A regression fuzzing method, device, equipment and storage medium

Abstract

The present application relates to the technical field of fuzzy testing, in particular to a regression fuzzy testing method, device, equipment and storage medium. The present application first extracts the control flow information and the data flow information of the target code, monitors the control flow coverage of the control flow information and the data flow coverage of the data flow information of the target code after inputting the test case into the program source code, controls the flow coverage and the data flow coverage, updates the test case until the program source code crashes, and obtains the final test case, that is, finds the test case that can make the program source code crash. From the above analysis, it can be known that the present application uses the control flow coverage and the data flow coverage to guide the update of the test case, so that the data flow coverage can fully cover the target code and the related code, so as to improve the regression vulnerability detection capability.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of fuzz testing, in particular to a regression fuzz testing method, device, equipment and storage medium. BACKGROUND

[0002] After the version of the program source code is changed, new code or part of the code in the program source code is changed, and the new code or the changed code is the target code. Regression fuzz testing technology can be used to test the regression vulnerability caused by executing the target code. The existing fuzz testing technology for regression testing scenarios only considers control flow information, without considering data flow information that may be more likely to trigger a regression vulnerability, thus limiting the detection ability of the regression vulnerability.

[0003] In summary, the prior art does not consider the detection ability of the regression vulnerability.

[0004] Therefore, the prior art still needs to be improved and improved. SUMMARY

[0005] To solve the above technical problems, the present application provides a regression fuzz testing method, device, equipment and storage medium, which solves the problem that the prior art does not consider the detection ability of the regression vulnerability.

[0006] To achieve the above purpose, the present application adopts the following technical solutions:

[0007] In a first aspect, the present application provides a regression fuzz testing method, comprising:

[0008] Obtaining target code generated by version change of program source code, and extracting control flow information and data flow information of the target code;

[0009] Inputting test cases to the program source code, and monitoring control flow coverage of the control flow information and data flow coverage of the data flow information when the program source code after inputting the test cases does not crash;

[0010] According to the control flow coverage and the data flow coverage, updating the test cases until the program source code crashes, and obtaining the final test cases.

[0011] In an implementation mode, the extracting the control flow information and the data flow information of the target code comprises:

[0012] Extracting the calling function corresponding to the target code;

[0013] Extracting the control flow information related to the calling function of the target code;

[0014] parsing basic blocks contained in the target code, the basic block being a code block with only one input port and one output port;

[0015] filtering definition basic blocks for defining variables and usage basic blocks for calling variables from the basic blocks;

[0016] determining a data dependency graph between the definition basic blocks;

[0017] taking the definition basic blocks, the usage basic blocks and the data dependency graph as data flow information.

[0018] In an implementation mode, the monitoring of the control flow coverage of the control flow information and the data flow coverage of the data flow information comprises:

[0019] inserting a monitoring program on the program source code;

[0020] monitoring the execution times of the control flow information by the monitoring program, and obtaining a control flow coverage according to the execution times of the control flow information;

[0021] monitoring the data flow coverage of the data flow information by the monitoring program.

[0022] In an implementation mode, the monitoring of the data flow coverage of the data flow information by the monitoring program comprises:

[0023] monitoring the nearest distance and the farthest distance contained in the data dependency graph of a target definition by the monitoring program, the target definition being a definition of the definition basic block;

[0024] obtaining a definition sub-score of each target definition according to the nearest distance and the farthest distance of each target definition;

[0025] filtering a target definition score from all the definition sub-scores of the target definitions according to the definition sub-score of each target definition;

[0026] monitoring the execution times of the usage basic block corresponding to each target usage by the monitoring program, the target usage being a usage of the usage basic block, and obtaining a target usage score according to the execution times corresponding to each target usage;

[0027] taking the target definition score and the target usage score as the data flow coverage.

[0028] In an implementation mode, the obtaining of the target usage score according to the execution times corresponding to each target usage comprises:

[0029] Accumulate the execution times corresponding to each of the target uses to obtain a target use score.

[0030] In an implementation, the updating the test case according to the control flow coverage and the data flow coverage until the program source code crashes to obtain a final test case comprises:

[0031] When the control flow coverage is greater than a first threshold and / or the target definition score is greater than a second threshold and / or the target use score is greater than a third threshold, determining a test mutation case of the test case;

[0032] Inputting the test mutation case to the program source code, and when the program source code after inputting the test mutation case does not crash, updating the test case until the program source code crashes to obtain a target test case.

