Fuzzy test case generation method and device, computer equipment and storage medium

Abstract

The invention discloses a generation method and device of a fuzzy test case, computer equipment and a storage medium. The generation method of the fuzzy test case comprises the steps of obtaining an intermediate representation code of external software corresponding to software to be tested; determining a target call list of virtual function call points according to the virtual function call points corresponding to the external interface of the to-be-tested software in the intermediate representation code; determining calling information of the to-be-tested software according to the target calling list and data flow information and control flow information corresponding to the to-be-tested software; and generating a fuzzy test case according to the calling information. According to the method, analysis errors caused by directly analyzing the use mode of the to-be-tested software by the external software and generation of abnormal fuzzy test cases can be avoided, and the generation accuracy of the fuzzy test cases is improved.

Description

Technical Field

[0001] The present application relates to the field of software testing technology, and more specifically, to a method, device, computer equipment and storage medium for generating fuzzy test cases. Background Art

[0002] Fuzz testing is an effective testing method for checking the security of information systems. Fuzz testing explores program status and detects program vulnerabilities by driving fuzz test cases to input highly random data into the program. Writing fuzz test case code is a necessary step for fuzz testing software. In related technologies, fuzz test case code is usually generated by analyzing the usage of the software to be tested, and then generating fuzz test cases based on the analyzed usage. However, this method may cause inaccuracies when generating fuzz test cases for some software. Summary of the invention

[0003] The present application proposes a method, apparatus, computer device and storage medium for generating fuzzy test cases, which improve the accuracy of fuzzy test case generation.

[0004] In a first aspect, an embodiment of the present application provides a method for generating a fuzzy test case, the method comprising: obtaining an intermediate representation code of external software corresponding to the software to be tested; determining a target call list of the virtual function call point according to the virtual function call point corresponding to the external interface of the software to be tested in the intermediate representation code, wherein the target call list includes interface information of the external interface called when the external software calls the software to be tested; determining the call information of the software to be tested according to the target call list and the data flow information and control flow information corresponding to the software to be tested, wherein the data flow information and the control flow information are determined based on the data access instructions and the control flow switching instructions in the intermediate representation code, and the call information includes the dependency data when the external software calls the external interface and the control dependency relationship information between the external interfaces called by the external software; generating a fuzzy test case according to the call information, the fuzzy test case being used to fuzz test the external software's call to the software to be tested.

[0005] In a second aspect, an embodiment of the present application provides a device for generating fuzzy test cases, the device comprising: a data acquisition module, a target call list determination module, a call information determination module and a fuzzy test case generation module, wherein the data acquisition module is used to acquire an intermediate representation code of external software corresponding to the software to be tested; the target call list determination module is used to determine a target call list of the virtual function call points according to the virtual function call points corresponding to the external interface of the software to be tested in the intermediate representation code, wherein the target call list includes interface information of the external interface called when the external software calls the software to be tested; the call information determination module is used to determine a target call list of the virtual function call points according to the virtual function call points corresponding to the external interface of the software to be tested in the target call list The calling information of the software to be tested is determined by using a list and data flow information and control flow information corresponding to the software to be tested, wherein the data flow information and the control flow information are determined based on the data access instructions and the control flow switching instructions in the intermediate representation code, and the calling information includes the dependency data when the external software in the information in the data flow calls the external interface of the software to be tested and the control dependency relationship when the external software calls the external interface of the software to be tested in the control flow information; the fuzzy test case generation module is used to generate a fuzzy test case according to the calling information, and the fuzzy test case is used to fuzz test the external software's call to the software to be tested.

[0006] In a third aspect, an embodiment of the present application provides a computer device comprising: one or more processors; a memory; and one or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more applications are configured to execute the method for generating fuzzy test cases provided in the first aspect above.

[0007] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which a program code is stored. The program code can be called by a processor to execute the method for generating fuzzy test cases provided in the first aspect above.

[0008] The solution provided by the present application first obtains the intermediate representation code of the external software corresponding to the software to be tested, and then analyzes the virtual function call points in the intermediate representation code to obtain the target call list corresponding to the external interface of the software to be tested, and finally generates a fuzzy test case according to the target call list, the data flow information and control flow information corresponding to the software to be tested, and the template of the fuzzy test case. The fuzzy test case is generated by analyzing the virtual function call points, which avoids the analysis errors caused by directly analyzing the external software's use of the software to be tested and the generation of abnormal fuzzy test cases, thereby improving the accuracy of fuzzy test case generation. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0010] Figure 1 A schematic flow chart of a method for generating a fuzzy test case according to an embodiment of the present application is shown.

