SAND: Decoupling Sanitization from Fuzzing for Low Overhead

arXiv:2402.16497v1 Announce Type: new
Abstract: Sanitizers provide robust test oracles for various software vulnerabilities. Fuzzing on sanitizer-enabled programs has been the best practice to find software bugs. Since sanitizers need to heavily instrument a target program to insert run-time checks, sanitizer-enabled programs have much higher overhead compared to normally built programs. In this paper, we present SAND, a new fuzzing framework that decouples sanitization from the fuzzing loop. SAND performs fuzzing on a normally built program and only invokes sanitizer-enabled …

arxiv best practice bugs cs.cr cs.se find fuzzing higher low practice program run sanitizer sanitizers software software vulnerabilities target test vulnerabilities