Intro to OSS-Fuzz-Gen

A Framework for Fuzz Target Generation and Evaluation

Konstantinos Chousos

sdi2000215@di.uoa.gr

Department of Informatics & Telecommunications, University of Athens

April 11, 2025

Fuzzing

What is fuzzing?

Fuzzing is the execution of a Program Under Test (PUT) using input(s) sampled from an input space (the “fuzz input space”) that protrudes the expected input space of the PUT [1].

Fuzzing

Why fuzz?

Fuzz testing is valuable for:

Software that receives inputs from untrusted sources (security);

Sanity checking the equivalence of two complex algorithms (correctness);

Verifying the stability of a high-volume API that takes complex inputs (stability), e.g. a decompressor, even if all the inputs are trusted.

— Google

LibFuzzer

Fuzz target structure

Entry point called repeatedly with mutated inputs.
Feedback-driven: uses coverage to guide mutations.
Best for libraries, not full programs.

extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
  DoSomethingWithData(Data, Size);
  return 0;
}extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
  DoSomethingWithData(Data, Size);
  return 0;
}extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
  DoSomethingWithData(Data, Size);
  return 0;
}

AFL++

AFL fuzzes programs/binaries. The inputs are taken from the seeds_dir and their mutations.

$ ./afl-fuzz -i seeds_dir -o output_dir -- /path/to/tested/program

Works on black-box or instrumented binaries.
Uses fork-server model for speed.
Supports persistent mode, QEMU, and Unicorn modes.

OSS-Fuzz-Gen

Architecture

Warning

The project must come with preexisting fuzz targets. Fuzz-Introspector gives the LLM info about the harnesses, not the main program/functions.

Δεδομένου ενός github repo link, γίνονται τα ακόλουθα:

compile το project με βάση κάποια predefined generic scripts κι άλλα “build heuristics”
ξανά compile με Fuzz Introspector για program analysis -> json report file με στατιστικά για κάθε συνάρτηση, καθώς πληροφορίες για το signature, τα ορίσματα κτλ.
το report χρησιμοποιείται σε ένα prompt που δίνεται στο LLM για να παράξει harness για κάποια συγκεκριμένη συνάρτηση.
Κάθε harness τεστάρετε για το αν δουλεύει και δεν κρασάρει κατευθείαν. Μετά γίνονται integrated σε OSS-Fuzz/ClusterFuzzLite projects.

OSS-Fuzz-Gen

LLM Prompting

Input: Fuzz-Introspector json code reports.
Include the above in prompt templates → send to LLM.
Result: Harness returned from LLM.

Demo Time

Clone and install Fuzz-Introspector.
Clone and setup OSS-Fuzz-Gen.
1. Checkout working commit: $ git checkout 171aac2.
2. Export API key.
Prepare a target project. README uses dvhar/dateparse.
Execute the script:

❯ python3 -m experimental.from_scratch.generate \
              --language c++ \
              --model gpt-4 \
              --function dateparse \
              --target-dir ../../dvhar/dateparse/ \
              --out-dir out

Demo Time

Result

// out/01.rawoutput
<code>
#include <stdint.h>
#include <stddef.h>

typedef struct {
    int sec;     /* seconds after the minute - [ 0 to 59 ] */
    int min;     /* minutes after the hour - [ 0 to 59 ] */
    int hour;    /* hours since midnight - [ 0 to 23] */
    int mday;    /* day of the month - [ 1 to 31 ] */
    int mon;     /* months since January - [ 0 to 11 ] */
    int year;    /* years */
    int wday;    /* days since Sunday - [ 0 to 6 ] */
    int yday;    /* days since January 1 - [ 0 to 365 ] */
} date_t;

extern int dateparse(const char* datestr, date_t* t, int *offset, int stringlen);

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
    // Ignore input if it is less than 1
    if (size < 1) {
        return 0;
    }

    // Convert data to string
    char *datestr = (char *)data;

    // Initialize a date_t struct and an offset integer
    date_t t;
    int offset = 0;

    // Call the function-under-test
    dateparse(datestr, &t, &offset, (int)size);

    return 0;
}
</code>

1 / 36

Intro to OSS-Fuzz-Gen A Framework for Fuzz Target Generation and Evaluation Konstantinos Chousos sdi2000215@di.uoa.gr Department of Informatics & Telecommunications, University of Athens April 11, 2025