[0011] Figure 2 A schematic flow chart of a method for generating fuzzy test cases according to another embodiment of the present application is shown.

[0012] Figure 3 A schematic flow chart of a method for generating fuzzy test cases according to yet another embodiment of the present application is shown.

[0013] Figure 4 A block diagram of a device for generating fuzzy test cases according to an embodiment of the present application is shown.

[0014] Figure 5 It is a block diagram of a computer device according to an embodiment of the present application for executing a method for generating a fuzzy test case according to an embodiment of the present application.

[0015] Figure 6 It is a storage unit of an embodiment of the present application for storing or carrying program code for implementing a method for generating fuzzy test cases according to an embodiment of the present application. DETAILED DESCRIPTION

[0016] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0017] In the relevant automatic generation scheme of fuzzy test case code, the external test software is analyzed, the usage method of the external interface of the software to be tested is extracted, and then the usage code of the external interface of the software to be tested is rebuilt based on the usage method, and the fuzzy test case is generated based on the usage code.

[0018] However, such fuzzy test cases are based on external software directly calling the software to be tested. Some software written in assembly language does not call the software to be tested directly, but indirectly calls it through virtual functions, such as C language and C++ language. Therefore, when generating fuzzy test cases for software written in C language or C++ language, if the usage of the external software is directly extracted and the corresponding fuzzy test cases are generated based on the usage, it is impossible to analyze and collect the complete data flow and control flow, and thus it is impossible to normally analyze the usage of its external interface, which will cause the generated fuzzy test cases to be inaccurate. In turn, using incorrectly written fuzzy test cases will result in erroneous test results when testing the software to be tested, and the purpose of fuzz testing the software to be tested cannot be achieved.

[0019] In view of the above problems, the inventors have proposed a method, device, computer equipment and storage medium for generating fuzzy test cases provided in the embodiments of the present application, which generates fuzzy test cases by analyzing virtual function call points, thereby avoiding analysis errors caused by directly analyzing the use of the software to be tested by external software and generating abnormal fuzzy test cases, thereby improving the accuracy of fuzzy test case generation. The specific method for generating fuzzy test cases is described in detail in the subsequent embodiments.

[0020] The following is a detailed introduction to the method for generating fuzzy test cases provided in the embodiments of the present application in conjunction with the accompanying drawings.

[0021] See also Figure 1 , Figure 1 FIG. 1 is a flow chart of a method for generating a fuzzy test case provided by an embodiment of the present application. In a specific embodiment, the method for generating a fuzzy test case is applied to Figure 4 The fuzzy test case generation device 300 and the computer device 100 ( Figure 5 ). The following will take a computer device as an example to illustrate the specific process of this embodiment. Of course, it can be understood that the computer device used in this embodiment can be a computer device, a server device, a vehicle terminal, etc., which is not limited here. Figure 1 The process shown is described in detail, and the method for generating a fuzzy test case may specifically include the following steps:

[0022] Step S110: Obtain the intermediate representation code of the external software corresponding to the software to be tested.

[0023] The external software corresponding to the software to be tested refers to the software that calls the software to be tested or the software that provides the software to be tested with the user and / or other software for interaction. It should be noted that the software to be tested needs to be linked with the external software to obtain a complete application and realize all the functions of the application.

[0024] In the embodiment of the present application, the intermediate representation code refers to the intermediate code (Intermediate Representation, IR), which is a data structure code that can be understood by a computer after compiling the external software. The intermediate representation code is used to realize the link between the external software and the software to be tested. The intermediate representation codes obtained by different external software are different. Here, the specific form of expression of the intermediate representation code is not limited. By compiling the external software, the intermediate representation code of the external software can be obtained. The software to be tested can be software written in C language or C++ language.

[0025] Step S120: Determine a target call list of the virtual function call points in the intermediate representation code corresponding to the external interface of the software to be tested, wherein the target call list includes interface information of the external interface called when the external software calls the software to be tested.

[0026] In the intermediate representation code, there is a good data relationship representation between the external software and the software to be tested. The data relationship representation can be a linear representation or a non-linear representation. In the embodiment scheme of the present application, the data relationship representation between the external software and the software to be tested in the intermediate representation code is a non-linear representation. And the non-linear representation is preferably a virtual function call point. The data relationship representation between the external software and the software to be tested can also be set according to actual needs, and is not specifically limited here.

