Modern software systems evolve through frequent commits that implement bug fixes, features, and security patches. Although code review and testing are widely used to check these changes, they often provide limited assurance for memory-safety issues. Code reviewers may miss subtle boundary, lifetime, or initialization errors, while existing tests may not exercise the specific paths affected by a commit. Fuzzing is effective at exposing such bugs, but applying it to every commit remains impractical because whole-program fuzzing is expensive, requires suitable harnesses, and may still fail to reach the code changed by a commit. In this paper, we introduce COMMITGUARD, a commit-aware differential slice-based fuzzing approach for verifying code changes. The key insight behind COMMITGUARD is that the pre-commit version of a modified function can serve as a behavioral baseline for interpreting bugs found after the commit. For each target commit, COMMITGUARD identifies modified functions, extracts compilable code slices from both the pre-commit and post-commit versions, and fuzzes the paired slices independently. It then compares sanitizer reports across the two versions and reports bugs that emerge only in the post-commit version as candidate commit-induced bugs. We evaluate COMMITGUARD on 300 commits from openSSL, libpcap and leptonica. Slice fuzzing initially produces 518 sanitizer reports across these commits. By comparing pre-commit and post-commit slices, COMMITGUARD narrows this large output to 7 candidate commit-induced bug reports that require manual triage. Manual validation confirms 5 of these reports as real bugs that were fixed by developers of the examined projects after we reported them, while only 2 reports were classified as false positives. COMMITGUARD analyzes a commit in 32.4 minutes on average and achieves 75.36% average coverage of modified functions.
This work presents CodeMechanic, a bug-property-guided system for generating constrained mit- igations for spatial memory corruption that combines a two-dimensional static and dynamic context extractor with in-prompt debugging knowledge and stepwise val- idation to limit the effect of LLM errors.
Han Zheng, Rafaila Galanopoulou, Ilia Shumailov et al.· 0 citations
Modern software systems are increasingly complex, and static analysis tools are commonly used to identify potentially vulnerable code by issuing warnings. However, these warnings often require manual inspection to confirm whether the reported issues are real, making the process time-consuming and error-prone. Directed fuzzing has emerged as a powerful automated technique to validate the warnings. However, applying it to the entire project in response to each warning is computationally infeasible, often requiring days of execution to achieve only incremental improvements in code coverage. We present SNIPTEST, an execution-based warning triage framework that generates and fuzzes compiled code slices centered around static-analysis warnings. Rather than proving exploitability in the full program, SNIPTEST provides evidence about how a warning behaves under progressively expanded sliced execution contexts. It employs a layer-by-layer slicing strategy, incrementally expanding context around the target location to validate potential vulnerabilities with increasing precision. We evaluate SNIPTEST on a benchmark of 97 true vulnerabilities and 97 false alarms across three real-world projects. SNIPTEST produces Possible True Positive evidence for 53 of 97 confirmed vulnerabilities (54.6%) by triggering the corresponding bug oracle consistently across all three analyzed slice levels, while the remaining cases are unreachable. Particularly, in 40.2% of these cases, it exploits the vulnerability along the observed execution path, matching the top three stack frames. On the 97 confirmed false alarms, SNIPTEST produces Possible False Positive evidence for 54 cases (55.6%) by reaching the warning without triggering the bug oracle, but misclassifies 28 cases (28.8%),and the remaining cases are unreached. Finally, we demonstrate the practical relevance of SNIPTEST by identifying CVE-2025-11964.
Aniruddhan Murali, N. Mathews, Mahmoud Alfadel et al.· IEEE Transactions on Softwar...· 0 citations
SemaDiff, a novel approach for identifying semantic-preserving commits through behaviour-based analysis, is proposed, and results show that SemaDiff distinguishes accurately semantic-preserving from -- changing commits in about 76% of the cases, with a 100% precision in semantic-changing commit detection.
Maha Ayub, Michael Konstantinou, Ahmed Khanfir et al.· 0 citations
Manually writing unit tests to uncover functional bugs in software libraries is not only time-consuming but also requires a deep understanding of the intended semantics of the APIs. Heuristic-based test generation methods suffer from low usability because they cannot reason about program semantics or interpret source code and documentation as humans do. Traditional fuzzing techniques like OSS-Fuzz often rely on crashes to detect bugs, but functional bugs do not always cause crashes. To overcome these limitations, we present LISA, a novel LLM-based invariant testing framework for software functional bugs. LISA iteratively generates API sequences and program invariants guided by API n-gram feedback, achieving higher bug-detection rates and competitive code coverage compared with both fuzzing and prior LLM-based test generation approaches, and reporting each finding as a high-confidence bug candidate for developer confirmation.
Ruogu Yang, Yifeng He, Yundi Xu et al.· 0 citations
This work proposes BreakGuard, an approach that generates a test suite to detect breaking changes in clients and successfully detected BCs from different library categories, but finds LLM-generated tests to be more reliable for detecting crash-type breaking changes as opposed to behavioural BCs.
Rachna Raj, Benoit Baudry, Diego Elias Costa· 0 citations
In recent years, code-reuse attacks (CRA) have become increasingly stealthy and destructive to modern software systems. However, existing control-flow integrity techniques mainly focus on control-flow paths and give limited consideration to the program’s overall execution state. To address this problem, we propose StackPatroller, a stack-integrity-based runtime supervision framework that enforces program integrity through configurable policies. Specifically, StackPatroller monitors runtime stack contexts to detect early deviations from normal execution, enabling the identification of whole-function reuse (including return-to-libc) and certain forward-edge attacks earlier—within user mode before any unintended system calls occur. Compared to previous approaches, StackPatroller leverages the program stack as a structured and predictable representation of execution state. This provides a reliable indicator for early anomaly detection during CRA and eliminates the need for specialized hardware support. To validate our approach, we implement a prototype of StackPatroller and evaluate it on representative real-world software samples. The evaluation results show that our prototype can effectively detect CRA with an average performance overhead of 7.8%.
Yuanheng Xu, Siyu Zhang, Juan Wang et al.· Journal of computing and sec...· 0 citations