A method and system for generating semantically aware fuzzy test cases for the WebAssembly runtime

Abstract

This invention proposes a semantically aware fuzzy test case generation method and system for WebAssembly runtime, belonging to the field of software fuzzing technology. It includes: defining a stack-invariant code transformation strategy to maintain the semantic validity of the code before and after test case transformation; based on the stack-invariant code transformation strategy, generating test cases for fuzzing using one of the following methods: Method 1, Method 2, or a combination of Method 1 and Method 2; Method 1 involves generating new test cases from existing test cases using one or more combinations of transformation methods such as interesting value mutation, operator mutation, fragment concatenation, control flow nesting, jump target mutation, and call target mutation; Method 2 involves expanding existing test cases according to a generation algorithm based on the control flow skeleton. This invention can effectively generate test cases that conform to semantic specifications and are diversified in control flow and data flow, helping fuzzing explore deep execution logic and improve vulnerability discovery efficiency.

Description

Technical Field

[0001] This invention relates to the field of software fuzzing technology, and in particular to a method and system for generating semantically aware fuzzy test cases for the WebAssembly runtime. Background Technology

[0002] WebAssembly is a virtual instruction set proposed by major browser vendors, renowned for its portability, security, and efficiency. The WebAssembly runtime is responsible for providing a memory-safe sandbox execution environment for WebAssembly modules, making its security paramount. Compromising the security of the WebAssembly runtime can lead to serious consequences such as sandbox escape and remote code execution. For example, the vulnerability CVE-2024-2887 found in a certain browser kernel was successfully exploited by attackers to achieve code execution. Therefore, discovering and patching security vulnerabilities in the WebAssembly runtime as early as possible is of great significance.

[0003] To locate security vulnerabilities in the WebAssembly runtime, fuzzing, as an automated vulnerability discovery technique, has garnered significant attention in both academia and industry. Fuzzing generates a large number of test cases using specific mutation or generation algorithms, uses these as input to the target program, executes the target program, and monitors its runtime status to collect test cases that trigger unexpected behavior or crashes. However, existing fuzzing tools have two major drawbacks in the WebAssembly scenario: First, the WebAssembly runtime performs a validity check on the stack semantics of the input module, and only compliant test cases are instantiated and executed. Therefore, the byte-level mutation algorithms used by tools such as AFL++ are likely to compromise semantic correctness, thus failing to effectively explore deep execution logic and discover WebAssembly runtime vulnerabilities. Second, the WebAssembly language specification contains hundreds of instructions with diverse purposes, and existing generation algorithms heavily rely on predefined generation rules, making it difficult to fully and efficiently explore different instruction combinations.

[0004] Therefore, in order to successfully apply fuzz testing to WebAssembly runtime vulnerability detection, there is an urgent need for an efficient and semantically aware test case generation method and system. Summary of the Invention

[0005] In view of the above background, the present invention aims to provide a semantically aware fuzzy test case generation method and system for WebAssembly runtime. The method and system define a stack-invariant code transformation strategy and implement data flow and control flow mutation of existing test cases based on it. In addition, a generation algorithm based on control flow skeleton is used to generate new code fragments. The two are combined to efficiently explore the input space of WebAssembly runtime and significantly improve the efficiency of vulnerability discovery.

[0006] To achieve the above-mentioned objectives, the present invention provides the following technical solution:

[0007] In a first aspect, the present invention provides a method for generating semantically aware fuzzy test cases for WebAssembly runtime, comprising the following steps:

[0008] Define a stack-invariant code transformation strategy to maintain the semantic validity of the code before and after the test case transformation;

[0009] Based on the stack-invariant code transformation strategy described above, test cases are generated using either Method 1, Method 2, or a combination of Method 1 and Method 2 for fuzz testing.

[0010] Method 1 is to generate new test cases from existing test cases by using one or more combinations of interesting value mutation, operator mutation, fragment splicing, control flow nesting, jump target mutation, and call target mutation.

[0011] The second method is to expand existing test cases based on a control flow skeleton generation algorithm.

[0012] Furthermore, when generating test cases using either method one or method two, method one or method two is executed once or multiple times.

[0013] Furthermore, the combination of Method 1 and Method 2 refers to executing Method 1 first and then Method 2, or executing Method 2 first and then Method 1.

[0014] Furthermore, the stack-invariant code transformation strategy refers to: during the process of transforming code to generate new test cases, only the impact on the semantics of stack operations before and after the transformation is considered, while ignoring the actual stack values ​​involved. Therefore, it achieves the same stack operation type t1. * →t2 * The code snippets are seamlessly replaced, and the semantic correctness of the new test cases is guaranteed in principle.