[0033] In an implementation, the updating the test case according to the control flow coverage and the data flow coverage until the program source code crashes to obtain a final test case further comprises:

[0034] When the program source code after inputting the test mutation case crashes, taking the test mutation case as the target test case.

[0035] In a second aspect, the embodiments of the present application further provide a regression fuzzing device, wherein the device comprises the following components:

[0036] An information extraction module is configured to obtain target code generated due to version change of program source code, and extract control flow information and data flow information of the target code;

[0037] A monitoring module is configured to input a test case to the program source code, and when the program source code after inputting the test case does not crash, monitor control flow coverage of the control flow information and data flow coverage of the data flow information;

[0038] An updating module is configured to update the test case according to the control flow coverage and the data flow coverage until the program source code crashes to obtain a final test case.

[0039] In a third aspect, the embodiments of the present application further provide a terminal device, wherein the terminal device comprises a memory, a processor, and a regression fuzzing program stored in the memory and executable on the processor, and the processor implements the steps of the regression fuzzing method when executing the regression fuzzing program.

[0040] In a fourth aspect, the embodiments of the present application further provide a computer readable storage medium, wherein the computer readable storage medium stores a regression fuzzing program, and the regression fuzzing program, when executed by a processor, implements the steps of the regression fuzzing method.

[0041] Beneficial effects: The present application firstly extracts the control flow information and the data flow information of the target code, monitors the control flow coverage of the control flow information and the data flow coverage of the data flow information of the target code after inputting the test case into the program source code, controls the control flow coverage and the data flow coverage, updates the test case until the program source code crashes, and obtains the final test case, that is, finds the test case that can make the program source code crash. From the above analysis, it can be known that the present application uses the control flow coverage and the data flow coverage to guide the update of the test case, makes the data flow coverage fully cover the target code and the related code, and improves the regression vulnerability detection capability. BRIEF DESCRIPTION OF DRAWINGS

[0042] Figure 1 The figure is a whole flowchart of the present application;

[0043] Figure 2 The figure is a regression fuzzing test flowchart of the source program code in the embodiments of the present application;

[0044] Figure 3 The figure is a static analysis flowchart in the embodiments of the present application;

[0045] Figure 4 The figure is a data dependency relationship schematic diagram in the embodiments of the present application;

[0046] Figure 5 The figure is a regression fuzzing test device structure diagram provided by the present application;

[0047] Figure 6 The figure is an internal structure principle block diagram of a terminal device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0048] The technical solutions in the present application are described clearly and completely in combination with the embodiments and the accompanying drawings of the specification. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the present application.

[0049] It is found through research that after the version of program source code is changed, new code is generated or part of the program source code is changed, and the new code or the changed code is target code. Regression fuzz testing technology can be used to test regression vulnerabilities generated by executing the target code. Existing fuzz testing technology for regression testing scenarios only considers control flow information and does not consider data flow information that can more easily trigger regression vulnerabilities, thereby limiting the detection ability of regression vulnerabilities.

[0050] To solve the above technical problems, the present application provides a regression fuzz testing method, device, equipment and storage medium, which solves the problem that the prior art does not consider the detection ability of regression vulnerabilities. In specific implementation, first, the target code generated by the version change of the program source code is obtained, and the control flow information and the data flow information of the target code are extracted; then the test case is input to the program source code, and when the program source code after the test case is input does not crash, the control flow coverage of the control flow information and the data flow coverage of the data flow information are monitored; finally, according to the control flow coverage and the data flow coverage, the test case is updated until the program source code crashes, and the final test case is obtained.

[0051] For example, during the version iteration change of the program source code, the local code of the program source code is changed, and the changed local code is the target code, that is, after the program version is changed, the changed code is called the target code. When the program source code is changed, the program source code needs to be re-fuzz tested, and this fuzz testing is regression fuzz testing. The control flow information and the data flow information contained in the target code are extracted, wherein the control flow information is each step and the execution order of each step that the target code needs to execute to achieve its function, and the data flow information is used to record the flow direction of the variables in the target code. The control flow information and the data flow information represent the target code from two different angles.

