Closed CarterPape closed 9 years ago
Language fuzzing using constraint logic programming
http://dl.acm.org/citation.cfm?id=2642963
@inproceedings{Dewey:2014:LFU:2642937.2642963, author = {Dewey, Kyle and Roesch, Jared and Hardekopf, Ben}, title = {Language Fuzzing Using Constraint Logic Programming}, booktitle = {Proceedings of the 29th ACM/IEEE International Conference on Automated Software Engineering}, series = {ASE '14}, year = {2014}, isbn = {978-1-4503-3013-8}, location = {Vasteras, Sweden}, pages = {725--730}, numpages = {6}, url = {http://doi.acm.org/10.1145/2642937.2642963}, doi = {10.1145/2642937.2642963}, acmid = {2642963}, publisher = {ACM}, address = {New York, NY, USA}, keywords = {automated program generation, automated testing, fuzzing}, }
Other (Program Generation)
We compare two different approaches to program generation for language fuzzing: sto (the stochastic grammar approach) and clp (our CLP-based approach). The comparison is a bit misleading because CLP can implement stochastic grammars; in fact, all of the approaches are implemented in SWI-Prolog, a publically-available Prolog engine that contains a constraint solver to implement CLP. The comparison does showcase the additional expressiveness and efficiency of CLP over purely stochastic grammars. While we requested implementations of the existing JavaScript fuzzers jsfunfuzz and LangFuzz from Mozilla for comparison with our technique, our request was ignored. Our entire infrastructure, including our implementation of stochastic grammars and the exact predicates that we use for JavaScript, is available in the supplementary materials located under the Downloads link at http://www.cs.ucsb.edu/~pllab.
NA
Fuzz testing builds confidence in compilers and interpreters. It is desirable for fuzzers to allow targeted generation of programs that showcase specific language features and behaviors. However, the predominant program generation technique used by most language fuzzers, stochastic context-free grammars, does not have this property. We propose the use of constraint logic programming (CLP) for program generation. Using CLP, testers can write declarative predicates specifying interesting programs, including syntactic features and semantic behaviors. CLP subsumes and generalizes the stochastic grammar approach
Yes
Added as langfuzz About to upload data to TeraPromise
Authors emailed.
Paper link: http://dl.acm.org/citation.cfm?id=2642963