Semantic perception fuzzy test case generation method and system oriented to WebAssembly operation

Abstract

The invention provides a method and a system for generating a semantic perception fuzzy test case during WebAssembly operation, and belongs to the technical field of software fuzzy test. Comprising the steps that a stack invariant code conversion strategy is defined, and semantic validity of codes before and after test case conversion is maintained; on the basis of a stack invariant code conversion strategy, a test case is generated by adopting a first mode, a second mode or a combination of the first mode and the second mode to be used for fuzzy testing; the first mode is that a new test case is generated from the existing test case by adopting a conversion mode of one or combination of more of interesting value mutation, operator mutation, fragment splicing, control flow nesting, target mutation skipping and target mutation calling; and the second mode is that the existing test cases are expanded according to a generation algorithm based on the control flow skeleton. According to the method, the test cases which conform to semantic specifications and are diversified in control flow and data flow can be effectively generated, fuzzy testing is helped to explore deep execution logic, and vulnerability mining efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of software fuzz testing, and in particular to a method and system for generating semantically-aware fuzz testing cases for WebAssembly runtime. Background Art

[0002] WebAssembly is a virtual instruction set proposed by mainstream browser vendors, known for its portability, security, and efficiency. The WebAssembly runtime is responsible for providing a memory-safe sandbox execution environment for WebAssembly modules, so its security is critical. Damaging the security of the WebAssembly runtime may lead to serious consequences such as sandbox escape and remote code execution. For example, the vulnerability CVE-2024-2887 found in a browser kernel was successfully exploited by attackers to achieve code execution. Therefore, it is of great significance to discover and fix security vulnerabilities in the WebAssembly runtime as soon as possible.

[0003] To locate security vulnerabilities in the WebAssembly runtime, fuzz testing, as an automated vulnerability mining technology, has attracted much attention in academia and industry. It generates a large number of test cases through specific mutation algorithms or generation algorithms, takes them as target program input, executes the target program and monitors the running status to collect test cases that trigger unexpected behaviors or crashes. However, the test case generation method adopted by existing fuzz testing tools has two major defects in the WebAssembly scenario: First, the WebAssembly runtime will perform a validity check on the semantic correctness of the input module's stack, and only compliant test cases will be instantiated and executed. Therefore, the byte-level mutation algorithm adopted by tools such as AFL++ is likely to destroy the semantic correctness and thus cannot effectively explore the deep execution logic and mine WebAssembly runtime vulnerabilities; second, the WebAssembly language specification contains hundreds of instructions with different uses. The existing generation algorithm relies heavily on pre-defined generation rules, making it difficult to fully and efficiently explore different instruction combinations.

[0004] Based on this, in order to successfully apply fuzz testing to WebAssembly runtime vulnerability detection, an efficient and semantically-aware test case generation method and system is urgently needed. Summary of the invention

[0005] In view of the above background, the present invention aims to provide a semantic-aware fuzzy test case generation method and system for WebAssembly runtime, which defines a stack-invariant code conversion strategy and implements data flow and control flow mutations of existing test cases based on it. In addition, a generation algorithm based on a control flow skeleton is used to complete the generation of new code snippets, and the two are combined to efficiently explore the input space of the WebAssembly runtime and greatly improve the efficiency of vulnerability mining.

[0006] In order to achieve the above-mentioned object of the invention, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides a method for generating semantically-aware fuzzy test cases for a WebAssembly runtime, comprising the following steps:

[0008] Define a stack-invariant code conversion strategy to maintain the semantic validity of the code before and after the test case conversion;

[0009] Based on the stack-invariant code conversion strategy, the following method 1, method 2, or a combination of method 1 and method 2 is used to generate test cases for fuzz testing;

[0010] The first method is to generate new test cases from existing test cases by using a transformation method of one or more combinations of interesting value mutation, operator mutation, fragment splicing, control flow nesting, jump target mutation and call target mutation;

[0011] The second method is to expand the existing test cases according to the generation algorithm based on the control flow skeleton.

[0012] Furthermore, when executing method 1 or method 2 to generate a test case, method 1 or method 2 is executed once or multiple times.

[0013] Furthermore, the combination of the method 1 and the method 2 refers to executing the method 1 first and then executing the method 2, or executing the method 2 first and then executing the method 1.

[0014] Furthermore, the stack-invariant code conversion strategy means that in the process of converting the code to generate a new test case, only the impact on the semantics of the stack operation before and after the conversion is considered while ignoring the actual stack value involved, thereby achieving the same stack operation type t1 * →t2 * The code snippets can be seamlessly replaced and the semantic correctness of the new test cases can be guaranteed in principle.

