{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T15:43:08Z","timestamp":1785512588151,"version":"3.56.0"},"publisher-location":"New York, NY, USA","reference-count":48,"publisher":"ACM","license":[{"start":{"date-parts":[[2020,6,27]],"date-time":"2020-06-27T00:00:00Z","timestamp":1593216000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2020,6,27]]},"DOI":"10.1145\/3377811.3380386","type":"proceedings-article","created":{"date-parts":[[2020,10,1]],"date-time":"2020-10-01T18:25:38Z","timestamp":1601576738000},"page":"999-1010","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":80,"title":["Typestate-guided fuzzer for discovering use-after-free vulnerabilities"],"prefix":"10.1145","author":[{"given":"Haijun","family":"Wang","sequence":"first","affiliation":[{"name":"Shenzhen University, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaofei","family":"Xie","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yi","family":"Li","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Cheng","family":"Wen","sequence":"additional","affiliation":[{"name":"CSSE, Shenzhen University, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yuekang","family":"Li","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yang","family":"Liu","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Singapore and Zhejiang Sci-Tech University, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shengchao","family":"Qin","sequence":"additional","affiliation":[{"name":"SCEDT, Teesside University, UK and CSSE, Shenzhen University, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hongxu","family":"Chen","sequence":"additional","affiliation":[{"name":"Nanyang Technological University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yulei","family":"Sui","sequence":"additional","affiliation":[{"name":"University of Technology Sydney, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2020,10]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"REDQUEEN: Fuzzing with Input-to-State Correspondence. In 26th Annual Network and Distributed System Security Symposium (NDSS'19)","author":"Aschermann Cornelius","year":"2019","unstructured":"Cornelius Aschermann, Sergej Schumilo, Tim Blazytko, Robert Gawlik, and Thorsten Holz. 2019. REDQUEEN: Fuzzing with Input-to-State Correspondence. In 26th Annual Network and Distributed System Security Symposium (NDSS'19). The Internet Society, San Diego, CA USA, 1--15."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/2635868.2635916"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134020"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978428"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/2338965.2336769"},{"key":"e_1_3_2_1_6_1","volume-title":"Extensible Fuzzing Framework (FSE '18 tool demo).","author":"Chen Hongxu","year":"2018","unstructured":"Hongxu Chen, Yuekang Li, Bihuan Chen, Yinxing Xue, and Yang Liu. 2018. FOT: A Versatile, Configurable, Extensible Fuzzing Framework (FSE '18 tool demo)."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/2103799.2103805"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243849"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00046"},{"key":"e_1_3_2_1_10_1","volume-title":"SAVIOR: Towards Bug-Driven Hybrid Testing. In 2020 IEEE Symposium on Security and Privacy. IEEE.","author":"Chen Yaohui","year":"2020","unstructured":"Yaohui Chen, Peng Li, Jun Xu, Shengjian Guo, Rundong Zhou, Yulong Zhang Zhang, Tao Wei, and Long Lu. 2020. SAVIOR: Towards Bug-Driven Hybrid Testing. In 2020 IEEE Symposium on Security and Privacy. IEEE."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813671"},{"key":"e_1_3_2_1_12_1","volume-title":"USENIX Security Symposium","volume":"98","author":"Cowan Crispan","year":"1998","unstructured":"Crispan Cowan, Calton Pu, Dave Maier, Jonathan Walpole, Peat Bakke, Steve Beattie, Aaron Grier, Perry Wagle, Qian Zhang, and Heather Hinton. 1998. Stackguard: Automatic adaptive detection and prevention of buffer-overflow attacks.. In USENIX Security Symposium, Vol. 98. San Antonio, TX, 63--78."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-21690-4_19"},{"key":"e_1_3_2_1_14_1","volume-title":"Typestate Verification: Abstraction Techniques and Complexity Results","author":"Field John","year":"2003","unstructured":"John Field, Deepak Goyal, G. Ramalingam, and Eran Yahav. 