Daisy: Effective Fuzz Driver Synthesis with Object Usage Sequence Analysis

Fuzzing is increasingly used in industrial settings for vulnerability detection due to its scalability and effectiveness. Libraries require driver programs to feed the fuzzer-generated inputs into library-provided interfaces. Writing such drivers manually is tedious and error-prone, thus greatly hindering the widespread use of fuzzing in practical situations. Previous attempts at automatic driver synthesis perform static analysis on the libraries and their consumers. However, a lack of dynamic object usage information renders them ineffective at generating interface function calls with correct parameters and meaningful sequences. This severely limits fuzzing's bug-finding capabilities and can produce faulty drivers.In this paper, we propose Daisy, a driver synthesis framework, which extracts dynamic object usage sequences of library consumers to synthesize significantly more effective drivers. Daisy uses the following two steps to synthesize a fuzz driver for a library. First, it models each object's behaviors into an object usage sequence during the execution of its consumers. Next, it merges all the extracted sequences and constructs a series of interface calls with valid object usages based on the merged sequence. We implemented Daisy and evaluated its effectiveness on real-world libraries selected from both the Android Open Source Project (AOSP) and Google's FuzzBench. Daisy's synthesized drivers significantly outperform drivers produced by other state-of-the-art fuzz driver synthesizers. In addition, on applying Daisy to the latest versions of those extensively-fuzzed real-world libraries of the benchmark, e.g. libaom and freetype2, we also found 9 previously-unknown bugs with 3 CVEs assigned.