[0015] Furthermore, the method 1 of generating a new test case from an existing test case includes:

[0016] Interesting value mutation: Replace the immediate values ​​involved in the WebAssembly instruction with boundary values ​​of the same type or singular values ​​that are more likely to trigger vulnerabilities;

[0017] Operator mutation: Replace t1 with stack operation type * →t2 * is another operator with the same stack operation type;

[0018] Slice splicing: First, parse the two original test cases s1 and s2 into an abstract syntax tree. Each node in the tree represents a specific WebAssembly operator and its child nodes represent the input source of the stack value that the current operator depends on. According to the parsed abstract syntax tree, a slice pool is further constructed. Each slice consists of a node in the tree and all its child nodes and is marked with the stack operation type t1. * →t2 * ; Set s1 to have stack operation type t1 * →t2 * Replace the slice f1 with a randomly selected slice f2 with the same stack operation type in s2, or randomly insert a randomly selected slice f2 with the stack operation type []→[] into s1; finally, perform on-demand context repair on s1 according to the context environment required by f2;

[0019] Control flow nesting: nesting on the control flow structure of the original test case, wrapping a certain control flow structure with different control structure instructions to ensure that the outer structure and the inner structure have the same stack operation type;

[0020] Jump target mutation: Modify the target label of the control flow jump instruction, and change the jump target label from the expected stack operation type t1 to the expected stack operation type t2 through local jump code conversion. * The old label l1 is converted to the expected stack operation type t2 * The new label l2;

[0021] Call target mutation: Modify the target function of the function call instruction to have function signature g1 * →g2 * The target function h1 is replaced by a new function h2 with the same function signature and randomly selected; if it is an indirect function call, an in-place function table modification is adopted.

[0022] Furthermore, in slice splicing, the on-demand context repair means: given the context set C1 required by the slice and the context set C2 of the current test case, check whether each context c1 in C1 can be satisfied by a context c2 in C2; if it can be satisfied, adjust the slice to use context c2 instead of c1, otherwise introduce a corresponding context c3 consistent with the context type of c1 into C2 and adjust the slice to use context c3.

[0023] Furthermore, in the jump target mutation, the local jump code conversion means: for an unconditional jump instruction, given the expected stack operation type t1 * The old label l1 and the expected stack operation type t2 * The new label l2 will first generate t1 * The old instruction sequence of stack values ​​is replaced by one that produces t2 * The new instruction sequence of the stack value is then modified to the target label of the jump instruction to l2; for conditional jump instructions, the stack operation type is additionally appended to the jump instruction as t2 * →t1 * The instruction sequence must be consistent to ensure semantic correctness.

[0024] Furthermore, in calling the target mutation, the in-place function table modification refers to: inserting a table modification instruction before the calling instruction, and updating the corresponding table entry value in the function table to the target function.

[0025] Furthermore, the generation algorithm based on the control flow skeleton described in the second method refers to decoupling the generation of the control flow skeleton from the generation of the data flow instruction sequence that generates the actual stack value, and specifically includes the following steps:

[0026] S201: First, the target stack operation type to be generated is t * Divided into subtype sequences [t1 * t2 * ...t n * ] and on this basis plan the overall control flow skeleton of the instruction sequence, for each subtype t i * Assign a randomly selected control structure instruction s i , which is responsible for i * Generation of stack values; where t n * Is the target stack operation type t * The nth subtype obtained by division;

[0027] S202: For the person responsible for generating t i * Control structure instructions for stack values i , if the maximum recursion depth d has not been reached c , then recursively call step S201 to generate s i The sub-control flow skeleton included, otherwise, execute step S203;

[0028] S203: subtype t i *For each type t in , randomly select a WebAssembly instruction with an output stack operation type of t and recursively generate the corresponding instruction for the input stack operation type of the instruction. This recursive generation process continues until the maximum recursion depth d is reached. d Or until the instruction does not need stack input, and finally connect the generated instructions in sequence to generate t i * Data flow instruction sequence of stack values;

[0029] S204: Traverse the subtype sequence [t1 * t2 * ...t n * ], and finally assemble the data flow instruction sequence corresponding to each subtype in the order of the subtype sequence to obtain the data flow instruction sequence generated on the stack. * The target instruction sequence for the stack value.

