ICST 2025
Mon 31 March - Fri 4 April 2025 Naples, Italy
Wed 2 Apr 2025 12:00 - 12:15 at Room A1 - Fuzzing and Security Chair(s): Serge Demeyer

We present the design of CompFuzzCI, a framework for incorporating compiler fuzzing into the continuous integration (CI) workflow of the compiler for Dafny, an opensource programming language that is increasingly used in and contributed to by industry. CompFuzzCI explores the idea of running a brief fuzzing campaign as part of the CI workflow of each pull request to a compiler project. Making this effective involved devising solutions for various challenges, including how to deduplicate bugs, how to bisect the project’s revision history to find the commit responsible for a regression (challenging when project interfaces change over time), and how to ensure that fuzz testing complements existing regression testing efforts. We explain how we have engaged with the Dafny development team at Amazon to approach these and other problems in the design of CompFuzzCI, and the lessons learned in the process. As a by-product of our work with CompFuzzCI, we found and reported three previously-unknown bugs in the Dafny compiler. We also present a controlled experiment simulating the use of CompFuzzCI over time on a range of Dafny commits, to assess its ability to find historic bugs. CompFuzzCI prioritises support for the Dafny compiler and the fuzz-d fuzzer but has a generalisable design: with modest modification to its internal interfaces, it could be adapted to work with other fuzzers, and the lessons learned from our experience will be relevant to teams considering including fuzzing in the CI of other industrial software projects.

Wed 2 Apr

Displayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change

11:00 - 12:30
Fuzzing and SecurityResearch Papers / Industry / Journal-First Papers at Room A1
Chair(s): Serge Demeyer University of Antwerp and Flanders Make vzw
11:00
15m
Talk
SPIDER: Fuzzing for Stateful Performance Issues in the ONOS Software-Defined Network Controller
Research Papers
Ao Li Carnegie Mellon University, Rohan Padhye Carnegie Mellon University, Vyas Sekar Carnegie Mellon University
11:15
15m
Talk
Mutation-based Fuzzing of the Swift Compiler With Incomplete Type Information
Research Papers
Sarah Canto Hyatt University of California, Santa Barbara, Kyle Dewey California State University, Northridge
11:30
15m
Talk
Scalable SMT Sampling for Floating-point Formulas via Coverage-guided Fuzzing
Research Papers
Manuel Carrasco Imperial College London, Cristian Cadar Imperial College London, Alastair F. Donaldson Imperial College London
11:45
15m
Talk
Introducing Black-Box Fuzz Testing for REST APIs in Industry: Challenges and Solutions
Industry
Andrea Arcuri Kristiania University College and Oslo Metropolitan University, Alexander Poth Volkswagen AG, Olsi Rrjolli Volkswagen AG
12:00
15m
Talk
Compiler Fuzzing in Continuous Integration: a Case Study on Dafny
Industry
Karnbongkot Boonriong Imperial College London, Stefan Zetzsche Amazon Web Services, Alastair F. Donaldson Imperial College London
12:15
15m
Talk
Automated SC-MCC Test Case Generation using Coverage Guided Fuzzing
Journal-First Papers
Golla Monika Rani , Sangharatna Godboley National Institute of Technology Warangal
:
:
:
: