TLDR Tech / InfoSec
On the Effectiveness of Mutational Grammar Fuzzing
Google Project Zero's Ivan Fratric identifies two core weaknesses in coverage-guided grammar fuzzing: coverage metrics fail to reward chained function call sequences needed to trigger complex bugs, and greedy corpus saving produces low-diversity sample sets that converge toward similar inputs. Fratric counters both issues with a periodic worker-restart strategy, in which each worker builds an independent corpus for T seconds before syncing with a shared server, alternating between generative and mutational phases. Experiments against libxslt showed that this approach uncovered up to 9 unique crashes, compared with 2-5 in continuous single-worker sessions, with T=3600 seconds proving optimal for that target.
Read the full story