[0015] Furthermore, the method described in Method 1 for generating new test cases from existing test cases includes:

[0016] Interesting value mutation: Replace the immediate value involved in the WebAssembly directive with a boundary value of the same type or an exotic value that is more likely to trigger the vulnerability;

[0017] Operator mutation: Replace t1 with a stack operation type * →t2 * The operator is another operator with the same stack operation type;

[0018] Slice concatenation: First, the two original test cases s1 and s2 are parsed into an abstract syntax tree. Each node in the tree represents a specific WebAssembly operator, and its child nodes represent the input sources of the stack values ​​that the current operator depends on. Based on the parsed abstract syntax tree, a slice pool is further constructed. Each slice consists of a node in the tree and all its child nodes, and is labeled with the stack operation type t1. * →t2 * ; s1 contains stack operation type t1 * →t2 * The slice f1 is replaced with a randomly selected slice f2 in s2 that has the same stack operation type, or a randomly selected slice f2 with the stack operation type []→[] is randomly inserted into s1; finally, s1 is repaired on demand according to the context environment required by f2.

[0019] Control flow nesting: Nesting the control flow structure of the original test case, wrapping a certain control flow structure with different control structure instructions, and ensuring that the outer structure and the inner structure have the same stack operation type;

[0020] Jump target mutation: Modify the target label of the control flow jump instruction, changing the jump target label from the expected stack operation type t1 through local jump code transformation. * The old label l1 is converted to the expected stack operation type t2. * The new tag l2;

[0021] Call target mutation: Modify the target function of the function call instruction to have the function signature g1. * →g2 * The target function h1 is replaced with a new function h2 with the same function signature, which is randomly selected; if it is an indirect function call, the local function table is modified.

[0022] Furthermore, in the slice splicing process, the on-demand context repair refers to: given the context set C1 required for the slice and the context set C2 of the current test case, checking whether each context c1 in C1 can be satisfied by a certain context c2 in C2; if it can be satisfied, then the slice is adjusted to use context c2 instead of c1; otherwise, a corresponding context c3 with the same context type as c1 is introduced into C2 and the slice is adjusted to use context c3.

[0023] Furthermore, in the jump target mutation, the local jump code transformation refers to: for an unconditional jump instruction, given the expected stack operation type t1 * The old label l1 and the expected stack operation type t2 * The new label l2 will first generate t1. * The old instruction sequence of the stack value is replaced to generate t2. * The new instruction sequence of the stack value is then modified, and the target label of the jump instruction is changed to l2; for conditional jump instructions, an additional stack operation type of t2 is appended after the jump instruction. * →t1 * The instruction sequence is used to ensure semantic correctness.

[0024] Furthermore, in the process of calling the target mutation, the local function table modification refers to inserting a table modification instruction before the calling instruction to update the corresponding table entry value in the function table to the target function.

[0025] Furthermore, the control flow skeleton-based generation algorithm described in Method 2 refers to decoupling the generation of the control flow skeleton from the generation of the data flow instruction sequence that generates the actual stack value, specifically including the following steps:

[0026] S201: First, specify the target stack operation type t to be generated. * Divided into subtype sequences [t1] * t2 * ...t n * Based on this, the overall control flow skeleton of the instruction sequence is planned, for each subtype t. i * Assign a randomly selected control structure instruction s i Its special responsibility is t i * Stack value generation; where t n * The target stack operation type is t * The nth subtype obtained from the partitioning;

[0027] S202: For those responsible for generating t i * Stack value control structure instructions s i If the maximum recursion depth d has not yet been reached c Then, the recursive call to step S201 generates s. i The included sub-control flow skeleton; otherwise, proceed to step S203.

[0028] S203: For subtype t i *For each type t in the process, a WebAssembly instruction with output stack operation type t is randomly selected, and corresponding instructions are recursively generated for the input stack operation type of that instruction. This recursive generation process continues until the maximum recursion depth d is reached. d The process continues until no instructions require stack input, and finally, the generated instructions are sequentially linked together to obtain the generated instruction t. i * The data stream instruction sequence of the stack value;

[0029] S204: Traverse the subtype sequence [t1] * t2 * ...t n * All subtypes in the array are then assembled according to the subtype sequence, resulting in the data stream instruction sequence generated for each subtype, which is then processed on the stack. * The target instruction sequence of the stack value.

