Search papers, labs, and topics across Lattice.
This paper introduces SynapseFlow, an automatic harness generator that enhances gray-box fuzzing by addressing the limitations of existing one-turn generation methods, which often suffer from hallucinations and inadequate coverage. By employing dataflow-aware function aggregation and a staged, rollback-enabled generation workflow decomposition, SynapseFlow constructs Structural Flow Graphs and synthesizes harnesses through a rigorous four-stage process. Evaluation on 25 real-world open-source software projects shows that SynapseFlow significantly outperforms state-of-the-art tools in branch coverage and bug detection, uncovering seven previously unreported bugs, including five with assigned CVEs.
SynapseFlow achieves over 4x higher branch coverage and uncovers critical bugs that other tools miss, revolutionizing fuzz harness generation.
High-quality fuzz harnesses are essential for effective gray-box fuzzing. While Large Language Models (LLMs) offer promise for automating this task, existing one-turn generation methods suffer from hallucinations and inadequate coverage due to coarse-grained function targeting and misaligned generation workflows. We present SynapseFlow, an automatic harness generator that addresses these limitations through two key innovations: dataflow-aware function aggregation and a staged, rollback-enabled generation workflow decomposition. SynapseFlow first analyzes source code to construct Structural Flow Graphs and extract coherent Function Triplets. It then synthesizes harnesses via a decomposed four-stage process governed by a staged rollback algorithm to ensure correctness. We evaluated SynapseFlow on 25 real-world open-source software projects. The experimental results indicate that SynapseFlow outperforms state-of-the-art tools (OSS-Fuzz-Gen, CKGFuzzer, PromeFuzz), achieving 3.07$\times$, 1.71$\times$, and 4.26$\times$ higher branch coverage, and 1.77$\times$, 1.51$\times$, and 1.36$\times$ higher bug detection rates, respectively. Most importantly, SynapseFlow discovered 7 previously unreported bugs (5 assigned CVEs), demonstrating its practical effectiveness in real-world bug discovery.