[0052] The test case is inputted to the program source code, when the program source code starts to run the test case, if the program source code does not crash (if it crashes, the test case at this time is the final test case), then monitor how much control flow information of the target code is covered (that is, monitor how many control flows are executed, that is, monitor the control flow coverage), monitor how much data flow information of the target code is covered (that is, monitor how many data flows are executed, that is, monitor the data flow coverage), then update the test case according to the control flow coverage and the data flow coverage (update the test case as the prior art), and continue to input the updated test case to the program source code, if the program source code has not crashed, continue to update the test case, until the program source code crashes, the test case corresponding to the crash is the final test case, the purpose of the present application is to find the test case that can make the program source code crash, so as to find the regression vulnerability brought by the target code to the program source code.

[0053] The regression fuzz testing method of the embodiment can be applied to a terminal device, which can be a terminal product with program testing function, such as a computer, etc. In the embodiment, as shown in Figure 1 The regression fuzz testing method specifically includes the following steps:

[0054] S100, obtaining target code generated by version change of program source code, and extracting control flow information and data flow information of the target code.

[0055] S200, inputting a test case to the program source code, when the program source code does not crash after the test case is inputted, monitoring control flow coverage of the control flow information and data flow coverage of the data flow information.

[0056] S300, updating the test case according to the control flow coverage and the data flow coverage, until the program source code crashes, and obtaining a final test case.

[0057] In the embodiment, step S100 includes the following specific steps S101-S106:

[0058] S101, extracting a calling function corresponding to the target code.

[0059] As shown in Figure 2 The static analysis of the target code can analyze the calling function contained in the target code. In the embodiment, the function containing the target code is the target function, and the calling function includes the function directly or indirectly calling the target function and the target function.

[0060] S102, extracting control flow information related to the calling function of the target code.

[0061] As Figure 2 shown, the control flow information in this embodiment is the path information from the entry of the calling function to the function call point of the target code that the calling function can reach, so as to reduce the paths that need to be explored in the fuzzing process, and make the test tend to contain the target function of the target code, thereby further improving the guiding ability.

[0062] In this embodiment, the algorithm required for extracting the control flow information is as shown below:

[0063]

[0064] The above algorithm takes the program Program (that is, the program source code) and the target point set TargetPoints (TargetPoints is the target code) as input, and outputs a mapping TF2RBB from the target calling function to the basic block set of the related possible target points that can be reached. That is, the path information from the entry of the calling function to the function call point of the target code that the calling function can reach is represented by the mapping TF2RBB. The algorithm extracts the control flow information based on the following principles:

[0065] First, the function call graph CG corresponding to the above function call is obtained, and all target functions TargetFuncs including the target code in the program source code are obtained (lines 1-2), and the mapping TF2RBB is initialized (line 3). For each target function tf, the target function is put into the queue queue, and the related target function call (that is, for each target function, which functions call it each time) and the target control flow information are analyzed one by one (lines 4-14).

[0066] That is, when the queue queue is not empty, the algorithm takes out the head function cur_f, and obtains all callers of the function from the function call graph CG (lines 6-8). For each caller, if the function has not been accessed, it is added to the mapping TF2RBB and the queue queue, respectively (lines 10-12). Subsequently, the algorithm obtains all call sites callsites in the caller that call the current function cur_f (line 13) and the basic block set that can reach any call site (line 14), and adds these reachable basic block sets to the contents of the mapping TF2RBB corresponding to the current caller (line 14).

[0067] S103, parse the basic block contained in the target code, the basic block is a code block with only one input port and one output port.

[0068] The object code contains a number of code blocks, and only the code block with one input port and one output port is a basic block.

[0069] S104, screening out a definition basic block for defining a variable and a use basic block for calling the variable from the basic block.

[0070] The basic block containing the Alloca instruction, the Load instruction and the Store instruction is taken as the definition basic block, where the Alloca instruction, the Load instruction and the Store instruction are all instructions for defining a variable. This embodiment takes the non-assignment target instruction (the target instruction is an instruction contained in the object code) as the definition of the variable, so as to find the non-target instruction using the same variable data as the target instruction.

[0071] The object code contains instructions other than the instructions for defining a variable, which are use instructions. The basic block containing the use variable instruction is a use basic block.

[0072] This embodiment uses the following algorithm to screen the definition basic block:

[0073]

[0074] The above algorithm takes the program Program (i.e. the program source code) and the target point (the target point is a basic block contained in the object code) set TargetPoints (TargetPoints is the object code) as the input, and outputs a mapping TargetDefs from the target point to the basic block set where the related target definition (the target definition is an instruction for defining a variable in the object code) is located.

