3 ms·

This is a better link: https://srg.doc.ic.ac.uk/projects/grayc/ https://srg.doc.ic.ac.uk/projects/grayc/ SRG is the group that maintains KLEE, the symbolic ex

This is a better link: https://srg.doc.ic.ac.uk/projects/grayc/ https://srg.doc.ic.ac.uk/projects/grayc/ SRG is the group that maintains KLEE, the symbolic execution engine https://klee.github.io/ https://klee.github.io/

wyldfire 3y ago
protobuf clang fuzzer is some related work [1][2] > transforming fuzzed programs so that they produce meaningful output, allowing differential testing to be used as a test oracle, and paving the way for fuzzer-generated programs to be integrated into compiler and code analyser regression test suites. But this ^^ seems particularly novel! Sadly, fuzzers like the protobuf one often produce compiler crashes due to failed assertions that are difficult to prioritize over other compiler features/fixes that are more obviously relevant. But if it can find a miscompile, that's a real big deal IMO. [1] https://llvm.org/devmtg/2017-10/slides/Serebryany-Structure-aware%20fuzzing%20for%20Clang%20and%20LLVM%20with%20libprotobuf-mutator.pdf https://llvm.org/devmtg/2017-10/slides/Serebryany-Structure-... [2] https://youtu.be/U60hC16HEDY https://youtu.be/U60hC16HEDY