Fuzzy test method and device

Abstract

The embodiment of the invention provides a fuzz testing method and device, and in the fuzz testing method, target seed input is selected from a current seed input set used for performing fuzz testing on a target program. And selecting a first tag value from a unique customized dictionary of the target seed input, and based on the first tag value, deforming the target seed input to obtain a variant seed input. Judging whether a second execution path corresponding to the variation seed input belongs to one of execution paths corresponding to each seed input in the current seed input set or not; and if the judgment result indicates that the second execution path does not belong to one of the execution paths, adding the variation seed input to the current seed input set for the next round of iteration.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of program testing, and more particularly, to a fuzzy testing method and apparatus. Background Art

[0002] Fuzz testing is an automated software testing technique that generates unexpected or random data as input to test the software's exception handling capabilities, thereby revealing potential vulnerabilities.

[0003] As software complexity increases, traditional fuzz testing methods face challenges in revealing software vulnerabilities, especially when dealing with program branches protected by specific conditions (such as equality constraints, etc.), existing fuzz testing methods are often inefficient. Summary of the invention

[0004] One or more embodiments of the present specification describe a method and apparatus for fuzzy testing, which maintains a unique customized dictionary for each seed input, thereby improving the efficiency and effectiveness of the test.

[0005] In a first aspect, a fuzz testing method is provided, comprising:

[0006] Selecting a target seed input from a current seed input set for fuzz testing a target program; the target program corresponds to a control flow graph having basic code blocks as nodes;

[0007] A first tag value is selected from a custom dictionary unique to the target seed input, and based on the first tag value, the target seed input is deformed to obtain a variant seed input; the custom dictionary records a plurality of tag values, the plurality of tag values ​​including constant values ​​associated with specific constraints extracted from nodes on a first execution path of the target seed input in the control flow graph;

[0008] Determine whether the second execution path corresponding to the mutated seed input belongs to one of the execution paths corresponding to the seed inputs in the current seed input set;

[0009] If the determination result indicates that the second execution path does not belong to one of the execution paths, the mutated seed input is added to the current seed input set for use in the next round of iteration.

[0010] In a second aspect, a fuzzy testing device is provided, comprising:

[0011] A selection unit, configured to select a target seed input from a current seed input set for fuzz testing a target program; the target program corresponds to a control flow graph having basic code blocks as nodes;

[0012] a deformation unit, configured to select a first tag value from a custom dictionary unique to the target seed input, and based on the first tag value, deform the target seed input to obtain a variant seed input; the custom dictionary records a plurality of tag values, the plurality of tag values ​​including constant values ​​associated with specific constraints extracted from nodes on a first execution path of the target seed input in the control flow graph;

[0013] A judging unit, used to judge whether the second execution path corresponding to the mutated seed input belongs to one of the execution paths corresponding to the seed inputs in the current seed input set;

[0014] An adding unit is used to add the mutated seed input to the current seed input set for the next round of iteration if the judgment result indicates that the second execution path does not belong to one of the execution paths.

[0015] According to a third aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method of the first aspect.

[0016] In a fourth aspect, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method of the first aspect is implemented.

[0017] The method and apparatus for fuzz testing provided by one or more embodiments of the present specification, for each seed input, based on the execution path of the seed input in the control flow graph, extracts the tag value that can cover the new branch from the control flow graph to construct a corresponding custom dictionary. Afterwards, during the fuzz testing process, for the current seed input, the seed input is first deformed based on the tag value in the corresponding custom dictionary to obtain a mutated seed input, and then the target program is tested based on the mutated seed input, thereby expanding the coverage of a single fuzzy test, and thus greatly improving the efficiency of the test. In addition, when selecting the tag value of the seed input from the custom dictionary, it is possible to avoid selecting an invalid tag value, so that the present solution can also improve the effectiveness of the test. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1 A schematic diagram of an implementation scenario of an embodiment disclosed in this specification;

