Journal
PROCEEDINGS OF THE 28TH ACM SIGSOFT INTERNATIONAL SYMPOSIUM ON SOFTWARE TESTING AND ANALYSIS (ISSTA '19)
Volume -, Issue -, Pages 398-401Publisher
ASSOC COMPUTING MACHINERY
DOI: 10.1145/3293882.3339002
Keywords
Coverage-guided fuzzing; property-based testing; QuickCheck
Funding
- Samsung
- NSF [CCF-1409872, CNS-1817122]
- Futurewei
Ask authors/readers for more resources
We present JQF, a platform for performing coverage-guided fuzz testing in Java. JQF is designed both for practitioners,who wish to find bugs in Java programs, as well as for researchers,who wish to implement new fuzzing algorithms. Practitioners write QuickCheck-style test methods that take inputs as formal parameters. JQF instruments the test program's bytecode and continuously executes tests using inputs that are generated in a coverage-guided fuzzing loop. JQF's input-generation mechanism is extensible. Researchers can implement custom fuzzing algorithms by extending JQF's Guidance interface. A Guidance instance responds to code coverage events generated during the execution of a test case, such as function calls and conditional jumps, and provides the next input. We describe several guidances that currently ship with JQF, such as: semantic fuzzing with Zest, binary fuzzing with AFL, and complexity fuzzing with Perffuzz. JQF is a mature tool that is open-source and publicly available. At the time of writing, JQF has been successful in discovering 42 previously unknown bugs in widely used open-source software such as OpenJDK, Apache Commons, and the Google Closure Compiler.
Authors
I am an author on this paper
Click your name to claim this paper and add it to your profile.
Reviews
Recommended
No Data Available