Strengthening the evolving software stack: from compiler fuzzing to patch testing
File(s)
Author(s)
Sharma, Arindam
Type
Thesis
Abstract
Modern software development hinges on the correctness and robustness of the software stack. Yet
as software evolves at an ever-accelerating pace, even minor flaws within the stack can introduce
pernicious bugs that slip through conventional quality-assurance pipelines.
This thesis presents techniques to bolster compiler reliability and automate patch testing at scale,
targeting two important components of the aforementioned stack. We begin by designing and
implementing GrayC, a novel mutation-based, greybox fuzzing system that integrates syntactic
and semantic program transformations to systematically explore deep parts of the compiler.
Unlike existing mutation-based approaches, GrayC guarantees the generation of well-formed
C programs that target deep compiler internals, uncovering subtle defects that evade purely
random or black-box mutators.
Building on this foundation, we introduce a unified patch-testing methodology comprising two
components: PaZZer, which accelerates reachability-guided fuzzing within continuous integration
pipelines by leveraging lightweight, incremental analyses; and P³ with patch specifications,
an automatic product program generator that merges pre- and post-patch code with patch
specifications to enable differential testing with off-the-shelf engines. Together, these tools
automate the analysis for a given code change.
The contributions of this thesis establish a practical, scalable path toward a more trustworthy
software stack with better compiler ecosystems and safer software evolution.
as software evolves at an ever-accelerating pace, even minor flaws within the stack can introduce
pernicious bugs that slip through conventional quality-assurance pipelines.
This thesis presents techniques to bolster compiler reliability and automate patch testing at scale,
targeting two important components of the aforementioned stack. We begin by designing and
implementing GrayC, a novel mutation-based, greybox fuzzing system that integrates syntactic
and semantic program transformations to systematically explore deep parts of the compiler.
Unlike existing mutation-based approaches, GrayC guarantees the generation of well-formed
C programs that target deep compiler internals, uncovering subtle defects that evade purely
random or black-box mutators.
Building on this foundation, we introduce a unified patch-testing methodology comprising two
components: PaZZer, which accelerates reachability-guided fuzzing within continuous integration
pipelines by leveraging lightweight, incremental analyses; and P³ with patch specifications,
an automatic product program generator that merges pre- and post-patch code with patch
specifications to enable differential testing with off-the-shelf engines. Together, these tools
automate the analysis for a given code change.
The contributions of this thesis establish a practical, scalable path toward a more trustworthy
software stack with better compiler ecosystems and safer software evolution.
Version
Open Access
Date Issued
2025-07-10
Date Awarded
2026-05-01
Copyright Statement
Attribution-NonCommercial 4.0 International Licence (CC BY-NC)
License URL
Advisor
Cadar, Cristian
Sponsor
European Research Council
Grant Number
819141
Publisher Department
Department of Computing
Publisher Institution
Imperial College London
Qualification Level
Doctoral
Qualification Name
Doctor of Philosophy (PhD)