[0075] That is, the above algorithm initializes the mapping TargetDefs as an empty mapping (line 1). Then, the algorithm analyzes the target points one by one, and extracts the related target definition block (lines 2-13). That is, for the current target point tp, the algorithm obtains the target function tf where the target point is located, and performs the definition-use analysis on the function (lines 2-4). Next, the target point tp is put into the queue queue, and all target definitions of tp are extracted iteratively according to the queue (lines 6-11). If the queue queue is not empty, the first instruction cur_inst in the queue is taken out (line 8); and according to the result of the definition-use analysis in line 5, all related definitions defs of the instruction which are not in the same basic block are obtained (line 9). For each definition, the algorithm adds it to the set of the mapping TargetDefs corresponding to the current target point tp (line 11). In addition, if the definition is not visited, it is added to the queue queue (lines 12-13).

[0076] This embodiment uses the following algorithm to filter the basic blocks for use:

[0077]

[0078]

[0079] For each target point (i.e. the basic block contained in the target code), the algorithm iteratively analyzes and collects the target use blocks related to the target point based on the use-definition analysis (line 5).

[0080] S105, determine the data dependency graph between the definition basic blocks.

[0081] The data dependency graph is used to represent the data dependency relationship between the definition basic blocks, that is, the data dependency graph is used to record the data or variables that are jointly defined by the definition basic blocks. Using the data dependency graph to participate in the subsequent regression fuzz testing of the target code can trigger some vulnerabilities with strict trigger conditions.

[0082] This embodiment collects all the reachable target points or the basic blocks (control flow) reachable by the target points, as well as the data dependency graph (data flow) between these basic blocks, thereby enhancing the guidance ability of the fuzz testing process for target definitions, target points, and target uses, and further triggering more regression vulnerabilities.

[0083] This embodiment uses the following algorithm to analyze the data dependency graph between the definition basic blocks:

[0084]

[0085]

[0086] The above algorithm takes the program Program (i.e. the program source code) and the target point (i.e. the basic block contained in the target code) set TargetPoints (i.e. the target code) as input, and the above algorithm outputs a mapping TGDD from the target point reachable basic block to its related data dependency basic block set (i.e. the above algorithm outputs a data dependency graph, which is used to record the connection between each basic block of the target code through the same data).

[0087] The algorithm first initializes the mapping TGDD as an empty mapping (line 1), and then analyzes each target point and extracts its related guidance relationship (lines 2-9). That is, for each target point tp, the target function tf of the target point is obtained, and the definition-use analysis is performed on the target function (lines 3-4). Subsequently, the algorithm obtains the basic block set TRBB reachable by the target point tp or the target points reachable by the target function tf (line 5). For each instruction inst in each basic block bb in TRBB, all related definitions defs within the basic block other than the basic block where inst is located are obtained (line 8). Finally, the algorithm adds the basic block where the definitions are located to the set of the mapping TGDD corresponding to the current basic block bb (line 9).

[0088] For example, as shown in FIG. 2, "def d:use b" is a target instruction included in the target code, BB2 is a target definition (that is, the basic block BB2 is a definition basic block), and BB5 is a target use (that is, the basic block BB5 is a use basic block). Although BB1 and BB4 do not include the use of the variable b and the definition of d in BB2, BB1 reaches BB3, and thus (BB3, BB1) constitutes a data dependency graph (that is, a data dependency relationship), and BB3 reaches BB4, and thus (BB4, BB3) also constitutes a data dependency graph, and similarly, BB5 reaches BB3, and thus (BB5, BB3) also constitutes a data dependency graph. Figure 4 The data dependency relationship of the embodiment includes a target point (as shown in FIG. 2), a target definition, and a target use, and collecting these relationships into the TGDD is to facilitate the program instrumentation process to instrument all data dependency relationships, and to use these relationships (that is, edges) as target data flow coverage information to guide the fuzzing process to explore different paths related to the target and their reachability. On this basis, in combination with the target definition and target use information strongly related to the target, the guidance capability of the fuzzing process for the target definition, target point, and target use can be further enhanced, the possibility of triggering a regression vulnerability can be improved, and thus the regression vulnerability detection capability can be improved.

[0089] Figure 3 S106, taking the definition basic block, the use basic block, and the data dependency graph as data flow information.