[0030] In the second aspect, the present invention proposes a semantic-aware fuzzy test case generation system for WebAssembly runtime, which is used to implement the above-mentioned semantic-aware fuzzy test case generation method.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] (1) The present invention proposes a stack-invariant code conversion strategy, which can in principle ensure that semantic correctness is properly preserved during the code conversion process, thereby helping fuzz testing to explore deep execution logic and effectively improve vulnerability mining efficiency. At the same time, the conversion strategy is universal and can be extended to other stack-based programming languages ​​such as Java bytecode.

[0033] (2) The present invention proposes a series of mutation algorithms for the data flow and control flow of WebAssembly code. The data flow mutation algorithm modifies the way stack values ​​are generated and the way stack values ​​are operated, while the control flow mutation algorithm changes the control flow relationship within and between functions. The synergistic effect of the two helps fuzz testing generate more diversified test cases and fully cover the input space.

[0034] (3) The present invention proposes a WebAssembly code generation algorithm based on a control flow skeleton. Different from the traditional generation algorithm, it decouples the generation of control flow structure and data flow instructions, making the generation process of each other independent and freer, thereby assisting fuzz testing in generating code snippets that do not exist or are rare in the initial corpus, further improving the efficiency of fuzz testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 Generate a flow chart of the method for semantically aware fuzz testing cases targeting WebAssembly runtimes;

[0036] Figure 2 Schematic diagram of the workflow of slicing and splicing in the mutation phase of a test case;

[0037] Figure 3 It is a workflow diagram of the generation algorithm based on the control flow skeleton;

[0038] Figure 4 Generates a system design diagram for semantically-aware fuzz testing of WebAssembly runtimes. DETAILED DESCRIPTION

[0039] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be pointed out that the embodiments described below are intended to facilitate the understanding of the present invention and do not have any limiting effect on the present invention.

[0040] The present invention provides a method for generating semantically-aware fuzzy test cases for WebAssembly runtime. The specific process is as follows: Figure 1 As shown, the specific implementation of each step is as follows:

[0041] Step 1: Define the stack-invariant code conversion strategy.

[0042] The stack-invariant code conversion strategy mentioned above means that when analyzing instruction sequences, we can ignore the specific operations performed on the stack value and only focus on the cumulative impact of the instructions on the stack operation type, because this is the key to the legality check of the WebAssembly runtime. Therefore, as long as the impact of two instruction sequences on the stack operation type is compatible, they can replace each other and still keep the stack state unchanged before and after the replacement, that is, they have the same stack operation type t1 * →t2 * The code snippets can be seamlessly interchanged and in principle the semantic correctness of the code before and after the replacement can be guaranteed, thereby assisting fuzz testing in exploring deep execution logic and improving testing efficiency.

[0043] Step 2: Input the original test case provided by the fuzz testing engine.

[0044] Step 3: Perform mutation operations on the test case at the data flow and control flow levels. The present invention utilizes the stack-invariant code conversion strategy defined in step S1 to ensure that the mutation algorithm involved in step S3 can maintain the semantic validity of the test case.

[0045] In a specific implementation of the present invention, this step can be achieved by the following sub-steps:

[0046] Step 301, interesting value mutation: modify the immediate value involved in a selected test case to a boundary value such as the maximum 32-bit signed integer value or a singular value that is more likely to trigger a vulnerability. The singular value that is more likely to trigger a vulnerability refers to the immediate value that appeared in the vulnerability previously disclosed on the target program. The interesting value mutation mainly modifies the const instruction responsible for pushing different types of immediate values ​​onto the stack. It maintains an interesting value array for i32, i64, f32 and f64 types and replaces the immediate value in the instruction with an arbitrarily selected interesting value from the corresponding type array when mutating. The interesting value of the v128 vector type is a random combination of interesting values ​​of smaller bit width types.

[0047] Step 302, operator mutation: The WebAssembly operators are grouped according to their stack operation types according to the stack-invariant code conversion strategy. For a certain operator of a selected test case, the operator mutation replaces it with another operator randomly selected from the operator group to which it belongs, thereby achieving different operations on the same stack value.

