Fuzzing the PHP Interpreter via Dataflow Fusion
summary
FlowFusion is an automatic fuzzer that implements dataflow fusion by merging PHPT seed programs’ definitions and uses to create new, semantically richer tests; it adds recursive fusion plus mutations, interface fuzzing, environment crossover, and uses ASAN/UBSAN for oracles. Running nightly on PHP, it finds 158 unknown bugs (125 fixed, 11 confirmed), modifies >5,000 source lines, and outperforms AFL++ and Polyglot (24% more lines covered after 24 hours); FlowFusion is now integrated into the official PHP toolchain.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:19Research question and challenges
- 3:04Input fusion for semantics
- 4:52Data flow fusion explained
- 7:25Flow Fusion setup
- 9:53Complementary fuzzing strategies
- 10:13Bug findings and impact
- 11:21Comparison with existing methods
- 12:45ProFusion's impact and integration
- 13:50Summary and future work
related talks
38mWhat The PHUZZ?! Finding 0-Days In PHP Apps wt Coverage-guided Fuzzing
01h 15mMake your programs more reliable with Fuzzing
31m“Fuzz or lose..."
39mMaking Fuzzing Part of Your Software Development Lifecycle
53mFuzzing 101
53mFuzz Testing for Fun and Profit
01h 00mClusterFuzz: Fuzzing at Google Scale
36mAutomated fuzz testing of closed source applications based on the code coverage