[0030] Secondly, this invention proposes a semantically aware fuzzy test case generation system for WebAssembly runtime, which is used to implement the above-mentioned semantically aware fuzzy test case generation method.

[0031] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0032] (1) This invention proposes a stack-invariant code conversion strategy, which can guarantee in principle that the semantic correctness is properly preserved during the code conversion process, thereby helping fuzz testing to explore deep execution logic and effectively improve the efficiency of vulnerability discovery. At the same time, this conversion strategy is universal and can be extended to other stack-based programming languages ​​such as Java bytecode.

[0033] (2) This invention proposes a series of mutation algorithms for WebAssembly code data flow and control flow. The data flow mutation algorithm modifies the way stack values ​​are generated and the way stack values ​​are manipulated, while the control flow mutation algorithm changes the control flow relationship within and between functions. The two work together to help fuzz testing generate more diverse test cases and fully cover the input space.

[0034] (3) This invention proposes a WebAssembly code generation algorithm based on control flow skeleton. Unlike traditional generation algorithms, it decouples the generation of control flow structure and data flow instructions, making their generation processes independent and more flexible. This helps fuzz testing generate code fragments that are not present or rare in the initial corpus, thereby further improving fuzz testing efficiency. Attached Figure Description

[0035] Figure 1 A flowchart for generating semantically aware fuzzy test cases for the WebAssembly runtime;

[0036] Figure 2 A schematic diagram illustrating the workflow of slicing and splicing test cases during the mutation phase;

[0037] Figure 3 This is a schematic diagram of the workflow of the control flow skeleton generation algorithm;

[0038] Figure 4 Generate the overall system design diagram for semantically aware fuzzy test cases targeting the WebAssembly runtime. Detailed Implementation

[0039] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be noted that the embodiments described below are intended to facilitate the understanding of the present invention and do not limit it in any way.

[0040] This invention provides a method for generating semantically aware fuzzy test cases for WebAssembly runtime, the specific process of which is as follows: Figure 1 As shown, the specific implementation of each step is as follows:

[0041] Step 1: Define the stack-invariant code transformation strategy.

[0042] The aforementioned stack-invariant code transformation strategy refers to analyzing instruction sequences by focusing solely on the cumulative impact of instructions on stack operation types, without considering the specific operations performed on the stack values. This is crucial for the WebAssembly runtime's validity checks. Therefore, as long as two instruction sequences have compatible effects on stack operation types, they can be substituted for each other while maintaining the unchanged stack state before and after the substitution, i.e., they have the same stack operation type t1. * →t2 * The code snippets can be seamlessly interchanged and the semantic correctness of the code before and after the replacement is guaranteed in principle, thereby assisting fuzz testing in exploring deep execution logic and improving testing efficiency.

[0043] Step 2: Input the original test cases provided by the fuzz testing engine.

[0044] Step 3 involves performing mutation operations at the data flow and control flow levels on the test cases. This invention utilizes the stack-invariant code transformation strategy defined in step S1 to ensure that the mutation algorithm involved in step S3 maintains the semantic validity of the test cases.

[0045] In one specific embodiment of the present invention, this step can be implemented through the following sub-steps:

[0046] Step 301, Interesting Value Mutation: Modify the immediate value involved in a selected test case to a boundary value such as a maximum 32-bit signed integer or a singular value more likely to trigger a vulnerability. The singular value more likely to trigger a vulnerability refers to an immediate value that appeared in a previously disclosed vulnerability in the target program. Interesting value mutation primarily modifies the const instruction responsible for pushing different types of immediate values ​​onto the stack. This instruction maintains an interesting value array for i32, i64, f32, and f64 types and replaces the immediate value in the instruction with an arbitrarily selected interesting value from the corresponding type array during mutation. Interesting values ​​for the v128 vector type are randomly combined from interesting values ​​of smaller bit-width types.

[0047] Step 302, Operator mutation: Based on the stack-invariant code transformation strategy, WebAssembly operators are grouped according to their stack operation types. For a certain operator in a selected test case, operator mutation replaces it with another operator randomly selected from its operator group, thereby achieving different operations on the same stack value.

[0048] Step 303, Slicing and splicing: For a selected test case s1, another test case s2 needs to be selected from the existing test cases, such as... Figure 2 As shown, the two given test cases s1 and s2 are first parsed into an abstract syntax tree. Each node in the tree represents a specific WebAssembly operator, and its child nodes represent the input sources of the stack values ​​that the current operator depends on. Based on the parsed abstract syntax tree, a slice pool P2 is further constructed for s2. Each slice consists of a node in the tree and all its child nodes, and is labeled with the stack operation type t1. * →t2 *Then, a random instruction node N1 is selected from s1 for mutation, and the corresponding type-labeled slice f1 rooted at N1 is calculated. Slice splicing involves two types of mutation operations: first, a slice f2 matching the stack operation type of slice f1 is randomly selected from the slice pool P2 and used to replace slice f1 in s1; second, a slice f2 with the stack operation type []→[] is randomly selected from P2 and inserted after node N1, i.e., after slice f1. In each slice splicing operation, one type of mutation operation is randomly selected. When repeating the slice splicing operation multiple times, different types of mutation operations can be selected. To successfully embed slice f2 into test case s1, slice concatenation employs on-demand context repair of slice f2. The basic idea is to consider a given context set C2 required by slice f2 and the context set C1 of the current test case s1. It checks whether each context c2 in C2 can be satisfied by a context c1 in C1. If satisfied, the slice uses context c1 instead of c2; otherwise, it introduces the corresponding context c3 into C1 (c3 has the same context type as c1, but the context content can be different) and adjusts slice f2 to use context c3. Then, based on on-demand context repair, it checks whether the contexts involved in functions, global variables, jump labels, and local variables in slice f2 can be repaired. If successfully repaired, the concatenation operation is retained; otherwise, it is discarded. Slice concatenation continues until the maximum number of attempts is reached.

[0049] Step 304, Control Flow Nesting: This step aims to create deeper nested control flow structures. It randomly selects a control flow structure from the test cases and encapsulates it within another control flow structure. Available control flow structures include block, loop, and if...else. Based on the stack-invariant code transformation strategy, the control flow structures before and after nesting should provide equivalent stack operation semantics to their contexts. Therefore, control flow nesting ensures that the outer structure and the inner structure have the same stack operation type, thus achieving a self-replicating effect.

[0050] Step 305, Jump Target Mutation: Modify the jump target of the jump instruction in WebAssembly. Given the expected stack operation type t1 * The old label l1 and the expected stack operation type t2 * The new label l2, the jump target mutation, takes different mutation operations depending on the different jump instructions: br and br_table are unconditional jump instructions, their stack operation type is unrestricted and can be dynamically adjusted to meet the needs of their context, so the original t1 can be directly generated. * The instruction sequence of the stack value is replaced to generate t2 * The new instruction sequence on the stack is updated and the jump target is changed to l2; br_if is a conditional jump instruction that will change the original t1. *Stack values ​​remain on the stack. To maintain the stack's invariant state, sudden changes in the jump target are handled with local jump code conversion, and an additional stack operation of type t2 is appended after the jump instruction. * →t1 * The instruction sequence is configured to ensure semantic correctness. Specifically, code segments f1 and f2 are inserted before and after the jump instruction, respectively. f1 is responsible for transferring the original t1... * Stack value converted to t2 * The stack is used by jump instructions, and f2 is responsible for moving t2. * Stack value conversion back to t1 * The stack value satisfies the stack invariant property. In jump target mutations, all necessary instruction sequences are generated by a generation algorithm.

[0051] Step 306, Target Mutation: Modify the control flow call relationships between functions in the test cases. For `call` and `call_indirect` instructions, a matching function (with the same function signature) is randomly selected from the current input as the new target based on the function signature of the target function. If no available function exists, the generation algorithm creates a new function that meets the required signature. Since the function actually called by the `call_indirect` instruction is determined at runtime, to ensure that it calls the target function, target mutation employs in-situ function table modification. It inserts a table modification instruction `table.set` before the call instruction to update the corresponding table entry value to the target function. For example, assuming the indirect function call instruction calls the function at index i1 of function table t1, to ensure that it actually calls the specified function h1 at runtime, index i1 of function table t1 is updated to function h1 in-situ before the indirect call instruction.

[0052] Step 4: Expand the test cases by generating new code snippets based on the control flow skeleton generation algorithm.

[0053] In one specific embodiment of the present invention, this step can be implemented through the following sub-steps, such as... Figure 3 As shown:

[0054] Step 401, given the target stack operation type t to be generated * Given the current recursion depth d, the generation algorithm first assigns stack operation type t to the current recursion depth d. * Divided into subtype sequences [t1] * t2 * ...t n * Based on this, the overall control flow skeleton of the instruction sequence is planned, for each subtype t. i * Assign a randomly selected control structure instruction s i Its special responsibility is t i *Stack value generation. Each subtype t here... i * It contains one or more types.