[0027] In the embodiment of the present application, the external software implements the external function call of the external interface of the software to be tested through the virtual function call point of the intermediate representation code. If the use mode of the external software is directly extracted, what is obtained is the use mode of the virtual function call point, not the use mode of the external software for the software to be tested. Moreover, the same virtual function call point can call different external interfaces of different software. If the virtual function call point of the external software is directly analyzed, the external interface of other software may be analyzed, and a fuzzy test case is generated for the analysis result. Such a fuzzy test case will affect the result of the fuzzy test, thereby failing to accurately detect the program state and program vulnerabilities of the software to be tested. Therefore, before the software to be tested is tested, it is necessary to first screen the external interface corresponding to the virtual function call point to ensure that the external interface call list corresponding to one or more virtual function call points corresponding to the intermediate representation code only contains the external interface of the current software to be tested, and obtain the target call list of the virtual function call point, which only contains the interface information corresponding to the external interface of the current software to be tested, so as to ensure that the fuzzy test case obtained by analyzing the virtual function call point only contains the relevant information of the software to be tested. The interface information may include the software to be tested corresponding to the external interface, the data transmitted by the external interface, and the interface information related to the correspondence between the external interface and the virtual function call point. The interface information may be added, modified, and deleted by the user. In the solution of the embodiment of the present application, the specific interface information may not be limited.

[0028] In some implementations, the screening method for the external interfaces corresponding to the virtual function call points may be screening according to the names corresponding to the external interfaces, or may be first labeling the external interfaces of different software to be tested with corresponding labels, and then screening the external interfaces according to the labels. The screening method for the external interfaces is not specifically limited herein.

[0029] Step S130: Determine the calling information of the software to be tested according to the target calling list and the data flow information and control flow information corresponding to the software to be tested, wherein the data flow information and the control flow information are determined based on the data access instructions and control flow switching instructions in the intermediate representation code, and the calling information includes the dependency data when the external software calls the external interface and the control dependency relationship information between the external interfaces called by the external software.

[0030] Among them, data flow information refers to a set of ordered data sequences with input data and output data, which are composed of all data required and / or generated by external software when calling the software to be tested. Control flow information refers to the sequential sequence of external interface execution in the software to be tested. Control dependency information refers to the relationship information between other external interfaces used by external software when calling a certain external interface and the external interface. It should be noted that both data flow information and control flow information can be obtained by identifying and / or analyzing the intermediate representation code, and the expression form of data flow information and control flow information can be a data flow graph and a control flow graph formed by external interfaces as data flow nodes and control flow nodes. The expression form can also be a table form, and the expression form of data flow information and control flow information is not specifically limited here.

[0031] In the embodiment of the present application, the target call list only includes the interface information of the external interface called when the external software calls the software to be tested, and the data flow information includes the data used or generated when the external software calls the external interface of the software to be tested. The control flow information includes the execution order of the external interface when the external software calls the software to be tested. Therefore, the dependent data when the external software calls the external interface of the software to be tested and the control dependency relationship information between the external interfaces can be determined based on the target call list, the data flow information and the control flow information.

[0032] Step S140: Generate a fuzzy test case according to the calling information, where the fuzzy test case is used to fuzz test the calling of the external software to the software to be tested.

[0033] Among them, a fuzzy test case refers to a computer program used to perform fuzzy testing, and the fuzzy test case includes but is not limited to fuzzy test data, execution conditions corresponding to the fuzzy test data, and test results corresponding to the fuzzy test case.

[0034] In an embodiment of the present application, the data type, data attributes and data results corresponding to the fuzzy test case can be determined based on the above dependency data in the calling information; the execution conditions and execution order of the fuzzy test case can also be determined based on the control dependency information in the calling information; then, based on the data type, data attributes, data results corresponding to the data, execution conditions and execution order, a fuzzy test case can be generated for the fuzzy test external software to call the software to be tested.

[0035] The method for generating fuzzy test cases provided in the embodiment of the present application first obtains the intermediate representation code of the external software corresponding to the software to be tested, then analyzes the virtual function call points in the intermediate representation code to obtain the target call list corresponding to the external interface of the software to be tested, and finally generates the fuzzy test case according to the target call list, the data flow information and control flow information corresponding to the software to be tested, and the template of the fuzzy test case. The fuzzy test case is generated by analyzing the virtual function call points, which avoids the analysis errors caused by directly analyzing the way the external software uses the software to be tested and the generation of abnormal fuzzy test cases, thereby improving the accuracy of the generation of fuzzy test cases.

