Memory safety bugs are major threats to software because they occupy 65%-70% of severe security bugs. Consequently, researchers have introduced directed fuzzers and directed coverage-guided fuzzers, which can target memory safety bugs. However, they waste much time testing uninteresting code that may not contain memory safety bugs. In this paper, we propose Slicer, a program slicing technique, to accelerate directed fuzzing targeting memory safety bugs. The key idea is to remove as many code snippets irrelevant to memory safety bugs from target programs as possible to minimize uninteresting code execution. For that, Slicer first identifies and keeps the code snippets, such as memory access code, memory management code (e.g., malloc), and relevant control flow statements, that potentially violate memory safety. Next, Slicer identifies and keeps extra code snippets, such as program initialization code, that are required to run programs. Finally, Slicer removes the other code snippets. This approach is beneficial to directed fuzzers when they target memory safety bugs because Slicer can improve performance orthogonal to the points that directed fuzzers improve. We evaluate Slicer with 24 programs and found ten new bugs with seven CVEs. Furthermore, Slicer accelerates program execution speed 1.61× faster. Moreover, Slicer shows 1.52× improved testing coverage for code relevant to memory safety bugs when integrated with directed coverage-guided and coverage-guided fuzzers, ParmeSan and Darwin. Finally, integrating Slicer with three directed fuzzers, AFLGo, WindRanger, and SelectFuzz shows 1.64× faster memory safety bug discovery than those fuzzers without Slicer.

Data Distribution Service (DDS) is a distributed network protocol widely used in cyber-physical systems. DDS provides flexible configurations defined in the formal design specification for safety and security. However, DDS programs suffer from both semantic bugs violating design specifications and software implementation bugs. To discover bugs, network protocol fuzzers have focused on testing client-server models by mutating input packets. However, they are unsuitable for fuzzing DDS programs due to a lack of consideration of the DDS-specific features, such as the DDS-specific input spaces (e.g., dynamic network topology formation and QoS and DDS security configurations) and impacts of DDS-specific semantic bugs (e.g., incorrect topology construction).