Fuzzing has become a commonly used approach to identifying bugs in complex, real-world programs. However, interpreters are notoriously difficult to fuzz effectively, as they expect highly structured inputs, which are rarely produced by most fuzzing mutations. For this class of programs, grammar-based fuzzing has been shown to be effective. Tools based on this approach can find bugs in the code that is executed after parsing the interpreter inputs, by following language-specific rules when generating and mutating test cases. Unfortunately, grammar-based fuzzing is often unable to discover subtle bugs associated with the parsing and handling of the language syntax. Additionally, if the grammar provided to the fuzzer is incomplete, or does not match the implementation completely, the fuzzer will fail to exercise important parts of the available functionality. In this paper, we propose a new fuzzing technique, called Token-Level Fuzzing. Instead of applying mutations either at the byte level or at the grammar level, Token-Level Fuzzing applies mutations at the token level. Evolutionary fuzzers can leverage this technique to both generate inputs that are parsed successfully and generate inputs that do not conform strictly to the grammar. As a result, the proposed approach can find bugs that neither byte-level fuzzing nor grammar-based fuzzing can find. We evaluated Token-Level Fuzzing by modifying AFL and fuzzing four popular JavaScript engines, finding 29 previously unknown bugs, several of which could not be found with state-of-the-art byte-level and grammar-based fuzzers.

翻译：模糊测试已成为识别复杂真实程序中漏洞的常用方法。然而，解释器因其期望高度结构化的输入而难以进行有效模糊测试，大多数模糊测试变异生成的内容极少符合这种结构要求。对于此类程序，基于语法的模糊测试已被证明行之有效。基于该方法的工具通过遵循特定语言规则生成和变异测试用例，能够发现解释器输入解析后所执行代码中的漏洞。遗憾的是，基于语法的模糊测试往往无法发现与语言语法解析和处理相关的细微漏洞。此外，若提供给模糊测试器的语法不完整或与实现不完全匹配，模糊测试器将无法充分覆盖可用功能的重要部分。本文提出一种名为"面向标记的模糊测试"的新型模糊测试技术。该技术不强调在字节级或语法级应用变异，而是将变异操作作用于标记级。进化式模糊测试器可借助该技术既生成能被成功解析的输入，也生成不完全符合语法的输入。因此，所提方法能够发现字节级模糊测试和基于语法的模糊测试均无法检测的漏洞。我们通过修改AFL并对四种主流JavaScript引擎进行模糊测试来评估面向标记的模糊测试，共发现29个此前未知的漏洞，其中数个漏洞无法通过当前最先进的字节级和基于语法的模糊测试器发现。