![](https://csdnimg.cn/release/download_crawler_static/15740490/bg2.jpg)
2 Y. Kun et al.
lie in tho se dependencies are also shared. Bugs in fundamental libraries may have
higher impact than bugs in code that is not shared. Designing new techniques
for automatically finding hidden flaws in those fundamental dependencies now
bec ome important task, especially the bugs that are reachable in upper level
applications.
Our research focus on a mature, widely us e d libraries named ICU [10]. ICU is
short for Inter national C ompo nents for Unicode, providing Unicode and Glob-
alization support for so ftware applications. ICU is widely portable and gives
applications the same results on all platforms and between C/C++ and Java
software. IC U library is used everywhere, including document processing soft-
ware like OpenOffice and LibreOffice, browsers like Chrome, Safa ri and Firefox,
operating systems like Android, macOS, iOS, Windows and Linux. ICU is inte-
grated as a fundamental component through high level APIs in var ious software
stack. Only security flaws in ICU that is r e achable from the input through API
calls could result in security impact. So our methodology is designed for finding
bugs in ICU that is triggerable fr om the entry point of application software.
Fuzzing is a widely used technique to detect vulnerabilities in software. We
designed a fuzzing based method to effectively find exploitable bugs in ICU
libraries. In our method, we will do a in-depth analysis on the connection between
target s oftware and ICU librar y. Target software mostly use part o f APIs from
ICU, and does some parameter filtering before invoking. So the analysis result
will help us infer the input generation rules for fuzzing, so that we can get rid
of useless mutations as many as possible while fuzzing. Moreover, we combine
covera ge-guided fuzzing technique to improve the code coverage.
Evaluation. To evaluate the effective ness of o ur design. We implemented a pro-
totype ICUFuzzer to detect v ulnerabilities in ICU that can be trig gered from
browsers’ JavaScript engine. We have studied how the browsers implement EC-
MAScript Internationalization API with the underlying support of ICU and
figured out how parameters are passed from the ECMAScript API to low level
ICU functions, and how the browsers filter them for security concerns. With
our findings, we developed a dedicated input generation engine inside the fuzzer
which produces inputs that can bypass the filter s. With our methodology, we
significantly improve the effectiveness of fuzzing and quickly find three zer o-day
bugs, 2 of them can be triggered in Chrome and 1 can be triggered in Chrome,
Safari, and Firefox.
Contribution. This paper makes the following contributions:
– We are the first to conduct fuzzing research on ICU library.
– We designed a fuzzer for finding bugs in ICU that is reachable from a pplica-
tion software. By analyzing the data flow from the input in target application
to the arguments passed down to ICU, we turn fuzzing target applications
into fuzzing ICU directly to a chieve better performance and keep zero false
positive at the same time. Coverage guided fuzzing technique is also applied
here to further improve the code coverage.