[0090] That is, the data flow information of the embodiment includes the definition basic block, the use basic block, and the data dependency graph.

[0091] That is, the data flow information of the embodiment includes the definition basic block, the use basic block, and the data dependency graph.

[0092] Embodiment Two, based on Embodiment One, in the embodiment, step S200 includes the following specific steps S201-S207:

[0093] ​S201, instrumenting a monitoring program on the program source code.

[0094] The monitoring program of this embodiment includes the instrumentation of control flow information, the instrumentation of data flow information and the instrumentation of target scores (i.e. monitoring how many control flows are executed, how many data flows are executed and computing target scores by the monitoring program). The instrumentation of target control flow information and data flow information not only has the guidance effect on specific locations in the fuzzing process, but also fully tests the code related to the target. And the instrumentation of target score information which is more related to the target point helps to further strengthen the guidance effect of the fuzzing process.

[0095] The monitoring program of this embodiment is as follows:

[0096]

[0097] This algorithm takes the original program Program (i.e. program source code), the set of target points TargetPoints, the reachable basic block mapping of calling functions TF2RBB, the target definition mapping TargetDefs, the target usage mapping TargetUses and the target-oriented data dependence mapping TGDD as inputs, and outputs the instrumented program.

[0098] This algorithm first performs the instrumentation of control flow coverage information according to the mapping TF2RBB, and then performs the instrumentation of data flow coverage information according to the mapping TGDD. Unlike control dependence, the predecessors of data dependence are not necessarily the last program execution basic block. Therefore, the instrumentation of data flow coverage information needs to first insert a series of state access related initialization instructions in each predecessor basic block (lines 4-5), and then calculate the hash value according to the access situation (line 9). Finally, in order to enhance the guidance ability of the fuzzing process for target definitions, target points and target uses, this paper calculates the related scores of each target (see section 3.2.1 for details), and performs instrumentation according to these scores (lines 11-16) in order to feedback to the fuzzing process.

[0099] S202, monitoring the number of executions of the control flow information by the monitoring program, and obtaining the control flow coverage TPScore according to the number of executions of the control flow information. tp (s):

[0100] TPScore tp (s) = Hit (tp)

[0101] In the formula, s represents the test case, tp is the basic block contained in each control flow of the target code, and Hit (tp) is the number of executions of the basic block tp.

[0102] S203, monitoring the nearest distance |b-tp| and the farthest distance L of the data dependence graph of the target definition b by the monitoring program, the target definition being the definition where the definition basic block is located.

[0103] Several definition basic blocks are used to complete the definition of a variable, if the variable is a variable in the target code, then the definition is a target definition.

[0104] Several definition basic blocks are used to complete the definition of a target definition b, and several variables are indirectly defined to complete the definition of the target definition b. The definition of each variable corresponds to a data dependence graph, the nearest distance |b-tp| is the number of basic blocks contained in the data dependence graph containing the least basic blocks. The farthest distance L is the number of basic blocks contained in the data dependence graph containing the most basic blocks

[0105] S204, obtaining the definition sub-score TDScore of each target definition according to the nearest distance and the farthest distance of each target definition tp (b):

[0106] TDScore tp (b)=L-(|b-tp|)+1

[0107] S205, screening the target definition score TDScore from all the definition sub-scores of the target definitions according to the definition sub-score of each target definition tp (s):

[0108]

[0109] TD s s is the program source code involved in running the test case s, for example, ten target definitions are involved in executing the test case s, each target definition corresponds to a definition sub-score, then there are ten definition sub-scores, and the smallest definition sub-score is screened from the ten definition sub-scores, which is the target definition score.

[0110] S206, monitoring the execution times ValidHit of each target use b' (the target use is the use where the use basic block is located) corresponding to the use basic block tp' by the monitoring program tp′ (b'), and accumulating the execution times corresponding to each target use to obtain the target use score TUScore tp′ (s):

[0111]

[0112] TUScoretp′ (b') = ValidHit tp′ (b')

[0113]

[0114] Hit(b') is the number of valid executions of the target using b' for the basic block tp', TU s is the set of all target uses on the execution path of test case s.

[0115] S207, the target definition score and the target use score are taken as data flow coverage.