[0048] Step 303, slice splicing: for a selected test case s1, another test case s2 needs to be selected from the existing test cases, such as Figure 2 As shown, the given two test cases s1 and s2 are first parsed into an abstract syntax tree. Each node in the tree represents a specific WebAssembly operator and its child nodes represent the input source of the stack value that the current operator depends on. Based on the abstract syntax tree obtained by parsing, a slice pool P2 is further constructed for s2. Each slice consists of a node in the tree and all its child nodes and is marked with the stack operation type t1. * →t2 *. Then, a certain instruction node N1 is randomly selected from s1 for mutation and the slice f1 with the corresponding type annotation with it as the root node is calculated. Slice splicing performs two types of mutation operations. One is to randomly select a slice f2 that matches the stack operation type of slice f1 from the slice pool P2 and use it to replace the slice f1 in s1. The other is to randomly select a slice f2 with the stack operation type []→[] from P2 and insert it after the node N1, that is, after the slice f1. In each slice splicing operation, one of the above mutation operations is randomly selected. When repeating multiple slice splicing operations, different types of mutation operations can be selected. In order to smoothly embed slice f2 into test case s1, slice splicing adopts on-demand context repair of slice f2. The basic idea is to check whether each context c2 in C2 can be satisfied by a context c1 in C1 given the context set C2 required by slice f2 and the context set C1 of the current test case s1; if it can be satisfied, the slice is adjusted to use context c1 instead of c2, otherwise the corresponding context c3 is introduced into C1 (the context type of c3 is consistent with that of c1, but the context content may be inconsistent) and slice f2 is adjusted to use context c3. Then, according to the on-demand context repair, check whether the contexts such as functions, global variables, jump labels and local variables involved in slice f2 can be repaired. If they can be successfully repaired, keep this splicing operation, otherwise discard it. Slice splicing will continue until the maximum number of times is reached.

[0049] Step 304, control flow nesting: strives to create a deeper embedded control flow structure, which randomly selects a control flow structure in the test case and encapsulates it in another control flow structure. The available control flow structures include block, loop, and if..else. According to the stack-invariant code conversion strategy, the control flow structures before and after nesting should provide equivalent stack operation semantics to their contexts. Therefore, control flow nesting ensures that the outer structure has the same stack operation type as the inner structure, thereby achieving a self-replication-like effect.

[0050] Step 305, jump target mutation: modify the jump target of the jump instruction in WebAssembly. Given the expected stack operation type t1 * The old label l1 and the expected stack operation type t2 * The new label l2 of the jump target mutation adopts different mutation operations according to the different jump instructions: br and br_table are unconditional jump instructions, and their stack operation types are not constrained and can be dynamically adjusted to meet the needs of their context. Therefore, the original t1 can be directly generated * The instruction sequence that generates the stack value is replaced by t2 * The new instruction sequence of the stack value and changes the jump target to l2; br_if is a conditional jump instruction and will change the original t1 *The stack value is left on the stack. To maintain the unchanged state of the stack, the jump target mutation adopts local jump code conversion, and the stack operation type t2 is added after the jump instruction. * →t1 * The instruction sequence is to ensure semantic correctness, that is, it inserts code fragments f1 and f2 before and after the jump instruction, and f1 is responsible for converting the original t1 * The stack value is converted to t2 * The stack value is used for jump instructions, and f2 is responsible for t2 * The stack value is converted back to t1 * The stack value is changed to satisfy the stack invariant property. In the jump target mutation, all necessary instruction sequences are generated by the generation algorithm.

[0051] Step 306, call target mutation: modify the control flow calling relationship between functions in the test case. For call and call_indirect instructions, it randomly selects a matching function (with the same function signature) from the current input as the new target according to the function signature of the target function. If there is no available function, it is handed over to the generation algorithm to create a new function that meets the required signature. Since the function actually called by the call_indirect instruction is determined at runtime, in order to ensure that it calls the target function, the call target mutation adopts in-place function table modification. It inserts the table modification instruction table.set before the call instruction to update the corresponding table entry value to the target function. For example, assuming that the indirect function call instruction calls the function at index i1 of the function table t1, in order to make it actually call the specified function h1 at runtime, the index i1 of the function table t1 is updated in-place to function h1 before the indirect call instruction.

[0052] Step 4: Generate new code snippets to expand the test cases according to the generation algorithm based on the control flow skeleton.

[0053] In a specific implementation of the present invention, this step can be implemented by the following sub-steps: Figure 3 As shown:

[0054] Step 401, given the target stack operation type t to be generated * and the current recursion depth d, the generation algorithm first converts the stack operation type t * Divided into subtype sequences [t1 * t2 * ...t n * ] and on this basis plan the overall control flow skeleton of the instruction sequence, for each subtype t i * Assign a randomly selected control structure instruction s i , which is responsible for i *The generation of stack values. Each subtype t i * Contains one or more types.