2003. Typestate Verification: Abstraction Techniques and Complexity Results. In Static Analysis, Radhia Cousot (Ed.). Springer Berlin Heidelberg, Berlin, Heidelberg, 439--462."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/1146238.1146254"},{"key":"e_1_3_2_1_16_1","volume-title":"CollAFL: Path Sensitive Fuzzing. In 2018 IEEE Symposium on Security and Privacy. IEEE Press, 1--12","author":"Gan Shuitao","year":"2018","unstructured":"Shuitao Gan, Chao Zhang, Xiaojun Qin, Xuwen Tu, Kang Li, Zhongyu Pei, and Zuoning Chen. 2018. CollAFL: Path Sensitive Fuzzing. In 2018 IEEE Symposium on Security and Privacy. IEEE Press, 1--12."},{"key":"e_1_3_2_1_17_1","unstructured":"Google Inc. 2019. ClusterFuzz. https:\/\/google.github.io\/clusterfuzz\/"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243804"},{"key":"e_1_3_2_1_19_1","volume-title":"Preventing Use-after-free with Dangling Pointers Nullification. In 22nd Annual Network and Distributed System Security Symposium.","author":"Lee Byoungyoung","year":"2015","unstructured":"Byoungyoung Lee, Chengyu Song, Yeongjin Jang, Tielei Wang, Taesoo Kim, Long Lu, and Wenke Lee. 2015. Preventing Use-after-free with Dangling Pointers Nullification. In 22nd Annual Network and Distributed System Security Symposium."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3213846.3213874"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3238147.3238176"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/3106237.3106295"},{"key":"e_1_3_2_1_23_1","unstructured":"Yuekang Li Yinxing Xue Hongxu Chen Xiuheng Wu Cen Zhang Xiaofei Xie Haijun Wang and Yang Liu. 2019. Cerebro: Context-aware Adaptive Fuzzing for Effective Vulnerability Detection. In 27th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering. Tallinn Estonia."},{"key":"e_1_3_2_1_24_1","unstructured":"LLVM. 2015. libFuzzer. https:\/\/llvm.org\/docs\/LibFuzzer.html"},{"key":"e_1_3_2_1_25_1","volume-title":"MOpt: Optimized Mutation Scheduling for Fuzzers. In 28th USENIX Security Symposium. 1949--1966","author":"Lyu Chenyang","year":"2019","unstructured":"Chenyang Lyu, Shouling Ji, Chao Zhang, Yuwei Li, Wei-Han Lee, Yu Song, and Raheem Beyah. 2019. MOpt: Optimized Mutation Scheduling for Fuzzers. In 28th USENIX Security Symposium. 1949--1966."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/1571629.1571631"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134073"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"crossref","unstructured":"Sanjay Rawat Vivek Jain Ashish Kumar Lucian Cojocar Cristiano Giuffrida and Herbert Bos. 2017. VUzzer: Application-aware Evolutionary Fuzzing. In NDSS. https:\/\/www.vusec.net\/download\/?t=papers\/vuzzer_ndss17.pdf","DOI":"10.14722\/ndss.2017.23404"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66332-6_2"},{"key":"e_1_3_2_1_30_1","volume-title":"Pinpoint: Fast and precise sparse value flow analysis for million lines of code. In ACM SIGPLAN Notices","author":"Shi Qingkai","year":"2018","unstructured":"Qingkai Shi, Xiao Xiao, Rongxin Wu, Jinguo Zhou, Gang Fan, and Charles Zhang. 2018. Pinpoint: Fast and precise sparse value flow analysis for million lines of code. In ACM SIGPLAN Notices, Vol. 53. ACM, 693--706."},{"key":"e_1_3_2_1_31_1","volume-title":"Driller: Augmenting Fuzzing Through Selective Symbolic Execution. In NDSS.","author":"Stephens Nick","year":"2016","unstructured":"Nick Stephens, John Grosen, Christopher Salls, Andrew Dutcher, Ruoyu Wang, Jacopo Corbetta, Yan Shoshitaishvili, Christopher Kr\u00fcgel, and Giovanni Vigna. 2016. Driller: Augmenting Fuzzing Through Selective Symbolic Execution. In NDSS."},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/2892208.2892235"},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.13"},{"key":"e_1_3_2_1_34_1","unstructured":"UAFL. 2019. Additoinal experiment results. https:\/\/sites.google.com\/view\/uafl\/"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3064176.3064211"},{"key":"e_1_3_2_1_36_1","volume-title":"Qinghua Zheng, and Ting Liu.","author":"Wang Haijun","year":"2019","unstructured":"Haijun Wang, Yun Lin, Zijiang Yang, Jun Sun, Yang Liu, Jin Song Dong, