FUDGE: fuzz driver generation at scale

TLDR

Fuzzing libraries requires a fuzz driver that exercises library code, but writing such drivers is largely manual and hampers widespread fuzzing adoption. This paper presents Fudge, a system that automatically generates fuzz drivers to overcome this bottleneck. Fudge produces driver candidates by analyzing existing client code, synthesizing C/C++ programs and build scripts, and automatically assessing their quality. Using Fudge, thousands of drivers were created, over 200 integrated into continuous fuzzing, several upstreamed to OSS‑Fuzz, and more than 150 bugs—including critical security vulnerabilities—were fixed.

Abstract

At Google we have found tens of thousands of security and robustness bugs by fuzzing C and C++ libraries. To fuzz a library, a fuzzer requires a fuzz driver—which exercises some library code—to which it can pass inputs. Unfortunately, writing fuzz drivers remains a primarily manual exercise, a major hindrance to the widespread adoption of fuzzing. In this paper, we address this major hindrance by introducing the Fudge system for automated fuzz driver generation. Fudge automatically generates fuzz driver candidates for libraries based on existing client code. We have used Fudge to generate thousands of new drivers for a wide variety of libraries. Each generated driver includes a synthesized C/C++ program and a corresponding build script, and is automatically analyzed for quality. Developers have integrated over 200 of these generated drivers into continuous fuzzing services and have committed to address reported security bugs. Further, several of these fuzz drivers have been upstreamed to open source projects and integrated into the OSS-Fuzz fuzzing infrastructure. Running these fuzz drivers has resulted in over 150 bug fixes, including the elimination of numerous exploitable security vulnerabilities.