FuZZan: Efficient Sanitizer Metadata Design for Fuzzing
summary
FuZZan replaces ASan’s heavy shadow memory with two compact metadata layouts (mean-shadow and arbitrary metadata), adds a runtime dynamic metadata switching sampler that profiles metadata access and picks the best layout, and removes ASan’s logging/initialization during fuzzing. Applied to AddressSanitizer, FuZZan improves fuzzing throughput by 48% (52% with empty seeds), finds 13% more unique paths in 24 hours and discovers bugs 42% faster, while preserving ASan’s detection capability (no loss of bug reporting).
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:29Sanitizer: Debug Policy Violations
- 6:05Fuzzan Design
- 7:45ASan Memory Mapping
- 8:15Min-shadow Memory Mapping
- 10:26Sampling Mode
- 10:58Initialization/Logging Overhead
- 12:14Detection Capability
- 12:51Metadata Structure Performance
- 14:17Performance Optimizations
- 15:37Dynamic Switching Performance
- 16:56Performance Overhead Analysis
- 18:19Bug Finding Speed Testing
- 19:14Real-world Fuzz Testing
related talks
53mFuzzing 101
25mHow fuzzing helps to find bugs
59mBeyond Sanitizers...
24mWhy you should be using automated fuzzing to test for security issues in your code
16mSEMSAN: a Configurable Sanitizer for Detecting System-Level Semantic Bugs
01h 15mMake your programs more reliable with Fuzzing
31m“Fuzz or lose..."
50mC++ Sanitizers & Fuzzing for the Windows Platform Using New Compilers...