[0036] See also Figure 2 , Figure 2 A flow chart of a method for generating a fuzzy test case provided by another embodiment of the present application is shown. The method for generating a fuzzy test case is applied to the above-mentioned computer device. Figure 2 The process shown is described in detail, and the method for generating a fuzzy test case may specifically include the following steps:

[0037] Step S201: Obtain the intermediate representation code of the external software corresponding to the software to be tested.

[0038] In the embodiment of the present application, step S210 can refer to the contents of other embodiments and will not be repeated here.

[0039] Step S202: Obtain an interface call list corresponding to each virtual function call point in the intermediate representation code.

[0040] The interface call list includes, but is not limited to, interface information such as the interface name of the external interface called, calling parameters of the external interface, and data relied upon when calling the external interface.

[0041] In an embodiment of the present application, a virtual function call point can call one or more external interfaces of a software to be tested, or can call one or more external interfaces of multiple software to be tested. An interface call list corresponding to each virtual function call point can be pre-stored in a storage unit. After the external software is compiled to obtain an intermediate representation code corresponding to the external software, the corresponding interface call list is obtained from the storage unit according to the virtual function call point in the intermediate representation code. The interface call list can also be obtained by extracting the virtual function call point and the external interface corresponding to the virtual function from the intermediate representation code, thereby obtaining an interface call list corresponding to each virtual function call point. The method for obtaining the interface call list corresponding to the virtual function call point is not specifically limited herein.

[0042] Step S203: based on the interface call list corresponding to each of the virtual function call points, determining the interface information of the external interface called when the external software calls the software to be tested.

[0043] Since the virtual function call point will also call the external interface of other software, in order to ensure the accuracy of the fuzz test of the software to be tested, it is necessary to filter the interface information in the interface call list corresponding to the virtual function call point. The filtering method can be based on the interface name in the interface information. It should be noted that when naming the external interface, it is necessary to strictly follow the naming specifications to improve the accuracy of filtering the call information in the interface call list. The filtering method can also be based on the data relied on when calling the external interface in the interface call list. The filtering method of the interface information in the interface call list is not specifically limited here.

[0044] Exemplarily, the interface call list corresponding to each virtual function call point may be as shown in Table 1:

[0045]

[0046] Table 1

[0047] As shown in Table 1, different virtual function call points call different external interfaces and the call parameters are also different.

[0048] Step S204: Determine the target call list according to the interface information.

[0049] In an embodiment of the present application, the interface information corresponding to the external interface of the software to be tested in the interface call list of all virtual function call points in the intermediate representation code is integrated to determine the target call list of the virtual function call points. The interface information in the target call list may be the same as or different from the interface information in the interface call list, and may be customized by the user. The interface information in the target call list is not specifically limited herein.

[0050] For example, if the software to be tested is software 1, the target call list may be as shown in Table 2:

[0051]

[0052] Table 2

[0053] As shown in Table 2, the target call list only includes the interface information of the external interface of the software to be tested.

[0054] Step S205: Determine the data flow information and the control flow information based on the data access instructions and the control flow switching instructions in the intermediate representation code.

[0055] Among them, data access instructions refer to instructions for accessing and operating data, and data access instructions include but are not limited to data instructions, data editing instructions, and data moving instructions. In the embodiment of the present application, data access instructions specifically refer to instructions for accessing and operating the data that the external interface depends on when the external software in the intermediate representation code calls the external interface of the software to be tested.

[0056] A control flow switching instruction refers to an instruction that changes the execution order of a program, and includes but is not limited to jump instructions, branch instructions, and other switching instructions. In the embodiment of the present application, a control flow switching instruction specifically refers to a switching instruction in the intermediate representation code that changes the interface call when the external software is to the external interface of the software to be tested.

[0057] The data flow information during the process of the external software calling the external interface of the software to be tested is obtained according to the data access instruction, and the control flow information during the process of the external software calling the external interface of the software to be tested is obtained according to the control flow switching instruction.

