Can I read What Happens When We Fuzz? Investigating OSS-Fuzz Bug History on EtoBox?

What Happens When We Fuzz? Investigating OSS-Fuzz Bug History by Keller, Brandon; Meneely, Andrew; Meyers, Benjamin is a scholarly article available to read on EtoBox.

What is What Happens When We Fuzz? Investigating OSS-Fuzz Bug History about?

BACKGROUND: Software engineers must be vigilant in preventing and correcting vulnerabilities and other critical bugs. In servicing this need, numerous tools and techniques have been developed to assist developers. Fuzzers, by autonomously generating inputs to test programs, promise to save time by detecting memory corruption, input handling, exception cases, and other issues. AIMS: The goal of this work is to empower developers to prioritize their quality assurance by analyzing the history of bugs generated by OSS-Fuzz. Specifically, we examined what has happened when a project adopts fuzzing as a quality assurance practice by measuring bug lifespans, learning opportunities, and bug types. METHOD: We analyzed 44,102 reported issues made public by OSS-Fuzz prior to March 12, 2022. We traced the Git commit ranges reported by repeated fuzz testing to the source code repositories to identify how long fuzzing bugs remained in the system, who fixes these bugs, and what types of problems fuzzers historically have found. We identified the bug-contributing commits to estimate when the bug containing code was introduced, and measure the timeline from introduction to detection to fix. RESULTS

Author

Keller, Brandon; Meneely, Andrew; Meyers, Benjamin

Published

2023

Language

EN