UBfuzz：发现 Sanitizer 实现中的 Bug
UBfuzz: Finding Bugs in Sanitizer Implementations
AI总结：
本文提出测试框架 UBfuzz，通过生成含未定义行为的程序并利用 crash-site mapping 测试预言机进行差分测试，在 GCC 和 LLVM sanitizers 中发现 31 个 bug，揭示了 sanitizer 的假阴性问题。
摘要：
在本文中，我们提出了一个用于验证编译器中 sanitizer 实现的测试框架。我们的核心组件是（1）一个专门设计用于生成包含未定义行为（UB）的程序的程序生成器，以及（2）一个用于 sanitizer 测试的新型测试预言机。该程序生成器采用 Shadow Statement Insertion，这是一种用于将 UB 引入有效种子程序的通用且有效的方法。生成的 UB 程序随后被用于多个 sanitizer 实现的差分测试。然而，不一致的 sanitizer 报告可能源于编译器优化或 sanitizer bug。为了准确确定差异是否由 sanitizer bug 引起，我们引入了一种名为 crash-site mapping 的新测试预言机。我们已将我们的技术整合到 UBfuzz 中，这是一个用于测试 sanitizer 的实用工具。在为期五个月的测试期间，UBfuzz 成功在 GCC 和 LLVM sanitizers 中发现了 31 个 bug。这些 bug 揭示了 sanitizer 中严重的假阴性问题，即程序中的某些 UB 未被报告。本研究为这一关键研究领域的进一步探索铺平了道路。
英文摘要：
In this paper, we propose a testing framework for validating sanitizer implementations in compilers. Our core components are (1) a program generator specifically designed for producing programs containing undefined behavior (UB), and (2) a novel test oracle for sanitizer testing. The program generator employs Shadow Statement Insertion, a general and effective approach for introducing UB into a valid seed program. The generated UB programs are subsequently utilized for differential testing of multiple sanitizer implementations. Nevertheless, discrepant sanitizer reports may stem from either compiler optimization or sanitizer bugs. To accurately determine if a discrepancy is caused by sanitizer bugs, we introduce a new test oracle called crash-site mapping. We have incorporated our techniques into UBfuzz, a practical tool for testing sanitizers. Over a five-month testing period, UBfuzz successfully found 31 bugs in both GCC and LLVM sanitizers. These bugs reveal the serious false negative problems in sanitizers, where certain UBs in programs went unreported. This research paves the way for further investigation in this crucial area of study.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