[0058] Exemplarily, in the process of external software calling the external interface of the software to be tested, data A, data B and data C are relied on. The data access instruction may be that when calling external interface 1, data B is accessed according to the data access instruction, when calling external interface 2, data B is switched to data A according to the data access instruction, and when calling external interface 3, data C is edited according to the data access instruction to obtain the edited data C. At this time, the corresponding data flow information is {data B, data A, edited data C}. During the calling process, the execution order of the called external interface can also be changed according to the control flow switching instruction. When the control flow switching instruction is not used, the control flow information is {external interface 1, external interface 2, external interface 3}. According to the control flow switching instruction, after calling external interface 1, jump to call external interface 3, and after calling external interface 3, call external interface 2 again. At this time, the control flow information is {external interface 1, external interface 3, external interface 2}. At this time, the data flow information will also change according to the change of the order of calling the external interface, and the latest data flow information {data B, edited data C, data A} is obtained. The data flow information and control flow information obtained according to different data access instructions and different control flow switching instructions are different.

[0059] Step S206: Determine control dependency information between the external interfaces called by the external software according to the control flow information.

[0060] In the embodiment of the present application, the control dependency relationship refers to the control logic relationship between external interfaces, including but not limited to sequence dependency and jump dependency.

[0061] Exemplarily, external interface 1 is called first, then external interface 2, then external interface 4 is called, and then external interface 3 is called. There is a sequential dependency between external interface 1 and external interface 2, a jump dependency between external interface 2 and external interface 4, and a sequential dependency between external interface 2 and external interface 3.

[0062] In some embodiments, the control flow information includes a control flow node graph, and determining the control dependency information between the external interfaces called by the external software based on the control flow information includes: obtaining the control dependency information between the external interfaces based on the connection relationship between the nodes corresponding to the external interfaces in the control flow node graph.

[0063] Among them, the control flow node graph refers to a node graph in which multiple nodes are connected according to the execution order. The connection relationship includes but is not limited to serial connection, parallel connection, hierarchical connection and other connection relationships. Serial connection means that two nodes are connected in a certain order, and the output of the previous node is used as the input of the next node. Parallel connection means that multiple nodes are connected in parallel, and the output of each node is used as the input of other nodes. Hierarchical connection means that some nodes are sub-nodes of high-level nodes to form a hierarchical structure.

[0064] In the embodiment of the present application, since one external interface corresponds to one or more nodes in the control flow node graph, the control dependency relationship between the external interfaces can be determined according to the connection relationship between the nodes in the control flow node graph.

[0065] Step S207: Determine, according to the data flow information, dependency data when the external software calls the external interface of the software to be tested.

[0066] In the embodiment of the present application, dependent data refers to the data used by the external software when calling the external interface. For example, the external software uses data A when calling external interface 1 and uses data C when calling external interface 2. Then, the dependent data of external interface 1 is data A, and the dependent data of external interface 2 is data C.

[0067] Step S208: Create the test data based on the dependency data.

[0068] In the embodiment of the present application, the data type, data attribute and data entity corresponding to the dependent data can be obtained according to the dependent data when the external software calls the external interface, and the corresponding test data can be created according to the data type, data attribute and data entity corresponding to the dependent data. The creation method of the test data can be automatically created by the test data creation program, or it can be manually created by the tester according to the data type, data attribute and data entity corresponding to the dependent data. The creation method of the test data is not specifically limited here.

[0069] Step S209: generating a fuzzy test case for the external software to perform fuzz testing on the software to be tested according to the control dependency information and the test data and based on a fuzzy test case template.

[0070] In order to facilitate the management of fuzzy test cases, a fuzzy test case template is introduced. The fuzzy test case template defines the format of the fuzzy test case so that the format of the fuzzy test cases generated according to the template is consistent.

[0071] In the embodiment of the present application, the control dependency information provides the execution dependency between the external software calling the external interface of the software to be tested, and the test data provides the data used when the external software calls the external interface of the software to be tested. According to the template of the fuzzy test case, a fuzzy test case with a consistent format is generated to facilitate the management of the test case by the tester.

[0072] The method for generating fuzzy test cases provided in the embodiment of the present application can more clearly obtain how the external software calls the software to be tested and the data used in the calling process by analyzing the target call list of the virtual function call points in the intermediate representation code of the external software, the control flow information corresponding to the software to be tested, and the data flow information, thereby avoiding extraction errors caused by directly extracting the usage method of the external software, making the fuzzy test cases generated based on the targets used for fuzzy testing more accurate, improving the accuracy of the generated fuzzy test cases, and also improving the accuracy of detecting the status of the software to be tested and program vulnerabilities. In addition, in the embodiment of the present application, a unified template is used to generate fuzzy test cases, which improves the readability and standardization of the fuzzy test case code.

