Directed fuzzing based on path constraints and deviation path correction

Directed fuzzing targets specific parts of a program and is particularly useful for tasks like PoC verification, crash reproduction, and patch testing. It uses static analysis to guide the fuzzing process. However, it still faces two significant challenges that affect its efficiency. They overlook whether the code region is related to the target location, causing excessive computational power to be wasted on calculating distances for irrelevant regions and hindering precise distance calculation. Additionally, the reliance on random mutations during test case generation results in new cases that are mostly unreachable to the target location. Therefore, we propose PathFuzz, a fuzzer that employs a distance calculation method constrained by the target path and a directed mutation method for the bytes that cause deviation from the target path. We first identified code regions related to the target location and calculated finer-grained basic block distances within these regions. Next, through taint analysis, we map program input bytes to the basic blocks that process them. We then perform directed mutations, adjusting the input bytes corresponding to the basic blocks that deviate from the target execution path to guide it back on track. We evaluated PathFuzz on Magma dataset, and experiments show that compared to several SOTA directed fuzzers, PathFuzz is on average 17.85 times, 2.47 times, 17.61 times, and 4.85 times faster, respectively, and it can trigger four vulnerabilities that other tools cannot within the specified time.