[0116] In the third embodiment based on the second embodiment, step S300 comprises the following specific steps: when the control flow coverage is greater than a first threshold value and / or the target definition score is greater than a second threshold value and / or the target use score is greater than a third threshold value, a test mutation case of the test case is determined; the test mutation case is input to the program source code; when the program source code after inputting the test mutation case does not crash, the test case is updated until the program source code crashes, and a target test case is obtained. When the program source code after inputting the test mutation case crashes, the test mutation case is taken as the target test case.

[0117] First, the algorithm selects a test case s from the seed pool S (corresponding to the second line of the algorithm), and assigns an energy value n to the test case s (corresponding to the third line of the algorithm, setting the energy value is to set the number of test mutation cases for the test case, wherein the test mutation case is generated from the test case, which is the prior art). The value determines the number of sub-seeds (i.e. test cases) generated from the seed (seed, i.e. test case) (corresponding to the fourth to fifth lines of the algorithm). For each mutated test case, the algorithm will monitor the execution of the test case as the program input, and collect the target control flow coverage (i.e. control flow coverage TPScore tp (s)), target score (target score including target definition score TDScore tp (s) and target use score TUScore tp′(s)), and the information of crash, etc. (corresponding to the 6th line of the algorithm). If the test case can trigger the program to crash, it is added to the crash set CRASHES (lines 7-8). If the execution path of the test case covers a new target control flow (corresponding to the 9th line of the algorithm, that is, the control flow has a new change) or a target data flow branch (corresponding to the 11th line of the algorithm), or a higher target score is obtained (corresponding to the 13th line of the algorithm), it is added to the seed pool S. The above process is repeated until a preset time limit is reached or a termination signal is received (corresponding to lines 2-14 of the algorithm).

[0118] The above algorithm is as follows:

[0119]

[0120] In summary, the present application analyzes the data flow information with stronger correlation with the target point, and focuses on the detection of the code blocks affected by the data flow of the target point. The present application uses the data flow information as feedback information, and designs a seed update strategy to guide the fuzz testing, so that it can fully cover the target code and the related code, thereby improving the regression vulnerability detection capability.

[0121] The present embodiment also provides a regression fuzz testing device, as shown in Figure 5 The device comprises the following components:

[0122] An information extraction module 01 is configured to obtain target code generated by version change of program source code, and extract control flow information and data flow information of the target code;

[0123] A monitoring module 02 is configured to input a test case into the program source code, and monitor control flow coverage of the control flow information and data flow coverage of the data flow information when the program source code after inputting the test case does not crash;

[0124] An update module 03 is configured to update the test case according to the control flow coverage and the data flow coverage until the program source code crashes, and obtain a final test case.

[0125] Based on the above embodiment, the present application also provides a terminal device, and a principle block diagram thereof can be as shown in Figure 6The terminal device includes a processor, a memory, a network interface, and a display screen connected through a system bus. The processor of the terminal device is configured to provide computing and control capabilities. The memory of the terminal device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The network interface of the terminal device is configured to communicate with an external terminal through a network connection. The computer program is executed by the processor to implement a regression fuzzing method. The display screen of the terminal device can be a liquid crystal display screen or an electronic ink display screen.

[0126] Those skilled in the art can understand that Figure 6 The principle block diagram shown in the figure is only a block diagram of part of the structure related to the present application, and does not constitute a limitation on the terminal device to which the present application is applied. The specific terminal device can include more or fewer components than those shown in the figure, or combine some components, or have a different component arrangement.

[0127] In one embodiment, a terminal device is provided, which includes a memory, a processor, and a regression fuzzing program stored in the memory and executable on the processor. When the processor executes the regression fuzzing program, the following operation instructions are implemented:

[0128] Obtain target code generated by version change of program source code, and extract control flow information and data flow information of the target code;

[0129] Input a test case to the program source code. When the program source code after inputting the test case does not crash, monitor control flow coverage of the control flow information and data flow coverage of the data flow information;

[0130] According to the control flow coverage and the data flow coverage, update the test case until the program source code crashes, and obtain a final test case.