[0073] See also Figure 3 , Figure 3 A flow chart of a method for generating a fuzzy test case provided by another embodiment of the present application is shown. The method for generating a fuzzy test case is applied to the above-mentioned computer device. Figure 3 The process shown is described in detail, and the method for generating a fuzzy test case may specifically include the following steps:

[0074] Step S310: Obtain the intermediate representation code of the external software corresponding to the software to be tested.

[0075] Step S320: Determine a target call list of the virtual function call points in the intermediate representation code corresponding to the external interface of the software to be tested, wherein the target call list includes interface information of the external interface called when the external software calls the software to be tested.

[0076] Step S330: Determine the calling information of the software to be tested according to the target calling list and the data flow information and control flow information corresponding to the software to be tested, wherein the data flow information and the control flow information are determined based on the data access instructions and control flow switching instructions in the intermediate representation code, and the calling information includes the dependency data when the external software calls the external interface and the control dependency relationship information between the external interfaces called by the external software.

[0077] In the embodiment of the present application, steps S310 to S330 may refer to the contents of other embodiments and will not be described in detail here.

[0078] Step S340: construct a data declaration corresponding to the dependent data according to the data type and data entity corresponding to the dependent data.

[0079] The data declaration includes but is not limited to the data type, data name and data initial value. Different assembly languages ​​have different ways of defining data declarations, so the definition of data declarations is not specifically limited here. Defining the data declaration of the data before using it in the program helps improve the readability and maintainability of the code.

[0080] For example, “age=30” represents a data declaration that defines a data age whose data type is an integer type and whose initial value is 30.

[0081] Step S350: Create the test data according to the data declaration.

[0082] In the embodiment of the present application, since the data declaration includes the data type, data name and data initial value, the data declaration can be changed or directly used according to the fuzzy test requirements to create test data.

[0083] Exemplarily, the fuzzy test requirement is "test age is 50". In this case, "age=30" is changed to "age=50", and the test data is "age=50".

[0084] Step S360: Determine the logic calling sequence when the external software calls the external interface according to the control dependency.

[0085] In the embodiment of the present application, the control dependency relationship indicates the calling order when the external software calls the external interface, and the logical calling sequence is obtained according to the calling order.

[0086] For example, the external software calls external interface 1, external interface 2 and external interface 3. The control dependency relationship indicates that the external software first calls external interface 2, then calls external interface 1, and finally calls external interface 3. At this time, the corresponding logical calling sequence is {external interface 2, external interface 1, external interface 3}.

[0087] Step S370: According to the logic call sequence and the test data, and based on the template of the fuzzy test case, a fuzzy test case is generated for the external software to perform fuzz testing on the software to be tested.

[0088] In an embodiment of the present application, a logical call sequence provides a calling order for external software to call an external interface, and test data provides data for external software to call an external interface. The code body of the fuzzy test case is obtained according to the logical call sequence and the test data, and then the code body is automatically generated according to the fuzzy test case template to have a calling order and test data.

[0089] The method for generating fuzzy test cases provided in the embodiment of the present application first obtains the calling sequence between the external interfaces of the software to be tested according to the control flow information, then determines the data type and data entity of the data used when the external software calls the external interface of the software to be tested according to the dependency data obtained from the data flow information, and finally generates fuzzy test cases based on the template of the fuzzy test case according to the calling sequence and the data declaration created by the data type and the data entity, so that the generated fuzzy test cases are more accurate, and the fuzzy test cases are generated by using a unified template, which improves the readability and standardization of the fuzzy test case code.

[0090] See also Figure 4, which shows a structural block diagram of a fuzzy test case generation device 300 provided in an embodiment of the present application. The fuzzy test case generation device 300 uses the above-mentioned computer device, and the fuzzy test case generation device 300 includes: a data acquisition module 310, a target call list determination module 320, a call information determination module 330 and a fuzzy test case generation module 340, wherein the data acquisition module 310 is used to obtain the intermediate representation code of the external software corresponding to the software to be tested; the target call list determination module 320 is used to determine the target call list of the virtual function call point according to the virtual function call point corresponding to the external interface of the software to be tested in the intermediate representation code, wherein the target call list includes the interface information of the external interface called when the external software calls the software to be tested; the call information determination module 330 is used to determine the target call list of the virtual function call point according to the virtual function call point corresponding to the external interface of the software to be tested in the intermediate representation code, wherein the target call list includes the interface information of the external interface called when the external software calls the software to be tested; the call information determination module 34 ... Module 330 is used to determine the calling information of the software to be tested according to the target calling list and the data flow information and control flow information corresponding to the software to be tested, wherein the data flow information and the control flow information are determined based on the data access instructions and the control flow switching instructions in the intermediate representation code, and the calling information includes the dependency data when the external software in the information in the data flow calls the external interface of the software to be tested and the control dependency relationship of the external software calling the external interface of the software to be tested in the control flow information; the fuzzy test case generation module 340 is used to generate fuzzy test cases according to the calling information, and the fuzzy test cases are used to fuzz test the external software's call to the software to be tested.