[0020] Figure 2 A schematic diagram showing a method for constructing a custom dictionary in one example;

[0021] Figure 3 A control flow graph diagram in one example is shown;

[0022] Figure 4 A flowchart of a fuzzy testing method according to an embodiment of the present specification is shown;

[0023] Figure 5 A schematic diagram of an execution path in one example is shown;

[0024] Figure 6 A schematic diagram of a fuzzy testing device according to an embodiment of the present specification is shown. DETAILED DESCRIPTION

[0025] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0026] At present, there are mainly the following fuzz testing methods:

[0027] First, the SMT-Solver method, which uses symbolic execution and constraint solving technology to handle complex branch conditions and improve the test coverage of program branches. However, this method has high overhead, is limited by solver performance, and is inefficient when testing large-scale programs.

[0028] Second, the gradient descent method, which adjusts the input value through numerical optimization methods to solve the constraints and tries to cover more program branches. However, this method may encounter local optimal problems, relies on gradient information that is difficult to calculate, and has a high computational cost.

[0029] Third, the dynamic taint analysis method, which tracks the flow of input data during program execution and identifies the association between input and program branches. However, this method may have incomplete coverage, prone to false positives and false negatives, and has a large performance overhead in large-scale applications.

[0030] Fourth, the input-to-branch correspondence method uses lightweight taint tracking to monitor the use of input values ​​in program execution and optimize related program branch exploration. However, this method relies on precise tracking, is difficult to manage complexity, and has a significant impact on performance in resource-constrained environments.

[0031] Fifth, the global dictionary method, in which all inputs are maintained in a global dictionary, which easily leads to the problem of dictionary pollution, that is, irrelevant tag values ​​are mixed into the dictionary, thus affecting the accuracy and efficiency of the test.

[0032] In view of this, the inventor of the present solution proposes a fuzz testing method based on a customized dictionary, that is, for each seed input, based on the execution path of the seed input in the control flow graph, the tag value that can cover the new branch is extracted from the control flow graph to construct a corresponding customized dictionary. Afterwards, in the fuzz testing process, for the current seed input, the seed input is first deformed based on the tag value in the corresponding customized dictionary to obtain a mutated seed input, and then the target program is tested based on the mutated seed input, thereby expanding the coverage of a single fuzzy test, and thus greatly improving the efficiency of the test. In addition, when selecting the tag value of the seed input from the customized dictionary, it is possible to avoid selecting an invalid tag value, so that the present solution can also improve the effectiveness of the test.

[0033] Figure 1 A schematic diagram of an implementation scenario of an embodiment disclosed in this specification. Figure 1 In the process, a certain sub-input (seed) is first randomly selected from the seed input set (seed Corpus). For the seed input, a token value (token) is randomly selected from its unique custom dictionary (Dicts), and the seed input is deformed based on the token value to obtain a mutant seed input (mutant). Then, the mutant seed can be input into the target program, and its execution path in the control flow graph corresponding to the target program is determined. Finally, it is determined whether the execution path belongs to one of the execution paths corresponding to each seed input, that is, whether the execution path will cover a new program branch (or a new edge). If the execution path covers the new program branch, the mutant seed input is added to the seed input set. If the new program branch is not covered, the mutant seed input is discarded.

[0034] So far, a round of fuzz testing of the target program has been completed. It should be understood that in practice, the fuzz testing process for the target program is repeatedly executed.

[0035] In addition, it should be understood that when the target program can process the above-mentioned mutation seed input normally, no result may be generated; when the target program cannot process the mutation seed input and an exception occurs, the target program may throw an exception or print an error message, etc.

[0036] As mentioned above, this solution is a fuzzy testing method based on a customized dictionary. The following takes any seed input (hereinafter referred to as the first seed input) as an example to illustrate the method for constructing the corresponding customized dictionary.

