feedback-guided Fuzzing Based on Thread Execution Sequences

WANG Anqi1, CHEN Zhe1,2, YIN Jiale1   

  1. 1 Country College of Computer Science and Technology,Nanjing University of Aeronautics and Astronautics,Nanjing 211106, China
    2 Collaborative Innovation Center of Novel Software Technology and Industrialization,Nanjing 211106, China
  • Received:2025-10-23 Revised:2026-01-29 Published:2026-10-13
  • About author:WANG Anqi,born in 2001,postgra-duate.Her main research interests include software verification and program analysis.
    CHEN Zhe,born in 1981,Ph.D,professor,is a member of CCF(No.22234M).His main research interests include software verification,software engineering and network security.
  • Supported by:
    National Natural Science Foundation of China(62172277) and Joint Research Funds of National Natural Science Foundation of China and Civil Aviation Administration of China(U1533130).

PDF (PC)

53

Abstract: C programming language is widely used in critical domains such as operating systems and embedded systems due to its efficiency and flexibility.However,its manual memory management mechanism makes it prone to memory safety vulnerabilities.Current mainstream coverage-guided fuzzing techniques are effective in detecting such vulnerabilities in single-threaded programs.Nevertheless,in multithreaded environments,many vulnerabilities remain undiscovered because traditional fuzzers do not account for thread interleaving,causing defects to hide within complex execution flows.To address this challenge,this paper proposes an enhanced grey-box fuzzing approach based on thread execution sequence feedback.This method tightly integrates the dynamic analysis tool Movec with the fuzzer AFL,innovatively collecting and leveraging thread execution order information as additional feedback.Moreover,it incorporates thread context and pointer metadata to guide seed selection and adjust mutation priorities.Comparative experiments with conventional coverage-guided fuzzers demonstrate that the proposed method significantly improves memory vulnerability detection in multithreaded programs,while reducing the average detection time by 38.21%.

Key words: Memory safety, Fuzzing, Multithreading, Source code instrument

CLC Number: 

