Abstract:

Fuzz testing is regarded as one of the key technologies and major research hotspots in the field of software vulnerability discovery. Writing high-quality fuzz testing drivers has long been a difficult and error-prone task. It is not only time-consuming and labor-intensive, but also requires developers to possess a deep understanding of the target library. Traditional automated fuzz driver generation approaches attempt to extract data-flow and control-flow dependencies among API from client code in different ways, but they fail to capture the complex usage-pattern constraints of some API, resulting in low coverage and frequent API misuse. With the rise of large language models, many LLM-based fuzz driver generation approaches have recently emerged. However, their prompt construction is typically centered only on functions and related types, lacking semantic elements associated with the target project and thus underutilizing the semantic reasoning capabilities of LLM. To address these challenges, this paper proposed StageFuzz, a fuzz driver generation approach that incorporated both semantic and syntactic library elements. StageFuzz heuristically queried the LLM to obtain two types of semantic elements, namely library pipelines and semantic stages. It then performed three levels of driver generation and mutation based on pipelines, semantic stages, and API, together with existing fuzz drivers, in order to improve driver quality and reduce generation time. This paper evaluats StageFuzz on eight open-source libraries. Experimental results show that, compared with the current state-of-the-art tool, StageFuzz achieves a 10.40% coverage improvement while consuming only 12.73% of the LLM tokens and 1.79% of the generation time.

Key words: fuzz testing, vulnerability detection, driver generation, large language model, library fuzzing