[0055] Step 402, for the person responsible for generating t i * Control structure instructions for stack values i If the maximum recursion depth has not been reached, continue to recursively call step 401 to generate s i control fluid, otherwise the actual t i * The data flow instruction sequence of the stack value is generated, that is, step S403 is executed.

[0056] Step 403 is to generate t on the stack i * Stack value, algorithm is t i * For each type t in , randomly select an instruction with output stack operation type t and recursively generate corresponding instructions for the input stack operation type of the instruction. This recursive generation process continues until the maximum recursive depth is reached or the instruction does not need stack input. Finally, the generated instructions are spliced ​​in order to generate t i * The instruction sequence of the stack value is s i of the control fluid.

[0057] Step 404, the algorithm finally assembles each control flow structure s according to the subtype sequence order i , the output is generated on the stack * The target instruction sequence for the stack value.

[0058] Based on the same inventive concept, this embodiment also provides a semantic-aware fuzzy test case generation system for WebAssembly runtime, such as Figure 4 As shown, it specifically includes the following modules:

[0059] Preprocessing module: used to define stack-invariant code conversion strategy;

[0060] Mutator module: This module mutates input test cases from both data flow and control flow aspects based on the stack-invariant code transformation strategy and converts them into new test cases. It contains interesting value mutators, operator mutators, slice splicers, control flow nesters, jump target mutators and call target mutators, which are used to perform interesting value mutation, operator mutation, slice splicing, control flow nesting, jump target mutation and call target mutation transformations to generate new test cases from existing test cases.

[0061] Generator module: This module generates new code snippets according to the generation algorithm based on the control flow skeleton to expand the input test cases or construct completely new test cases.

[0062] The test cases generated by the system can be used in the fuzz testing follow-up processing process known to those skilled in the art.

[0063] For the system embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment, and the implementation methods of the remaining modules will not be repeated here. The system embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0064] The embodiments of the system of the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The system embodiments can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, the corresponding computer program instructions in the non-volatile memory are read into the memory by the processor of any device with data processing capabilities and run.

[0065] The embodiments described above provide a detailed description of the technical solutions and beneficial effects of the present invention. It should be understood that the above are only specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, supplements and equivalent substitutions made within the scope of the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A semantic-aware fuzzy test case generation method for WebAssembly runtime, characterized in that: The following steps are involved: Define a stack-invariant code conversion strategy to maintain the semantic validity of the code before and after the test case conversion; Based on the stack-invariant code conversion strategy, the following method 1, method 2, or a combination of method 1 and method 2 is used to generate test cases for fuzz testing; The first method is to generate new test cases from existing test cases by using a transformation method of one or more combinations of interesting value mutation, operator mutation, fragment splicing, control flow nesting, jump target mutation and call target mutation; The second method is to expand existing test cases according to a generation algorithm based on a control flow skeleton.

2. The method for generating semantically-aware fuzzy test cases for WebAssembly runtime according to claim 1, characterized in that: When executing method 1 or method 2 to generate a test case, method 1 or method 2 is executed once or multiple times.

3. The method for generating semantically-aware fuzzy test cases for WebAssembly runtime according to claim 1, characterized in that: The combination of the method 1 and the method 2 refers to executing the method 1 first and then executing the method 2, or executing the method 2 first and then executing the method 1.

4. The method for generating semantically-aware fuzzy test cases for WebAssembly runtime according to claim 1, characterized in that: The stack-invariant code conversion strategy means that in the process of converting the code to generate a new test case, only the impact on the semantics of the stack operation before and after the conversion is considered, while ignoring the actual stack value involved, so as to achieve the same stack operation type t1 * →t2 * The code snippets can be seamlessly replaced and the semantic correctness of the new test cases can be guaranteed in principle.

