SQLynx: Towards Generic Mutation-Based Fuzzing for DBMSs Across Diverse Dialects
DBMSs play a critical role in modern software ecosystems, but their increasing complexity inevitably leads to bugs. DBMS fuzzing has proven highly effective in uncovering bugs in DBMSs. However, the diversity of SQL dialects requires extensive manual adaptation to accommodate various grammar features. Moreover, such adaptations limit fuzzing to a narrow range of grammar features, leaving many bugs undetected. In this paper, we propose SQLynx, a mutation-based DBMS fuzzer aiming at generic fuzzing across dialects with generic mutation and dynamic instantiation. The generic mutation reconstructs SQL statements based on a SQL structure corpus, enabling dialect-independent generation of diverse grammar structures. The dynamic instantiation leverages schema information from the target database to instantiate semantically valid statements. We implement SQLynx and evaluate it on six widely used DBMSs, including MySQL and PostgreSQL. Adapting these DBMSs with SQLynx required 1,094 lines of code in total, which is fewer than existing fuzzers. Compared with state-of-the-art DBMS fuzzers Sqirrel, BuzzBee, Lego, and SQLsmith, SQLynx covered 34%, 153%, 66%, and 41% more branches, and triggered 8, 10, 7, 10 more bugs in 24 hours, respectively, demonstrating its effectiveness.
Thu 9 JulDisplayed time zone: Eastern Time (US & Canada) change
10:30 - 12:30 | |||
10:30 20mTalk | CuFuzz: An API-Knowledge-Graph Coverage-Driven Fuzzing Framework for CUDA Libraries Research Papers Ximing Fan School of cyber science and engineering, Sichuan University, China, Yong Fang Sichuan University, Peng Jia Sichuan University, Yang Liu Nanyang Technological University, Yijia Xu Sichuan University, Xi Peng Huawei Theory Lab, Yuhao Zhou Fudan University | ||
10:50 20mTalk | SQLiFuzz: Uncovering SQL Injection in Any Web Applications Research Papers I Putu Arya Dharmaadi University of Groningen, Thuan Pham University of Melbourne, Fadi Mohsen University of Groningen, Fatih Turkmen University of Groningen Link to publication | ||
11:10 20mTalk | Reducing Coverage-Equivalent Inputs in Grammar-based Fuzzing by Avoiding Recurrent Rule Sequences Research Papers Jaehan Yoon Sungkyunkwan University, Yunji Seo Korea University, Hakjoo Oh Korea University, Sooyoung Cha Sungkyunkwan University Pre-print | ||
11:30 10mTalk | CapCo: Automating Carla-Apollo Co-Simulation and Scenario Fuzzing Tool Demonstrations Xiaodong Zhang University of Chinese Academy of Science, Songyang Yan Xi'an Jiaotong University, Ming Fan Xi'an Jiaotong University, Zijiang Yang University of Science and Technology of China and Synkrotron, Inc. | ||
11:40 10mTalk | SQLynx: Towards Generic Mutation-Based Fuzzing for DBMSs Across Diverse Dialects Tool Demonstrations Runpei Miao SKLCCSE Lab, Beihang University, Jie Liang Beihang University, Zhiyong Wu Tsinghua University, China, Jingzhou Fu School of Software, Tsinghua University, Yu Jiang Tsinghua University, Shuai Ma SKLCCSE Lab, Beihang University | ||
11:50 10mTalk | A Practical Fuzzer for the Python Runtime System Tool Demonstrations Link to publication Pre-print | ||
12:00 10mTalk | Shark2Pit: Automated Test Template Generation for Protocol Fuzzing Based on Packet Parser Tool Demonstrations Yulai Fu , Yuanliang Chen Tsinghua University, Fuchen Ma Tsinghua University, Changjian Liu Central South University, Wanli Chen Central South University, Dalong Shi AVIC International Digital Network Technology Co., Ltd., Qiang Fu Central South University, Heyuan Shi Central South University | ||