[0037] Figure 2 A schematic diagram showing a method for constructing a custom dictionary in one example. Figure 2In the embodiment of the present invention, for any first seed input in the seed input set, after inputting it into the target program, the corresponding program execution path can be determined from the control flow graph corresponding to the target program. The control flow graph is generated based on the compiled code of the target program, including a plurality of nodes and directed edges between the nodes, a single node represents a basic code block, which contains a plurality of code statements (i.e., compilation instructions) executed sequentially, and the last code statement can be a jump statement. Of course, in practice, the jump statement can also be used as a separate basic code block, which is not limited in this specification. In addition, a single directed edge represents a jump relationship between basic code blocks, and the jump relationship can have a corresponding jump condition.

[0038] For any node on the above program execution path, when there is a jump statement containing an equality constraint in the corresponding basic code block, the target jump relationship whose corresponding directed edge is not covered in the program execution path is determined from each jump relationship affected by the target equality constraint in the jump statement (for example, "in == token", where "in" is a variable and "token" is a constant value), and it is judged whether the jump condition of the target jump relationship is that the target equality constraint is satisfied (or the target equality constraint is true). If so, the constant value ("token") in the target equality constraint is obtained and used as a tag value of the first seed input; if not, the constant value in the target equality constraint is not obtained, that is, the constant value is abandoned.

[0039] In one embodiment, a constant value set may be queried based on the target equality constraint to obtain constant values ​​in the target equality constraint, wherein the constant value set stores constant values ​​corresponding to several equality constraints in the target program, and each constant value is extracted from the target program during compilation.

[0040] Of course, in practice, the constant values ​​can also be obtained by dynamically analyzing the target equality constraint, and this specification does not limit this.

[0041] It should be understood that after analyzing each node on the execution path of the above program, a customized dictionary of the first seed input can be constructed based on each tag value obtained.

[0042] Figure 3 A control flow graph diagram is shown in one example, Figure 3In , the basic code block corresponding to node A contains a jump statement, and it is assumed that the jump condition of the left branch (i.e., the left jump relation) is that the equality constraint i==10 is satisfied, and the jump condition of the right branch (i.e., the right jump relation) is that the equality constraint is not satisfied. It is also assumed that the execution path corresponding to the seed input i is the right branch path, then the tag value can be obtained: 10. Since there are no other nodes containing jump statements in the execution path, the custom dictionary constructed for the seed input i is: {10}.

[0043] It should be understood that when the execution path corresponding to the seed input is the branch path on the left, since the jump condition of the right branch of node A is that the equality constraint is not satisfied (that is, the equality constraint is not satisfied), the tag value is abandoned: 10. It should be understood that the reason for abandoning the tag value 10 here is that the program branch corresponding to it has been included in the execution path.

[0044] In other words, this solution uses the constant values ​​of the corresponding program branches that are not covered in the execution path as label values ​​to construct a customized dictionary of seed inputs, so that when the seed input is deformed based on the label values ​​in the customized dictionary, the new program branches can be covered based on the obtained mutated seed input, thereby expanding the test coverage.

[0045] Need to explain, Figure 3 This is just an exemplary description. In actual use, the basic code blocks corresponding to node B and node C can also be merged into one, and the code statements corresponding to each node are compilation instructions, etc. This specification does not limit this.

[0046] Figure 4 The flowchart of the fuzzy testing method according to one embodiment of the present specification is shown. The method can be executed by any device, equipment, platform, or device cluster with computing and processing capabilities. It should be noted that the method includes multiple rounds of iterations. Figure 4 The method steps included in the kth (k is a positive integer) round of iteration are shown. Figure 4 As shown, the method may include the following steps:

[0047] Step S402, selecting a target seed input from a current seed input set used for fuzz testing the target program.

[0048] It should be understood that the current seed input set here is the k-th round seed input set, which is obtained by performing k-1 rounds of iterative updates on the initial seed input set.

