Module 4: Random Testing

Question 1

random testing (fuzzing)

Answer 1

idea: feed random inputs to a program
observe whether it behaves correctly
special case of mutation analysis

Question 2

infinite monkey theorem

Answer 2

a monkey hitting keys at random on a typewriter will produce any given text…with probability increasing 1 as time increases

Question 3

what kind of bugs can fuzzing find?

Answer 3

memory errors
other undefined behavior
assertion violations
infinite loops
concurrency bugs (data races, deadlocks, etc)

Question 4

random testing pros and cons

Answer 4

pros:
easy to implement
provably good coverage given enough tests
can work with programs in any format
appealing for finding security vulnerabilities

cons:
inefficient test suite
might find unimportant bugs
poor code coverage

Question 5

afl core ideas:

Answer 5

• genetic algorithm
• efficient source-code instrumentation
• effective heuristics for input mutation

Question 6

fuzz targets

Answer 6

enable to fuzz libraries (i.e. program components) instead of whole programs

Question 7

cuzz: fuzzing thread schedules

Answer 7

introduces Sleep() calls

• automatically
• systematically before each statement
• gives worst case

Question 8

bug depth

Answer 8

the number of ordering constraints a schedule has to satisfy to find the bug