[0055] Step 402, for those responsible for generating t i * Stack value control structure instructions s i If the maximum recursion depth has not yet been reached, continue recursively calling step 401 to generate s. i The control fluid, otherwise, generates actual t. i * The data stream instruction sequence of the stack value is generated, i.e., execution step S403.

[0056] Step 403, to generate t on the stack i * Stack value, algorithm t i * For each type t in the algorithm, an instruction with output stack operation type t is randomly selected, and corresponding instructions with input stack operation type t are recursively generated. This recursive generation process continues until the maximum recursion depth is reached or the instruction no longer requires stack input. Finally, the generated instructions are concatenated in order to obtain the generated t. i * The instruction sequence of the stack value is used as s i The control fluid.

[0057] Step 404: The algorithm finally assembles each control flow structure s according to the subtype sequence order. i The output is t generated on the stack. * The target instruction sequence of the stack value.

[0058] Based on the same inventive concept, this embodiment also provides a semantically aware fuzzy test case generation system for WebAssembly runtime, such as... Figure 4 As shown, it specifically includes the following modules:

[0059] Preprocessing module: used to define stack-invariant code transformation strategies;

[0060] Mutagen Module: This module uses a stack-invariant code transformation strategy to mutate input test cases from both data flow and control flow perspectives, transforming them into new test cases. It includes interesting value mutants, operator mutants, slice splicers, control flow nesters, jump target mutants, and call target mutants, which are used to generate new test cases from existing test cases by performing the transformation methods of interesting value mutation, operator mutation, slice splicing, control flow nesting, jump target mutation, and call target mutation, respectively.

[0061] Generator module: This module generates new code snippets based on a control flow skeleton-based generation algorithm to expand input test cases or construct entirely new test cases.

[0062] The test cases generated by this system can be used in fuzz testing post-processing procedures known to those skilled in the art.

[0063] For the system embodiments, since they basically correspond to the method embodiments, relevant details can be found in the descriptions of the method embodiments; the implementation methods of the remaining modules will not be repeated here. The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the present invention according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0064] The system embodiments of the present invention can be applied to any device with data processing capabilities, such as a computer or other similar device. The system embodiments can be implemented in software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by the processor of any data processing device loading the corresponding computer program instructions from non-volatile memory into memory for execution.

[0065] The embodiments described above provide a detailed explanation of the technical solutions and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, additions, and equivalent substitutions made within the scope of the principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for generating semantically aware fuzzy test cases for WebAssembly runtime, characterized in that, Includes the following steps: A stack-invariant code transformation strategy is defined to maintain the semantic validity of test case code before and after transformation. This strategy means that during the code transformation to generate new test cases, only the impact on stack operation semantics before and after transformation is considered, while ignoring the actual stack values ​​involved. Therefore, it ensures that code with the same stack operation type t1 will be transformed into a single test case. * → t2 * The code snippets are seamlessly replaced, and the semantic correctness of the new test cases is guaranteed in principle. Based on the stack-invariant code transformation strategy described above, test cases are generated using either Method 1, Method 2, or a combination of Method 1 and Method 2 for fuzz testing. Method 1 is as follows: new test cases are generated from existing test cases by using one or more combinations of interesting value mutation, operator mutation, fragment splicing, control flow nesting, jump target mutation, and call target mutation. The second method involves expanding existing test cases based on a control flow skeleton generation algorithm. This algorithm decouples the generation of the control flow skeleton from the generation of the data flow instruction sequence that produces the actual stack value. Specifically, it includes the following steps: S201: First, specify the target stack operation type t to be generated. * Divided into subtype sequences [t1] * t2 * ... t n * Based on this, the overall control flow skeleton of the instruction sequence is planned, for each subtype t. i * Assign a randomly selected control structure instruction s i Its special responsibility is t i * Stack value generation; where t n * The target stack operation type is t * The nth subtype obtained from the partitioning; S202: For those responsible for generating t i * Stack value control structure instructions s i If the maximum recursion depth d has not yet been reached c Then, the recursive call to step S201 generates s. i The included sub-control flow skeleton; otherwise, proceed to step S203. S203: For subtype t i * For each type t in the process, a WebAssembly instruction with output stack operation type t is randomly selected, and corresponding instructions are recursively generated for the input stack operation type of that instruction. This recursive generation process continues until the maximum recursion depth d is reached. d The process continues until no instructions require stack input, and finally, the generated instructions are sequentially linked together to obtain the generated instruction t. i * The data stream instruction sequence of the stack value; S204: Traverse the subtype sequence [t1] * t2 * ... t n * All subtypes in the array are then assembled according to the subtype sequence, resulting in the data stream instruction sequence generated for each subtype, which is then processed on the stack. * The target instruction sequence of the stack value.