[0131] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, storage, database or other medium used in each embodiment of the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0132] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A regression fuzzing method, characterized in that, The method comprises the following steps: acquiring target code generated by version change of program source code, and extracting control flow information and data flow information of the target code, including: extracting a calling function corresponding to the target code; extracting control flow information related to the calling function of the target code; parsing basic blocks contained in the target code, the basic block being a code block with only one input port and one output port; screening definition basic blocks for defining variables from the basic blocks, and screening use basic blocks for calling variables from the basic blocks; determining a data dependency graph between the definition basic blocks; taking the definition basic blocks, the use basic blocks and the data dependency graph as data flow information; inputting a test case into the program source code, and monitoring control flow coverage of the control flow information and data flow coverage of the data flow information when the program source code after inputting the test case does not crash; updating the test case according to the control flow coverage and the data flow coverage until the program source code crashes, to obtain a final test case; the monitoring of the control flow coverage of the control flow information and the data flow coverage of the data flow information comprises: inserting a monitoring program into the program source code; monitoring the execution times of the control flow information through the monitoring program, and obtaining control flow coverage according to the execution times of the control flow information; monitoring the nearest distance and the farthest distance contained in the data dependency graph defined by the target according to the target definition through the monitoring program, the target definition being a definition of the definition basic block; obtaining a definition sub-score of each target definition according to the nearest distance and the farthest distance of each target definition; screening a target definition score from the definition sub-scores of all target definitions according to the definition sub-score of each target definition; monitoring the execution times of the use basic block corresponding to each target use through the monitoring program, and obtaining a target use score according to the execution times corresponding to each target use, the target use being a use of the use basic block; taking the target definition score and the target use score as data flow coverage.

2. The method of claim 1, wherein, the obtaining of the target use score according to the execution times corresponding to each target use comprises: accumulating the execution times corresponding to each target use to obtain the target use score.

3. The method of claim 1, wherein, the updating of the test case according to the control flow coverage and the data flow coverage until the program source code crashes to obtain a final test case comprises: determining a test variation test case of the test case when the control flow coverage is greater than a first threshold value and / or the target definition score is greater than a second threshold value and / or the target use score is greater than a third threshold value; inputting the test variation test case into the program source code, and updating the test case until the program source code crashes to obtain a target test case when the program source code after inputting the test variation test case does not crash.

4. The method of claim 3, wherein the regression fuzzing is performed by a regression fuzzer. the updating of the test case according to the control flow coverage and the data flow coverage until the program source code crashes to obtain a final test case further comprises: When the program source code after inputting the test mutation case crashes, the test mutation case is taken as a target test case.

5. A regression fuzzing apparatus characterized by, The device comprises the following components: An information extraction module is configured to obtain target code generated by version change of program source code, and extract control flow information and data flow information of the target code, including: extracting calling functions corresponding to the target code; extracting control flow information related to the calling functions of the target code; parsing basic blocks contained in the target code, the basic block being a code block with only one input port and one output port; screening definition basic blocks for defining variables from the basic blocks, and screening usage basic blocks for calling variables from the basic blocks; determining a data dependency graph between the definition basic blocks; taking the definition basic blocks, the usage basic blocks, and the data dependency graph as data flow information; A monitoring module is configured to input a test case to the program source code, and monitor control flow coverage of the control flow information and data flow coverage of the data flow information when the program source code after inputting the test case does not crash; An updating module is configured to update the test case according to the control flow coverage and the data flow coverage until the program source code crashes, and obtain a final test case; The monitoring of the control flow coverage of the control flow information and the data flow coverage of the data flow information comprises: Instrumenting a monitoring program on the program source code; Monitoring the execution times of the control flow information through the monitoring program, and obtaining control flow coverage according to the execution times of the control flow information; Monitoring the nearest distance and the farthest distance contained in the data dependency graph of a target definition through the monitoring program, the target definition being a definition of the definition basic block; Obtaining a definition sub-score of each target definition according to the nearest distance and the farthest distance of each target definition; Screening a target definition score from all the definition sub-scores of the target definitions according to the definition sub-score of each target definition; Monitoring the execution times of the usage basic block corresponding to each target usage through the monitoring program, and obtaining a target usage score according to the execution times corresponding to each target usage, the target usage being usage of the usage basic block; Taking the target definition score and the target usage score as data flow coverage. The terminal device comprises a memory, a processor, and a regression fuzzing test program stored in the memory and executable on the processor, and the processor implements the steps of the regression fuzzing test method according to any one of claims 1-4 when executing the regression fuzzing test program.

6. A terminal device, characterized by comprising: The computer readable storage medium stores a regression fuzzing test program, and the regression fuzzing test program implements the steps of the regression fuzzing test method according to any one of claims 1-4 when executed by a processor.

7. A computer-readable storage medium, characterized in that, ​

Images