Some bugs cannot be exposed by program inputs, but only by certain program environments. During execution, most programs access various resources, like databases, files, or devices, that are external to the program and thus part of the program's environment. In this paper, we present a coverage-guided, mutation-based environment synthesis approach of bug-inducing program environments. Specifically, we observe that programs interact with their environment via dedicated system calls and propose to intercept these system calls (i) to capture the resources accessed during the first execution of an input as initial program environment, and (ii) mutate copies of these resources during subsequent executions of that input to generate slightly changed program environments. Any generated environment that is observed to increase coverage is added to the corpus of environment seeds and becomes subject to further fuzzing. Bug-inducing program environments are reported to the user. Experiments demonstrate the effectiveness of our approach. We implemented a prototype called AFLChaos which found bugs in the resource-handling code of five (5) of the seven (7) open source projects in our benchmark set (incl. OpenSSL). Automatically, AFLChaos generated environments consisting of bug-inducing databases used for storing information, bug-inducing multimedia files used for streaming, bug-inducing cryptographic keys used for encryption, and bug-inducing configuration files used to configure the program. To support open science, we publish the experimental infrastructure, our tool, and all data.

翻译：某些缺陷无法通过程序输入暴露，而只能由特定程序环境引发。在运行过程中，大多数程序会访问数据库、文件或设备等外部资源，这些资源属于程序环境的一部分。本文提出了一种基于覆盖率引导和变异的环境合成方法，用于发现引发程序缺陷的环境。具体而言，我们观察到程序通过专用系统调用与环境交互，并提出拦截这些系统调用的方法：(i) 捕获输入首次执行时访问的资源作为初始程序环境；(ii) 在后续执行该输入时对这些资源的副本进行变异，生成略微变化的程序环境。任何被观测到能提升覆盖率的生成环境都会被加入环境种子语料库，并接受进一步模糊测试。最终，引发程序缺陷的环境会被报告给用户。实验证明了该方法的有效性。我们实现了原型工具AFLChaos，该工具在基准测试集中七个（7个）开源项目中的五个（5个）（包括OpenSSL）的资源处理代码中发现了缺陷。AFLChaos能够自动生成由以下内容组成的缺陷环境：用于存储信息的缺陷数据库、用于流媒体的缺陷多媒体文件、用于加密的缺陷密钥，以及用于程序配置的缺陷配置文件。为支持开放科学，我们公开了实验基础设施、工具及所有数据。