[0091] In some embodiments, the target call list determination module 320 can be specifically used to obtain an interface call list corresponding to each of the virtual function call points in the intermediate representation code; based on the interface call list corresponding to each of the virtual function call points, determine the interface information of the external interface called when the external software calls the software to be tested; and determine the target call list based on the interface information.

[0092] In one possible implementation, the call information determination module 330 may be used to determine the data flow information and the control flow information based on the data access instructions and the control flow switching instructions in the intermediate representation code; determine the control dependency information between the external interfaces called by the external software according to the control flow information; determine the dependency data when the external software calls the external interface of the software to be tested according to the data flow information; and determine the call information corresponding to the software to be tested according to the control dependency information and the dependency data.

[0093] Optionally, the control flow information includes a control flow node graph, and the call information determination module 330 can also be used to obtain control dependency information between the external interfaces based on the connection relationship between the nodes corresponding to the external interfaces in the control flow node graph.

[0094] In some embodiments, the fuzzy test case generation module 340 can be specifically used to create the test data based on the dependency data; generate a fuzzy test case for the external software to perform fuzz testing on the software to be tested according to the control dependency information and the test data and based on the fuzzy test case template.

[0095] Optionally, the fuzzy test case generation module 340 can also be used to determine the logical call sequence when the external software calls the external interface according to the control dependency; based on the logical call sequence and test data, and based on the fuzzy test case template, generate a fuzzy test case for the external software to perform fuzz testing on the software to be tested.

[0096] In some implementations, the fuzzy test case generation module 340 may also be used to construct a data declaration corresponding to the dependent data according to the data type and data entity corresponding to the dependent data; and create the test data according to the data declaration.

[0097] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described devices and modules can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0098] In several embodiments provided in the present application, the coupling between modules may be electrical, mechanical or other forms of coupling.

[0099] In addition, each functional module in each embodiment of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software functional modules.

[0100] To summarize, the solution provided by the present application first obtains the intermediate representation code of the external software corresponding to the software to be tested, and then analyzes the virtual function call points in the intermediate representation code to obtain the target call list corresponding to the external interface of the software to be tested, and finally generates a fuzzy test case based on the target call list, the data flow information and control flow information corresponding to the software to be tested, and the template of the fuzzy test case. By analyzing the virtual function call points to generate the fuzzy test case, the analysis errors caused by directly analyzing the way the external software uses the software to be tested and the generation of abnormal fuzzy test cases are avoided, thereby improving the accuracy of the generation of fuzzy test cases.

[0101] Please refer to Figure 5 , which shows a structural block diagram of a computer device provided in an embodiment of the present application. The computer device 100 may be a computer device, a server device, a vehicle-mounted terminal, or other computer device capable of running an application. The computer device 100 in the present application may include one or more of the following components: a processor 110, a memory 120, and one or more applications, wherein the one or more applications may be stored in the memory 120 and configured to be executed by one or more processors 110, and the one or more applications are configured to execute the method described in the aforementioned method embodiment.

[0102] The processor 110 may include one or more processing cores. The processor 110 uses various interfaces and lines to connect various parts of the entire computer device 100, and executes various functions and processes data of the computer device 100 by running or executing instructions, programs, code sets or instruction sets stored in the memory 120, and calling data stored in the memory 120. Optionally, the processor 110 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 110 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 110, but may be implemented separately through a communication chip.

[0103] The memory 120 may include a random access memory (RAM) or a read-only memory (ROM). The memory 120 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 120 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc. The data storage area may also store data (such as a phone book, audio and video data, chat record data) created by the computer device 100 during use.

[0104] Please refer to Figure 6 , which shows a structural block diagram of a computer-readable storage medium provided in an embodiment of the present application. The computer-readable storage medium 200 stores program codes, which can be called by a processor to execute the method described in the above method embodiment.