[0049] The seed inputs in the above-mentioned initial seed input set can be carefully selected according to a specific context or domain knowledge, and are legal data related to the target program. It should be understood that by deforming or transforming these various inputs, a test case for fuzz testing the target program can be generated.

[0050] In one embodiment, the target seed input may be randomly selected from a current seed input set.

[0051] Step S404: Select a first tag value from a custom dictionary unique to the target seed input, and based on the first tag value, transform the target seed input to obtain a variant seed input.

[0052] Among them, the custom dictionary unique to the target seed input can be obtained through Figure 2 The illustrated method steps are constructed such that a number of tag values ​​are recorded therein, the tag values ​​comprising constant values ​​associated with specific constraints extracted from nodes on the first execution path of the target seed input in the control flow graph.

[0053] Specifically, any tag value may be randomly selected from a custom dictionary unique to the target seed input as the first tag value. Afterwards, the target seed input may be combined with the first tag value to obtain a variant seed input.

[0054] Of course, in practice, the target seed input may also be mutated in other ways, and this specification does not limit this.

[0055] It should be noted that since the degree branches corresponding to each tag value recorded in the custom dictionary do not cover the program execution path corresponding to the target seed input, when the target seed input is mutated based on the tag value, the coverage of a single round of fuzz testing can be expanded, thereby improving the test efficiency.

[0056] Step S406, determining whether the second execution path corresponding to the mutated seed input belongs to one of the execution paths corresponding to the seed inputs in the current seed input set.

[0057] In one embodiment, it is determined whether there is a first directed edge in the second execution path that is not included in any of the execution paths. If the determination result indicates that there is the first directed edge, it is determined that the second execution path does not belong to one of the execution paths.

[0058] Specifically, for each directed edge in the second execution path, it is compared with each directed edge in each execution path. If it is consistent with any directed edge in any execution path, it is considered that the directed edge is included in each execution path; if it is inconsistent with any directed edge in each execution path, it is considered that the directed edge is not included in any execution path in each execution path.

[0059] For example, suppose the execution paths corresponding to the seed inputs in the current seed input set are as follows: Figure 5 As shown on the left, the execution paths are: 1->2->4, 1->2->5, 1->3->6. The second execution path is as follows Figure 5 As shown on the right, the second execution path is: 1->2->5->7. Since the directed edge 5->7 is not included in Figure 5 In any of the execution paths shown on the left, the second execution path does not belong to one of the execution paths.

[0060] In another embodiment, a second node set formed by nodes on the second execution path is obtained, and the second node set is compared with each node set corresponding to each execution path. If the second node set is not equal to each node set, it is determined that the second execution path does not belong to one of the execution paths.

[0061] Specifically, for any node set in each node set, the number of elements in the second node set can be compared with that in any node set. If the number of elements in the two node sets is the same, the element contents of the two node sets can be compared one by one. If all elements of the two node sets are equal, then they are equal; otherwise, if the number of elements is not the same, or there are unequal element contents, then they are considered unequal.

[0062] Also Figure 5 For example, the node sets corresponding to the execution paths are {1,2,4}, {1,2,5}, {1,3,6}, and the second node set corresponding to the second execution path is {1,2,5,7}. Since the number of elements in the second node set is not equal to that in each node set, the second node set is not equal to each node set, and therefore the second execution path does not belong to one of the execution paths.

[0063] Step S408: If the judgment result indicates that the second execution path does not belong to one of the execution paths, the mutated seed input is added to the current seed input set for the next round of iteration.

[0064] It should be understood that the second execution path mentioned above does not belong to one of the execution paths, and it can be understood that this round of testing can cover new program branches, so that the variant seed input can be added to the current seed input set.

[0065] In addition, for the mutation seed input, constant values ​​related to the equality constraints can also be extracted from the nodes on the second execution path and used as tag values ​​of the mutation seed input to construct a custom dictionary unique to the mutation seed input.

