AceCov: Auxiliary Composite Edge Coverage for Fuzzing

Security flaws in software, including bugs and vulnerabilities, can cause serious issues, and fuzzing has been extensively studied and employed to identify them. A typical fuzzer automatically generates test inputs and feeds back information obtained from executed programs for efficient software verification. As the feedback information, edge coverage, which is based on edge traversals in a control flow graph, is widely used. We focus on branches whose results change depending on the traversal of a particular edge in the control flow graph. In particular, we found that when a branch depends on a combination of multiple edge traversals, it is difficult for existing edge coverage to cover the branch outcome. Based on this observation, we propose a novel coverage metric for such branches: auxiliary composite-edge coverage (AceCov). AceCov works together with existing edge coverage to provide an auxiliary coverage metric only for branches such as the one described above, where the edge coverage does not cover the result. We implemented AceCov in AFL++ and evaluated it using FuzzBench and MAGMA. The evaluation results show a performance improvement of up to 3.36% and an average improvement of 1.19% over AFL++. We also identified four bugs that AFL++ failed to find.