{"id":"https://openalex.org/W4411552763","doi":"https://doi.org/10.1109/icse55347.2025.00239","title":"No Harness, No Problem: Oracle-guided Harnessing for Auto-generating C API Fuzzing Harnesses","display_name":"No Harness, No Problem: Oracle-guided Harnessing for Auto-generating C API Fuzzing Harnesses","publication_year":2025,"publication_date":"2025-04-26","ids":{"openalex":"https://openalex.org/W4411552763","doi":"https://doi.org/10.1109/icse55347.2025.00239"},"language":"en","primary_location":{"id":"doi:10.1109/icse55347.2025.00239","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icse55347.2025.00239","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE/ACM 47th International Conference on Software Engineering (ICSE)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5118596368","display_name":"Gabriel Sherman","orcid":null},"institutions":[{"id":"https://openalex.org/I223532165","display_name":"University of Utah","ror":"https://ror.org/03r0ha626","country_code":"US","type":"education","lineage":["https://openalex.org/I223532165"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Gabriel Sherman","raw_affiliation_strings":["University of Utah"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Utah","institution_ids":["https://openalex.org/I223532165"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5088758050","display_name":"Stefan Nagy","orcid":"https://orcid.org/0000-0003-0220-1706"},"institutions":[{"id":"https://openalex.org/I223532165","display_name":"University of Utah","ror":"https://ror.org/03r0ha626","country_code":"US","type":"education","lineage":["https://openalex.org/I223532165"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Stefan Nagy","raw_affiliation_strings":["University of Utah"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Utah","institution_ids":["https://openalex.org/I223532165"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I223532165"],"apc_list":null,"apc_paid":null,"fwci":5.9441,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":{"value":0.96281851,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":91,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"165","last_page":"177"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9921000003814697,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9921000003814697,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9900000095367432,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9896000027656555,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.9583755731582642},{"id":"https://openalex.org/keywords/oracle","display_name":"Oracle","score":0.8685246706008911},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7082409262657166},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.3146466612815857},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.14079007506370544}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.9583755731582642},{"id":"https://openalex.org/C55166926","wikidata":"https://www.wikidata.org/wiki/Q2892946","display_name":"Oracle","level":2,"score":0.8685246706008911},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7082409262657166},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.3146466612815857},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.14079007506370544}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/icse55347.2025.00239","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icse55347.2025.00239","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE/ACM 47th International Conference on Software Engineering (ICSE)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G6769771232","display_name":"CICI: TCR: Practical, Systematic Fuzz Testing for Securing Scientific