Improving Fuzzing Coverage with Execution Path Length Selection

Abstract

Coverage-guided fuzzing is one of the most effective types of fuzz testing. Code coverage is an important parameter of performance evaluation of the coverage-guided fuzzing tools since normally higher coverage result means a higher chance of fault detection. To expand the overall code covered, based on previous basic block analysis, we propose a method for selecting the mutants of inputs that are able to execute some specific length of the execution path.