  • TP311
[1] NSA,CISA,FBI,et al.The Case for Memory Safe Roadmaps [R].Washington,DC:Cybersecurity and Infrastructure Security Agency,2023.
[2] CHEN Z,TAO C Q,ZHANG Z Y,et al.BeyondSpatial andTemporal Memory Safety[C]//Proceedings of the 40th International Conference on Software Engineering.New York:ACM,2018:189-190.
[3] NETHERCOTE N,SEWARD J.Valgrind:A Framework forHeavyweight Dynamic Binary Instrumentation[J].SIGPLAN Notices,2007,42(6):89-100.
[4] NAGARAKATTE S,ZHAO J,MARTIN M M K,et al.SoftBound:Highly Compatible and Complete Spatial Memory Safety for C[J].SIGPLAN Notices,2009,44(6):245-258.
[5] SEREBRYANY K,BRUENING D,POTAPENKO A,et al.Ad-dressSanitizer:A Fast Address Sanity Checker[C]//Proceedings of the 2012 USENIX Annual Technical Conference(USENIX ATC 12).Boston,MA:USENIX Association,2012:309-318.
[6] WOLFF D,SHI Z,DUCK G J,et al.GreyboxFuzzing for Concurrency Testing [C]//Proceedings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems(ASPLOS 2024).New York:ACM,2024:482-498.
[7] CAI Y,ZHU B Y,MENG R J,et al.Detecting ConcurrencyMemory Corruption Vulnerabilities[C]//Proceedings of the 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering(ESEC/FSE ’19).New York:ACM,2019:706-717.
[8] LIU C M,ZOU D Q,LUO P,et al.A Heuristic Framework to Detect Concurrency Vulnerabilities[C]//Proceedings of the 34th Annual Computer Security Applications Conference(ACSAC ’18).New York:ACM,2018:529-541.
[9] BÖHME M,PHAM V T,ROYCHOUDHURY A.Coverage-Based Greybox Fuzzing as Markov Chain[C]//Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security(CCS’16).New York:ACM,2016:1032-1043.
[10] LEMIEUX C,SEN K.FairFuzz:A Targeted Mutation Strategy for Increasing Greybox Fuzzing Coverage[C]//Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering(ASE ’18).Piscataway,NJ:IEEE,2018:475-485.
[11] FIORALDI A,MAIER D,EISSFELDT H,et al.AFL++:Combining Incremental Steps of Fuzzing Research[C]//Proceedings of the 14th USENIX Workshop on Offensive Technologies(WOOT 2020).Berkeley,CA:USENIX Association,2020.
[12] YU Y P,JIA X K,LIU Y W,et al.HTFuzz:Heap Operation Sequence Sensitive Fuzzing [C]//Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering(ASE’22).New York:ACM,2022:1-13.
[13] ZHENG H,ZHANG J Y,HUANG Y H,et al.FishFuzz:Catch Deeper Bugs by Throwing Larger Nets [C]//Proceedings of the 32nd USENIX Security Symposium(USENIX Security 23).Anaheim,CA:USENIX Association,2023:1343-1360.
[14] CHEN Z,WANG C,YAN J Q,et al.Runtime Detection ofMemory Errors with Smart Status[C]//Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis.New York:ACM,2021:296-308.
[15] CHEN Z,YAN J Q,KAN S L,et al.Detecting Memory Errors at Runtime with Source-Level Instrumentation[C]//Procee-dings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis.New York:ACM,2019:341-351.
[16] CHEN Z,YAN J Q,LI W M,et al.Runtime Verification ofMemory Safety via Source Transformation[C]//Proceedings of the 40th International Conference on Software Engineering:Companion Proceedings(ICSE’18).New York:ACM,2018:264-265.
[17] CHEN Z,YAN R,MA Y Z,et al.A Smart Status Based Monitoring Algorithm for the Dynamic Analysis of Memory Safety[J].ACM Transactions on Software Engineering and Methodo-logy,2024,33(4):1-47.
[18] SEREBRYANY K,ISKHODZANOV T.ThreadSanitizer:DataRace Detection in Practice[C]//Proceedings of the Workshop on Binary Instrumentation and Applications(WBIA ’09).New York:ACM,2009:62-71.
[19] XU M,KASHYAP S,ZHAO H,et al.Krace:Data Race Fuzzing for Kernel File Systems[C]//Proceedings of the 2020 IEEE Symposium on Security and Privacy(SP).San Francisco,CA:IEEE,2020:1643-1660.
[20] JIANG Z M,BAI J J,LU K J,et al.Context-Sensitive and Directional Concurrency Fuzzing for Data-Race Detection[C]//Proceedings of the Network and Distributed System Security Symposium(NDSS 2022).San Diego,CA:Internet Society,2022.
[21] KLEES G,RUEF A,COOPER B,et al.Evaluating Fuzz Testing[C]//Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security.New York:ACM,2018:2123-2138.
[1] LIANG Haotian, CAO Yan. R2Fuzz:Dependence Graph Repair Based Fuzzing Framework for Key-Value DBMS [J]. Computer Science, 2026, 53(9): 421-431.
[2] WEI Qing, ZHANG Yupeng, LIU Shaoxun, ZHANG Jinfeng, ZHANG Yuezhong, CHEN Haoyang. Fuzzing Driver Generation Based on Large Language Models [J]. Computer Science, 2026, 53(6A): 250400113-8.
[3] WEI Zihan, MA Rongkuan, LI Beibei, YANG Yahui, LI Zhuo, SONG Yunkai. Firmware Recovery Based Emulation and Testing Method for Industrial Gateway [J]. Computer Science, 2025, 52(12): 411-418.
[4] LU Bo, LYU Xiao. Detection of Web Command Injection Vulnerabilities on IOS-XE Based on Static Analysis-drivenApproach [J]. Computer Science, 2025, 52(12): 419-427.
[5] MAO Ruiqi, CHEN Zhe. Lightweight Memory Safety Runtime Detection Method Combined with Static Analysis [J]. Computer Science, 2025, 52(11A): 241100060-8.
[6] YIN Jiale, CHEN Zhe. Dynamic Analysis Based Fuzz Testing for Memory Safety Vulnerabilities [J]. Computer Science, 2025, 52(11): 382-389.
[7] YAN Rui, CHEN Zhe. Dynamic Analysis Method for Memory Safety of Multithreaded C Programs [J]. Computer Science, 2024, 51(6A): 230900115-6.
[8] MA Yingzi, CHEN Zhe, YIN Jiale, MAO Ruiqi. Memory Security Vulnerability Detection Combining Fuzzy Testing and Dynamic Analysis [J]. Computer Science, 2024, 51(2): 352-358.
[9] LIN Jiahan, RAN Meng, PENG Jianshan. SSFuzz:State-sensitive Greybox Fuzzing for Network Protocol Services [J]. Computer Science, 2024, 51(12): 71-78.
[10] DING Duo, SUN Cong, ZHENG Tao. Robust Binary Program Debloating [J]. Computer Science, 2024, 51(10): 208-217.
[11] ZHUANG Yuan, CAO Wenfang, SUN Guokai, SUN Jianguo, SHEN Linshan, YOU Yang, WANG Xiaopeng, ZHANG Yunhai. Network Protocol Vulnerability Mining Method Based on the Combination of Generative AdversarialNetwork and Mutation Strategy [J]. Computer Science, 2023, 50(9): 44-51.
[12] ZHAO Mingmin, YANG Qiuhui, HONG Mei, CAI Chuang. Smart Contract Fuzzing Based on Deep Learning and Information Feedback [J]. Computer Science, 2023, 50(9): 117-122.
[13] DU Hao, WANG Yunchao, YAN Chenyu, LI Xingwei. Test Cases Generation Techniques for Root Cause Location of Fault [J]. Computer Science, 2023, 50(7): 10-17.
[14] YANG Yahui, MA Rongkuan, GENG Yangyang, WEI Qiang, JIA Yan. Black-box Fuzzing Method Based on Reverse-engineering for Proprietary Industrial Control Protocol [J]. Computer Science, 2023, 50(4): 323-332.
[15] HE Jie, CAI Ruijie, YIN Xiaokang, LU Xuanting, LIU Shengli. Detection of Web Command Injection Vulnerability for Cisco IOS-XE [J]. Computer Science, 2023, 50(4): 343-350.
Viewed
Full text


Abstract

Cited
  Shared   
  Discussed   
No Suggested Reading articles found!
渝ICP备16013121号-4
Add:18# Honghu West Rd., Yubei ,Chongqing,China    Post Code: 401121
Tel: 023-63500828/023-67039612/023-67039623
E-mail: jsjkx12@163.com
Powered by Beijing Magtech Co., Ltd.