Improving Multitasking DBMS Fuzzing With More Accurate Coverage and Testcase Trimming

Coverage-guided fuzzing is prevalent in detecting DBMS (Database Management System) bugs. However, current coverage-guided DBMS fuzzers suffer from two limitations that prevent fuzzers from discovering bugs efficiently. First, the coverage feedback is imprecise which prevents fuzzers from making optimal decisions on fuzzing strategies. Second, DBMS fuzzers lack testcase trimming to control the increasing input sizes. The large input size makes DBMS execution slower and reduces the likelihood that a mutation would touch important structures. In this paper, we proposed corresponding methods to overcome these limitations. Specifically, the work-task coverage tracking and unstable edge filtering improve the coverage accuracy with low instrumentation overhead. Based on more accurate coverage, we further propose testcase trimming to improve the speed of bug detection. We implemented a prototype named Tuzz and evaluated it on three popular DBMSs. The evaluation result shows that Tuzz explores 16.3%, 26.1%, and 26.6% more edges than the state-of-the-art fuzzer in PostgreSQL, MySQL, and MariaDB, respectively. More importantly, Tuzz has discovered 10 and 4 previously unknown bugs in MySQL and MariaDB.