TY - JOUR AU - Liu, Xiao AU - Li, Xiaoting AU - Prajapati, Rupesh AU - Wu, Dinghao PY - 2019/07/17 Y2 - 2024/03/29 TI - DeepFuzz: Automatic Generation of Syntax Valid C Programs for Fuzz Testing JF - Proceedings of the AAAI Conference on Artificial Intelligence JA - AAAI VL - 33 IS - 01 SE - AAAI Technical Track: Applications DO - 10.1609/aaai.v33i01.33011044 UR - https://ojs.aaai.org/index.php/AAAI/article/view/3895 SP - 1044-1051 AB - <p>Compilers are among the most fundamental programming tools for building software. However, production compilers remain buggy. Fuzz testing is often leveraged with newlygenerated, or mutated inputs in order to find new bugs or security vulnerabilities. In this paper, we propose a grammarbased fuzzing tool called DEEPFUZZ. Based on a generative <em>Sequence-to-Sequence</em> model, DEEPFUZZ automatically and continuously generates well-formed C programs. We use this set of new C programs to fuzz off-the-shelf C compilers, e.g., GCC and Clang/LLVM. We present a detailed case study to analyze the success rate and coverage improvement of the generated C programs for fuzz testing. We analyze the performance of DEEPFUZZ with three types of sampling methods as well as three types of generation strategies. Consequently, DEEPFUZZ improved the testing efficacy in regards to the line, function, and branch coverage. In our preliminary study, we found and reported 8 bugs of GCC, all of which are actively being addressed by developers.</p> ER -