Crash report accumulation is a necessary step during continuous fuzzing. Dynamic software analysis techniques like fuzzing and dynamic symbolic execution generate a large number of crashes for analysis. However, the time and resource constraints often lead to the postponement of fixing some less critical issues, potentially introducing new errors in future releases. Thus, there is a need to distinguish new errors from old ones. We propose a crash accumulation method and implemented it as part of the CASR toolset. We evaluated our approach on crash reports collected from fuzzing results.
翻译:崩溃报告累积是持续模糊测试过程中的必要步骤。诸如模糊测试和动态符号执行等动态软件分析技术会生成大量崩溃以供分析。然而,时间和资源限制常常导致推迟修复一些不太关键的问题,这可能在未来版本中引入新的错误。因此,需要区分新错误与旧错误。我们提出了一种崩溃累积方法,并将其作为CASR工具集的一部分实现。我们在从模糊测试结果收集的崩溃报告上评估了我们的方法。