2. The semantically aware fuzzy test case generation method for WebAssembly runtime according to claim 1, characterized in that, When generating test cases using either method one or method two, method one or method two is executed once or multiple times.

3. The semantically aware fuzzy test case generation method for WebAssembly runtime according to claim 1, characterized in that, The combination of Method 1 and Method 2 refers to executing Method 1 first and then Method 2, or executing Method 2 first and then Method 1.

4. The semantically aware fuzzy test case generation method for WebAssembly runtime according to claim 1, characterized in that, The method described in Method 1 for generating new test cases from existing test cases includes: Interesting value mutation: Replace the immediate value involved in the WebAssembly directive with a boundary value of the same type or an exotic value that is more likely to trigger the vulnerability; Operator mutation: Replace t1 with a stack operation type * → t2 * The operator is another operator with the same stack operation type; Slice concatenation: First, the two original test cases s1 and s2 are parsed into an abstract syntax tree. Each node in the tree represents a specific WebAssembly operator, and its child nodes represent the input sources of the stack values ​​that the current operator depends on. Based on the parsed abstract syntax tree, a slice pool is further constructed. Each slice consists of a node in the tree and all its child nodes, and is labeled with the stack operation type t1. * → t2 * ; s1 contains stack operation type t1 * → t2 * The slice f1 is replaced with a randomly selected slice f2 in s2 that has the same stack operation type, or a randomly selected slice f2 with stack operation type [ ] → [ ] is randomly inserted into s1; finally, s1 is repaired on demand according to the context environment required by f2. Control flow nesting: Nesting the control flow structure of the original test case, wrapping a certain control flow structure with different control structure instructions, and ensuring that the outer structure and the inner structure have the same stack operation type; Jump target mutation: Modify the target label of the control flow jump instruction, changing the jump target label from the expected stack operation type t1 through local jump code transformation. * The old label l1 is converted to the expected stack operation type t2. * The new tag l2; Call target mutation: Modify the target function of the function call instruction to have the function signature g1. * → g2 * The target function h1 is replaced with a new function h2 with the same function signature, which is randomly selected; if it is an indirect function call, the local function table is modified.

5. The semantically aware fuzzy test case generation method for WebAssembly runtime according to claim 4, characterized in that, In the slice splicing process, the on-demand context repair refers to: given the context set C1 required for the slice and the context set C2 of the current test case, checking whether each context c1 in C1 can be satisfied by a certain context c2 in C2; if it can be satisfied, then the slice is adjusted to use context c2 instead of c1; otherwise, a corresponding context c3 with the same context type as c1 is introduced into C2 and the slice is adjusted to use context c3.

6. The semantically aware fuzzy test case generation method for WebAssembly runtime according to claim 4, characterized in that, In the jump target mutation, the local jump code transformation refers to: for an unconditional jump instruction, given the expected stack operation type t1 * The old label l1 and the expected stack operation type t2 * The new label l2 will first generate t1. * The old instruction sequence of the stack value is replaced to generate t2. * The new instruction sequence of the stack value is then modified, and the target label of the jump instruction is changed to l2; for conditional jump instructions, an additional stack operation type of t2 is appended after the jump instruction. * → t1 * The instruction sequence is used to ensure semantic correctness.

7. The semantically aware fuzzy test case generation method for WebAssembly runtime according to claim 4, characterized in that, In the process of calling the target mutation, the local function table modification refers to inserting a table modification instruction before the call instruction to update the corresponding table entry value in the function table to the target function.

8. A semantically aware fuzzy test case generation system for WebAssembly runtime, used to implement the method of claim 1, characterized in that, The system includes: The preprocessing module is used to define stack-invariant code transformation strategies; The Mutagen module, under the condition of satisfying the stack-invariant code transformation strategy, generates new test cases from existing test cases from both the data flow and control flow aspects, using one or more combinations of transformation methods such as interesting value mutation, operator mutation, fragment splicing, control flow nesting, jump target mutation, and call target mutation; The generator module expands existing test cases based on a control flow skeleton generation algorithm, while satisfying the stack-invariant code transformation strategy.

Images