[0066] It can be seen that as the number of iterations increases, this solution will dynamically update the seed input set according to the newly discovered seed input, and build the corresponding custom dictionary according to the execution path of the new seed input. This ensures that the seed input set can always reflect the latest test information, and for the latest test seeds, the relevant tag values ​​can always be recorded, avoiding the waste of resources due to outdated or irrelevant inputs.

[0067] So far, a round of fuzz testing of the target program has been completed. It should be understood that in practice, the fuzz testing process for the target program is repeatedly executed.

[0068] In addition, it should be understood that when the target program can process the above-mentioned mutation seed input normally, no result may be generated; when the target program cannot process the mutation seed input and an exception occurs, the target program may throw an exception or print an error message, etc.

[0069] The advantages of the fuzzy testing method provided in the embodiments of this specification are described below:

[0070] 1. This solution significantly reduces performance overhead by building a unique custom dictionary for each seed input, reducing unnecessary tag value retrieval and application. In addition, the application of this custom dictionary can also avoid the problem of dictionary pollution, thereby ensuring the accuracy and efficiency of the test.

[0071] 2. This solution is lighter and can be optimized more precisely for specific seed inputs.

[0072] In summary, this approach can significantly improve edge coverage, that is, it can explore more uncovered program branches. At the same time, because it can more deeply explore program branches controlled by complex conditions, its vulnerability discovery ability is also enhanced. In addition, the use of customized dictionaries not only makes each test iteration more targeted, that is, it can more accurately explore specific program branches, but also easy to maintain and expand, thereby enhancing the maintainability and extensibility of the program. In short, this solution provides an efficient, accurate and scalable fuzz testing method, which brings new possibilities to the field of software security testing.

[0073] Corresponding to the above-mentioned fuzzy testing method, an embodiment of the present specification also provides a fuzzy testing device, such as Figure 6 As shown, the device may include:

[0074] The selection unit 602 is used to select a target seed input from a current seed input set used for fuzz testing a target program, where the target program corresponds to a control flow graph having basic code blocks as nodes.

[0075] The deformation unit 604 is used to select a first tag value from a custom dictionary unique to the target seed input, and deform the target seed input based on the first tag value to obtain a mutant seed input. The custom dictionary records a plurality of tag values, which include constant values ​​related to specific constraints extracted from nodes on the first execution path of the target seed input in the control flow graph.

[0076] The judgment unit 606 is used to judge whether the second execution path corresponding to the mutated seed input belongs to one of the execution paths corresponding to the seed inputs in the current seed input set.

[0077] The adding unit 608 is configured to add the mutated seed input to the current seed input set for the next iteration if the determination result indicates that the second execution path does not belong to one of the execution paths.

[0078] In one embodiment, the apparatus further includes: a construction unit 610;

[0079] The construction unit 610 includes:

[0080] A determination submodule 6102, used to determine the first execution path corresponding to the target seed input;

[0081] The determination submodule 6102 is further configured to, for any first node on the first execution path, when there is a jump statement containing an equality constraint in the corresponding first basic code block, determine, from among the jump relations affected by the target equality constraint in the jump statement, a target jump relation whose corresponding directed edge is not covered in the first execution path;

[0082] The acquisition submodule 6104 is used to acquire the constant value in the target equality constraint if the jump condition of the target jump relation is that the target equality constraint is satisfied, and use it as one of the tag values ​​in the custom dictionary.

[0083] In one embodiment, the acquisition submodule 6104 is specifically used for:

[0084] Based on the target equality constraint, the constant value set is queried to obtain the constant value in the target equality constraint. The constant value set stores constant values ​​corresponding to several equality constraints in the target program. The constant values ​​are extracted from the target program during compilation.

[0085] In one embodiment, the deformation unit 604 is specifically used for:

[0086] The target seed input and the first tag value are combined to obtain a mutation seed input.

