Abstract:Rust has been extensively used in software development in the past decades due to its memory safety mechanisms and gradually matured ecosystems. Enhancing the quality of Rust libraries is critical to Rust ecosystems as the libraries are often the core component of software systems. Nevertheless, we observe that existing approaches fall short in testing Rust API interactions - they either lack a Rust ownership-compliant API testing method, fail to handle the large search space of function dependencies, or are limited by pre-selected codebases, resulting in inefficiencies in finding errors. To address these issues, we propose a fuzzing technique, namely FRIES, that efficiently synthesizes and tests complex API interactions to identify defects in Rust libraries, and therefore promises to significantly improve the quality of Rust libraries. Behind our approach, a key technique is to traverse a weighted API dependency graph, which encodes not only syntactic dependency between functions but also the common usage patterns mined from the Rust ecosystem that reflect the programmer’s thinking. Combined with our efficient generation algorithm, such a graph structure significantly reduces the search space and lets us focus on finding hidden bugs in common application scenarios. Meanwhile, an ownership assurance algorithm is specially designed to ensure the validity of the generated Rust programs, notably improving the success rate of compiling fuzz targets. Experimental results demonstrate that this technique can indeed generate high-quality fuzz targets with minimal computational resources, while more efficiently discovering errors that have a greater impact on actual development, thereby mitigating the impact on the robustness of programs in the Rust ecosystem. So far, FRIES has identified 130 bugs, including 84 previously unknown bugs, in 20 well-known latest versions of Rust libraries, of which 54 have been confirmed.

RULF: Rust Library Fuzzing via API Dependency Graph Traversal

Fuzz Testing for Rust Library Functions

FRIES: Fuzzing Rust Library Interactions Via Efficient Ecosystem-Guided Target Generation

Fuzz Driver Synthesis for Rust Generic APIs

Automated Fuzzing Harness Generation for Library APIs and Binary Protocol Parsers

Atlas: Automating Cross-Language Fuzzing on Android Closed-Source Libraries

Forest: A Tree-based Black-box Fuzzing Approach for RESTful APIs

foREST: A Tree-based Approach for Fuzzing RESTful APIs

FuzzTheREST: An Intelligent Automated Black-box RESTful API Fuzzer

VisFuzz: understanding and intervening fuzzing with interactive visualization

A Lightweight and High-Precision Approach for Bulky JavaScript Engines Fuzzing

Fuzzing: A Survey for Roadmap

Fuzzing Based on Function Importance by Interprocedural Control Flow Graph

SkipFuzz: Active Learning-based Input Selection for Fuzzing Deep Learning Libraries

UNIFUZZ: A Holistic and Pragmatic Metrics-Driven Platform for Evaluating Fuzzers

The Seeds of the FUTURE Sprout from History: Fuzzing for Unveiling Vulnerabilities in Prospective Deep-Learning Libraries

FuzzFactory: domain-specific fuzzing with waypoints

FishFuzz: Throwing Larger Nets to Catch Deeper Bugs

NESTFUZZ: Enhancing Fuzzing with Comprehensive Understanding of Input Processing Logic

FuzzDistill: Intelligent Fuzzing Target Selection using Compile-Time Analysis and Machine Learning

REST API Fuzzing by Coverage Level Guided Blackbox Testing