Dowsing for overflows: a guided fuzzer to find buffer boundary violations

摘要: Dowser is a 'guided' fuzzer that combines taint tracking, program analysis and symbolic execution to find buffer overflow underflow vulnerabilities buried deep in program's logic. The key idea of lets us pinpoint the right areas code probe appropriate inputs do so. Intuitively, for typical overflows, we need consider only accesses an array loop, rather than all possible instructions program. After finding such candidate sets instructions, rank them according estimation how likely they are contain interesting vulnerabilities. We then subject most promising further testing. Specifically, first use determine which input bytes influence index execute symbolically, making this set symbolic. By constantly steering along branch outcomes lead were able detect bugs real programs (like nginx webserver, inspircd IRC server, ffmpeg videoplayer). Two found previously undocumented overflows poppler PDF rendering library.