[0087] The determination unit 606 is specifically used for:

[0088] Determine whether there is a first directed edge in the second execution path that is not included in any execution path in each execution path;

[0089] If the determination result indicates that the first directed edge exists, it is determined that the second execution path does not belong to one of the execution paths.

[0090] In another embodiment, the determining unit 606 is specifically configured to:

[0091] Acquire a second node set formed by nodes on a second execution path;

[0092] Compare the second node set with each node set corresponding to each execution path;

[0093] If the second node set is not equal to any of the node sets, it is determined that the second execution path does not belong to one of the execution paths.

[0094] In one embodiment, the apparatus further comprises:

[0095] The extraction unit 612 is used to extract constant values ​​related to the equality constraint from the nodes on the second execution path, and use them as tag values ​​of the mutation seed input to construct a custom dictionary unique to the mutation seed input.

[0096] The functions of the functional modules of the device in the above-mentioned embodiment of this specification can be implemented through the steps of the above-mentioned method embodiment. Therefore, the specific working process of the device provided by one embodiment of this specification will not be repeated here.

[0097] An embodiment of the present specification provides a fuzzy testing device that maintains a unique customized dictionary for each seed input, thereby improving the efficiency and effectiveness of the test.

[0098] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 4 The method described.

[0099] According to another embodiment of the present invention, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the Figure 4 The method described.

[0100] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the server embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0101] The steps of the method or algorithm described in conjunction with the disclosure of this specification can be implemented in hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, and the software modules can be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, register, hard disk, mobile hard disk, CD-ROM or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC. In addition, the ASIC can be located in a server. Of course, the processor and the storage medium can also be present in the server as discrete components.

[0102] Those skilled in the art will appreciate that in one or more of the above examples, the functions described in the present invention may be implemented in hardware, software, firmware, or any combination thereof. When implemented using software, the functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any media that facilitates the transmission of a computer program from one place to another. The storage medium may be any available medium that a general or special-purpose computer can access.

[0103] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0104] The specific implementation methods described above further illustrate the purpose, technical solutions and beneficial effects of this specification. It should be understood that the above description is only the specific implementation method of this specification and is not intended to limit the protection scope of this specification. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of this specification should be included in the protection scope of this specification.

Claims

1. A fuzz testing method, comprising: Selecting a target seed input from a current set of seed inputs used for fuzz testing the target program; The target program corresponds to a control flow graph having basic code blocks as nodes; A first tag value is selected from a custom dictionary unique to the target seed input, and based on the first tag value, the target seed input is deformed to obtain a variant seed input; the custom dictionary records a plurality of tag values, the plurality of tag values ​​including constant values ​​associated with specific constraints extracted from nodes on a first execution path of the target seed input in the control flow graph; Determine whether the second execution path corresponding to the mutated seed input belongs to one of the execution paths corresponding to the seed inputs in the current seed input set; If the determination result indicates that the second execution path does not belong to one of the execution paths, the mutated seed input is added to the current seed input set for use in the next round of iteration.

2. The method according to claim 1, wherein: The custom dictionary is constructed by the following steps: Determining the first execution path corresponding to the target seed input; For any first node on the first execution path, when there is a jump statement containing an equality constraint in the corresponding first basic code block, determining, from jump relations affected by the target equality constraint in the jump statement, a target jump relation whose corresponding directed edge is not covered in the first execution path; If the jump condition of the target jump relation is that the target equality constraint is satisfied, a constant value in the target equality constraint is obtained and used as one of the tag values ​​in the custom dictionary.

3. The method according to claim 2, wherein: The obtaining of the constant value in the target equality constraint includes: Based on the target equality constraint, a constant value set is queried to obtain constant values ​​in the target equality constraint; the constant value set stores constant values ​​corresponding to several equality constraints in the target program; and the constant values ​​are extracted from the target program during compilation.

4. The method according to claim 1, wherein: The transforming the target seed input includes: The target seed input and the first tag value are combined to obtain the mutated seed input.