[0105] The computer-readable storage medium 200 may be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk, or a ROM. Optionally, the computer-readable storage medium 200 includes a non-transitory computer-readable storage medium. The computer-readable storage medium 200 has storage space for program code 210 that performs any method steps of the above method. These program codes can be read from or written to one or more computer program products. The program code 210 can be compressed, for example, in an appropriate form.

[0106] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for generating a fuzzy test case, characterized in that: The method comprises: Obtaining the intermediate representation code of the external software corresponding to the software to be tested; Determine a target call list of the virtual function call points according to the virtual function call points corresponding to the external interface of the software to be tested in the intermediate representation code, wherein the target call list includes interface information of the external interface called when the external software calls the software to be tested; Determine the call information of the software to be tested according to the target call list and the data flow information and control flow information corresponding to the software to be tested, wherein the data flow information and the control flow information are determined based on the data access instructions and the control flow switching instructions in the intermediate representation code, and the call information includes the dependency data when the external software calls the external interface and the control dependency relationship information between the external interfaces called by the external software; A fuzzy test case is generated according to the calling information, and the fuzzy test case is used for fuzz testing the calling of the external software to the software to be tested.

2. The method according to claim 1, characterized in that The step of determining a target call list of the virtual function call points in the intermediate representation code corresponding to the external interface of the software to be tested comprises: Obtain an interface call list corresponding to each virtual function call point in the intermediate representation code; Based on the interface call list corresponding to each virtual function call point, determining the interface information of the external interface called when the external software calls the software to be tested; The target call list is determined according to the interface information.

3. The method according to claim 1, characterized in that: Determining the call information of the software to be tested according to the target call list and the data flow information and control flow information corresponding to the software to be tested includes: Determine the data flow information and the control flow information based on the data access instructions and the control flow switching instructions in the intermediate representation code; Determining control dependency relationship information between the external interfaces called by the external software according to the control flow information; Determining, according to the data flow information, dependency data when the external software calls the external interface of the software to be tested; Determine the call information corresponding to the software to be tested according to the control dependency information and the dependency data.

4. The method according to claim 3, characterized in that The control flow information includes a control flow node graph, and obtaining control dependency relationship information between the external software calling the external interface of the software to be tested according to the control flow information includes: Based on the connection relationship between the nodes corresponding to the external interfaces in the control flow node graph, control dependency information between the external interfaces is obtained.

5. The method according to any one of claims 1 to 4, characterized in that: The generating a fuzzy test case according to the call information includes: Based on the dependency data, create the test data; According to the control dependency information and the test data, and based on a template of the fuzzy test case, a fuzzy test case is generated for the external software to perform fuzz testing on the software to be tested.

6. The method according to claim 5, characterized in that The step of generating a fuzzy test case for the external software to perform fuzz testing on the software to be tested based on the control dependency information and the test data and the template of the fuzzy test case includes: Determining, according to the control dependency, a logical calling sequence when the external software calls the external interface; According to the logic call sequence and the test data, and based on the template of the fuzzy test case, a fuzzy test case is generated for the external software to perform fuzz testing on the software to be tested.

7. The method according to claim 5, characterized in that Before creating the test data based on the dependency data, the method further includes: Constructing a data declaration corresponding to the dependent data according to the data type and data entity corresponding to the dependent data; The test data is created according to the data declaration.

8. A device for generating fuzzy test cases, characterized in that: The device comprises: a data acquisition module, a target call list determination module, a call information determination module and a fuzzy test case generation module, wherein: The data acquisition module is used to acquire the intermediate representation code of the external software corresponding to the software to be tested; The target call list determination module is used to determine the target call list of the virtual function call point according to the virtual function call point corresponding to the external interface of the software to be tested in the intermediate representation code, wherein the target call list includes the interface information of the external interface called when the external software calls the software to be tested; The calling information determination module is used to determine the calling information of the software to be tested according to the target calling list and the data flow information and control flow information corresponding to the software to be tested, wherein the data flow information and the control flow information are determined based on the data access instructions and the control flow switching instructions in the intermediate representation code, and the calling information includes the dependency data when the external software in the information in the data flow calls the external interface of the software to be tested and the control dependency relationship when the external software calls the external interface of the software to be tested in the control flow information; The fuzzy test case generation module is used to generate a fuzzy test case according to the call information, and the fuzzy test case is used to fuzz test the call of the external software to the software to be tested.

9. A computer device, characterized in that: include: one or more processors; Memory; One or more application programs, wherein the one or more application programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores program codes, which can be called by a processor to execute the method according to any one of claims 1 to 7.

Images