FairFuzz-TC: a fuzzer targeting rare branches

Abstract

FairFuzz is a coverage-guided mutational fuzzing tool based on AFL, which targets its mutation strategy towards rare branches in the program. FairFuzz was built to run on command-line C $${\backslash }$$ C++ programs which accept a single file as input. We introduce the modifications to FairFuzz which enable it to run on Test-Comp benchmarks; we refer to this altered version as FairFuzz-TC. FairFuzz-TC placed in the middle of the testing competition. FairFuzz-TC had better performance on the error-finding benchmarks than on the branch coverage benchmarks. We analyze the results and find that the benchmarks on which FairFuzz-TC has the most difficulties are those where (a) most functionality is under hard comparisons (requiring precise input values), (b) getting a seed input on which the program does not crash or time out is difficult, or (c) the program takes too much time to execute.