5. The method according to claim 1, wherein: The determining whether the second execution path corresponding to the mutated seed input belongs to one of the execution paths corresponding to the seed inputs in the current seed input set includes: Determine whether there is a first directed edge in the second execution path that is not included in any execution path in the execution paths; If the determination result indicates that the first directed edge exists, it is determined that the second execution path does not belong to one of the execution paths.

6. The method according to claim 1, wherein: The determining whether the second execution path corresponding to the mutated seed input belongs to one of the execution paths corresponding to the seed inputs in the current seed input set includes: Acquire a second node set formed by nodes on the second execution path; Comparing the second node set with each node set corresponding to each execution path; If the second node set is not equal to any of the node sets, it is determined that the second execution path does not belong to one of the execution paths.

7. The method according to claim 1, further comprising: Constant values ​​related to the equality constraints are extracted from the nodes on the second execution path and used as tag values ​​of the mutation seed input to construct a custom dictionary unique to the mutation seed input.

8. A fuzzy testing device, comprising: A selection unit, used for selecting a target seed input from a current seed input set used for fuzz testing a target program; The target program corresponds to a control flow graph having basic code blocks as nodes; a deformation unit, configured to select a first tag value from a custom dictionary unique to the target seed input, and based on the first tag value, deform the target seed input to obtain a variant seed input; the custom dictionary records a plurality of tag values, the plurality of tag values ​​including constant values ​​associated with specific constraints extracted from nodes on a first execution path of the target seed input in the control flow graph; A judging unit, used to judge whether the second execution path corresponding to the mutated seed input belongs to one of the execution paths corresponding to the seed inputs in the current seed input set; An adding unit is used to add the mutated seed input to the current seed input set for the next round of iteration if the judgment result indicates that the second execution path does not belong to one of the execution paths.

9. The apparatus according to claim 8, further comprising: Building blocks; The building block comprises: A determination submodule, used to determine the first execution path corresponding to the target seed input; The determining submodule is further configured to, for any first node on the first execution path, when there is a jump statement containing an equality constraint in the corresponding first basic code block, determine, from among the jump relations affected by the target equality constraint in the jump statement, a target jump relation whose corresponding directed edge is not covered in the first execution path; The acquisition submodule is used for acquiring a constant value in the target equality constraint and using it as one of the tag values ​​in the custom dictionary if the jump condition of the target jump relation is that the target equality constraint is satisfied.

10. The device according to claim 9, wherein: The acquisition submodule is specifically used for: Based on the target equality constraint, a constant value set is queried to obtain a constant value in the target equality constraint; the constant value set stores constant values ​​corresponding to a plurality of equality constraints in the target program; The constant values ​​are extracted from the target program during compilation.

11. The device according to claim 8, wherein: The deformation unit is specifically used for: The target seed input and the first tag value are combined to obtain the mutated seed input.

12. The device according to claim 8, wherein: The judging unit is specifically used for: Determine whether there is a first directed edge in the second execution path that is not included in any execution path in the execution paths; If the determination result indicates that the first directed edge exists, it is determined that the second execution path does not belong to one of the execution paths.

13. The device according to claim 8, wherein: The judging unit is specifically used for: Acquire a second node set formed by nodes on the second execution path; Comparing the second node set with each node set corresponding to each execution path; If the second node set is not equal to any of the node sets, it is determined that the second execution path does not belong to one of the execution paths.

14. The apparatus according to claim 8, further comprising: An extraction unit is used to extract constant values ​​related to the equality constraint from the nodes on the second execution path, and use the constant values ​​as tag values ​​of the mutation seed input to construct a custom dictionary unique to the mutation seed input.

15. A computer-readable storage medium having a computer program stored thereon, wherein: When the computer program is executed in a computer, the computer is caused to execute the method according to any one of claims 1 to 7.

16. A computing device comprising a memory and a processor, wherein: The memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 7 is implemented.

Images