5. The method for generating semantically-aware fuzzy test cases for WebAssembly runtime according to claim 1, characterized in that: The method 1 of generating new test cases from existing test cases includes: Interesting value mutation: Replace the immediate values ​​involved in the WebAssembly instruction with boundary values ​​of the same type or singular values ​​that are more likely to trigger vulnerabilities; Operator mutation: Replace t1 with stack operation type * →t2 * is another operator with the same stack operation type; Slice splicing: First, parse the two original test cases s1 and s2 into an abstract syntax tree. Each node in the tree represents a specific WebAssembly operator and its child nodes represent the input source of the stack value that the current operator depends on. According to the parsed abstract syntax tree, a slice pool is further constructed. Each slice consists of a node in the tree and all its child nodes and is marked with the stack operation type t1. * →t2 * ; Set s1 to have stack operation type t1 * →t2 * Replace the slice f1 with a randomly selected slice f2 with the same stack operation type in s2, or randomly insert a randomly selected slice f2 with the stack operation type []→[] into s1; finally, perform on-demand context repair on s1 according to the context environment required by f2; Control flow nesting: nesting on the control flow structure of the original test case, wrapping a certain control flow structure with different control structure instructions to ensure that the outer structure and the inner structure have the same stack operation type; Jump target mutation: Modify the target label of the control flow jump instruction, and change the jump target label from the expected stack operation type t1 to the expected stack operation type t2 through local jump code conversion. * The old label l1 is converted to the expected stack operation type t2 * The new label l2; Call target mutation: Modify the target function of the function call instruction to have function signature g1 * →g2 * The target function h1 is replaced by a new function h2 with the same function signature and randomly selected; if it is an indirect function call, an in-place function table modification is adopted.

6. The method for generating semantically-aware fuzzy test cases for WebAssembly runtime according to claim 5, characterized in that: In slice splicing, the on-demand context repair means: given the context set C1 required by the slice and the context set C2 of the current test case, check whether each context c1 in C1 can be satisfied by a context c2 in C2; if it can be satisfied, adjust the slice to use context c2 instead of c1, otherwise introduce the corresponding context c3 consistent with the context type of c1 into C2 and adjust the slice to use context c3.

7. The method for generating semantically-aware fuzzy test cases for WebAssembly runtime according to claim 5, characterized in that: In the jump target mutation, the local jump code conversion means: for an unconditional jump instruction, given the expected stack operation type t1 * The old label l1 and the expected stack operation type t2 * The new label l2 will first generate t1 * The old instruction sequence of stack values ​​is replaced by one that produces t2 * The new instruction sequence of the stack value is then modified to the target label of the jump instruction to l2; for conditional jump instructions, the stack operation type is additionally appended to the jump instruction as t2 * →t1 * The instruction sequence must be consistent to ensure semantic correctness.

8. The method for generating semantically-aware fuzzy test cases for WebAssembly runtime according to claim 5, characterized in that: In the call target mutation, the in-place function table modification refers to: inserting a table modification instruction before the call instruction, and updating the corresponding table entry value in the function table to the target function.

9. The method for generating semantically-aware fuzzy test cases for WebAssembly runtime according to claim 1, characterized in that: The generation algorithm based on the control flow skeleton described in the second method refers to decoupling the generation of the control flow skeleton from the generation of the data flow instruction sequence that generates the actual stack value, and specifically includes the following steps: S201: First, the target stack operation type to be generated is t * Divided into subtype sequences [t1 * t2 * ...t n * ] and on this basis plan the overall control flow skeleton of the instruction sequence, for each subtype t i * Assign a randomly selected control structure instruction s i , which is responsible for i * Generation of stack values; where t n * Is the target stack operation type t * The nth subtype obtained by division; S202: For the person responsible for generating t i * Control structure instructions for stack values i , if the maximum recursion depth d has not been reached c , then recursively call step S201 to generate s i The sub-control flow skeleton included, otherwise, execute step S203; S203: subtype t i * For each type t in , randomly select a WebAssembly instruction with an output stack operation type of t and recursively generate the corresponding instruction for the input stack operation type of the instruction. This recursive generation process continues until the maximum recursion depth d is reached. d Or until the instruction does not need stack input, and finally connect the generated instructions in sequence to generate t i * Data flow instruction sequence of stack values; S204: Traverse the subtype sequence [t1 * t2 * ...t n * ], and finally assemble the data flow instruction sequence corresponding to each subtype in the order of the subtype sequence to obtain the data flow instruction sequence generated on the stack. * The target instruction sequence for the stack value.

10. A semantically aware fuzzy test case generation system for WebAssembly runtime, used to implement the method of claim 1, characterized in that: The system comprises: Preprocessing module, used to define stack-invariant code transformation strategies; The mutator module generates new test cases from existing test cases by using one or more combinations of interesting value mutation, operator mutation, fragment splicing, control flow nesting, jump target mutation, and call target mutation from both data flow and control flow under the condition of satisfying the stack-invariant code transformation strategy; The generator module expands the existing test cases according to the generation algorithm based on the control flow skeleton under the condition of satisfying the stack-invariant code transformation strategy.

Images