Software","funder_award_id":"2419798","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":18,"referenced_works":["https://openalex.org/W2020841721","https://openalex.org/W2138110817","https://openalex.org/W2584230735","https://openalex.org/W2766647240","https://openalex.org/W2963298680","https://openalex.org/W2964241064","https://openalex.org/W3049735680","https://openalex.org/W3101845936","https://openalex.org/W3136127207","https://openalex.org/W3163844163","https://openalex.org/W4213078493","https://openalex.org/W4284694562","https://openalex.org/W4308632293","https://openalex.org/W4384163171","https://openalex.org/W4385187202","https://openalex.org/W4385301329","https://openalex.org/W4388857347","https://openalex.org/W4402265102"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2511770387","https://openalex.org/W3120811337","https://openalex.org/W2766647240","https://openalex.org/W4385301282","https://openalex.org/W2990186179","https://openalex.org/W4210660460","https://openalex.org/W3203597304"],"abstract_inverted_index":{"Library":[0],"APIs":[1,121,298],"are":[2,286,292],"used":[3],"by":[4,253,282,288],"virtually":[5],"every":[6],"modern":[7],"application":[8],"and":[9,59,106,177,189,227,237,262,269],"system,":[10],"making":[11,62],"them":[12,100],"among":[13],"today's":[14,231],"most":[15],"security-critical":[16],"software.":[17],"In":[18],"recent":[19,73],"years,":[20],"library":[21],"bug-finding":[22],"efforts":[23],"have":[24],"overwhelmingly":[25],"adopted":[26],"the":[27,154,277],"powerful":[28],"testing":[29],"strategy":[30],"of":[31,157,184,205,240,290],"coverage-guided":[32],"fuzzing.":[33,164],"At":[34,147],"its":[35,53],"core,":[36],"API":[37,47,97,143,170],"fuzzing":[38,56,84,109,144],"operates":[39],"on":[40],"harnesses:":[41],"wrapper":[42],"programs":[43],"that":[44],"initialize":[45],"an":[46],"before":[48],"feeding":[49],"random":[50],"inputs":[51],"to":[52,80,172],"functions.":[54],"Successful":[55],"demands":[57],"correct":[58,197],"thorough":[60],"harnesses,":[61,271],"manual":[63,158],"harnessing":[64,234],"challenging":[65],"without":[66,114],"sufficient":[67],"domain":[68],"expertise.":[69],"To":[70],"overcome":[71],"this,":[72],"strategies":[74],"propose":[75],"\u201clearning\u201d":[76],"libraries'":[77],"intended":[78],"usage":[79],"automatically":[81],"generate":[82],"their":[83,88,127,179],"harnesses.":[85],"Yet,":[86],"despite":[87],"high":[89,149],"code":[90,257],"coverage,":[91,258],"resulting":[92],"harnesses":[93,207,242,252,303],"frequently":[94],"miss":[95],"key":[96],"semantics-bringing":[98],"with":[99,110],"invalid,":[101],"unrealistic,":[102],"or":[103],"otherwise-impossible":[104],"data":[105],"call":[107],"sequences-derailing":[108],"false-positive":[111,274],"crashes.":[112,275],"Thus,":[113],"a":[115,138,148,182,202,223,238,254],"precise,":[116],"semantically-correct":[117,206],"harnessing,":[118],"many":[119,295],"critical":[120],"will":[122],"remain":[123],"beyond":[124],"fuzzing's":[125],"reach-leaving":[126],"hidden":[128],"vulnerabilities":[129,265,280],"ripe":[130],"for":[131,140,208],"attackers.":[132],"This":[133],"paper":[134],"introduces":[135],"Oracle-guided":[136,151,220],"Harnessing:":[137],"technique":[139],"fully-automatic,":[141],"semantics-aware":[142],"har-ness":[145],"synthesis.":[146],"level,":[150],"Harnessing":[152,221],"mimics":[153],"trial-and-error":[155],"process":[156],"harness":[159],"creation-yet":[160],"au-tomates":[161],"it":[162,229],"via":[163,181],"Specifically,":[165],"we":[166],"leverage":[167],"information":[168],"from":[169,243],"headers":[171],"mutationally":[173],"stitch-together":[174],"candidate":[175],"harnesses;":[176],"evaluate":[178,228],"validity":[180],"set":[183,204],"Correctness":[185],"Oracles:":[186],"compilation,":[187],"execution,":[188],"changes":[190],"in":[191,212,297],"coverage.":[192],"By":[193],"keeping-and":[194],"further":[195],"mutating-only":[196],"candidates,":[198],"our":[199],"approach":[200],"produces":[201],"diverse":[203],"complex,":[209],"real-world":[210,247],"libraries":[211],"as":[213,215,222],"little":[214],"one":[216],"hour.":[217],"We":[218],"integrate":[219],"prototype,":[224],"OG":[225],"HARN;":[226],"alongside":[230],"leading":[232],"fully-automatic":[233],"approach,":[235],"Hopper,":[236],"plethora":[239],"developer-written":[241,251,270],"OSS-Fuzz.":[244],"Across":[245],"20":[246],"APIs,":[248],"OGHARN":[249],"outperforms":[250],"median":[255],"14%":[256],"while":[259],"uncovering":[260],"31":[261],"30":[263],"more":[264],"than":[266],"both":[267],"Hopper":[268],"respectively-with":[272],"zero":[273],"Of":[276],"41":[278,285],"new":[279],"found":[281,296],"OGHARN,":[283],"all":[284],"confirmed":[287],"developers-40":[289],"which":[291],"since":[293],"fixed-with":[294],"that,":[299],"until":[300],"now,":[301],"lacked":[302],"whatsoever.":[304]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}