View in EDS

CoverFuzz: A Coverage‐Guided and General‐Purpose Fuzzing Framework.

Saved in:
Bibliographic Details
Title: CoverFuzz: A Coverage‐Guided and General‐Purpose Fuzzing Framework.
Authors: Lin, Renze1 (AUTHOR), Wang, Ran1 (AUTHOR) wangran@hdu.edu.cn, Xu, Xianghua1 (AUTHOR), Long, Guodong2 (AUTHOR), Zhang, Dongqi3 (AUTHOR)
Source: Journal of Software: Evolution & Process. May2026, Vol. 38 Issue 5, p1-16. 16p.
Subjects: Programming languages, Software reliability, Software measurement, Defect tracking (Computer software development)
Abstract: Fuzz testing has proven highly effective in detecting errors and vulnerabilities across a wide range of systems under test (SUTs). For SUTs that take programming languages as input, such as compilers, runtime engines, constraint solvers, and software libraries with accessible APIs, their stability is crucial since these systems serve as the foundation of most software. The correctness of these foundational systems directly determines the reliability of upper layer software. However, existing general purpose fuzzers often neglect the guiding role of coverage information during fuzzing loops and rely on overly simplistic methods for automatic prompt generation. To address these issues, this paper proposes CoverFuzz, a coverage guided and general‐purpose fuzzing framework that supports multiple large models and enables fuzz testing across different programming languages, SUTs, and their respective characteristics. The key idea behind CoverFuzz is to employ a nonuniform coverage guided fuzzing loop, which not only maintains the overall efficiency of the fuzzing process but also effectively utilizes coverage information to explore untested regions of the target system. To realize CoverFuzz, we introduce two core techniques: an expert template‐based prompt generation method and a nonuniform coverage guided fuzzing loop. The former reduces the user's effort in configuring CoverFuzz and improves the quality of initial prompts, while the latter leverages coverage feedback to enhance the exploration of SUTs and facilitate bug discovery. We evaluated CoverFuzz on four SUTs that accept different input languages, including C, C++, Go, and SMT2. The experimental results demonstrate that CoverFuzz achieves higher code coverage than state of the art general purpose fuzzers across all four languages. Moreover, CoverFuzz discovered 47 bugs in systems such as GCC, Clang, CVC5, and Go, 18 of which were previously unknown. [ABSTRACT FROM AUTHOR]
Copyright of Journal of Software: Evolution & Process is the property of Wiley-Blackwell and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)
Database: Engineering Source
Description
Abstract:Fuzz testing has proven highly effective in detecting errors and vulnerabilities across a wide range of systems under test (SUTs). For SUTs that take programming languages as input, such as compilers, runtime engines, constraint solvers, and software libraries with accessible APIs, their stability is crucial since these systems serve as the foundation of most software. The correctness of these foundational systems directly determines the reliability of upper layer software. However, existing general purpose fuzzers often neglect the guiding role of coverage information during fuzzing loops and rely on overly simplistic methods for automatic prompt generation. To address these issues, this paper proposes CoverFuzz, a coverage guided and general‐purpose fuzzing framework that supports multiple large models and enables fuzz testing across different programming languages, SUTs, and their respective characteristics. The key idea behind CoverFuzz is to employ a nonuniform coverage guided fuzzing loop, which not only maintains the overall efficiency of the fuzzing process but also effectively utilizes coverage information to explore untested regions of the target system. To realize CoverFuzz, we introduce two core techniques: an expert template‐based prompt generation method and a nonuniform coverage guided fuzzing loop. The former reduces the user's effort in configuring CoverFuzz and improves the quality of initial prompts, while the latter leverages coverage feedback to enhance the exploration of SUTs and facilitate bug discovery. We evaluated CoverFuzz on four SUTs that accept different input languages, including C, C++, Go, and SMT2. The experimental results demonstrate that CoverFuzz achieves higher code coverage than state of the art general purpose fuzzers across all four languages. Moreover, CoverFuzz discovered 47 bugs in systems such as GCC, Clang, CVC5, and Go, 18 of which were previously unknown. [ABSTRACT FROM AUTHOR]
ISSN:20477473
DOI:10.1002/smr.70122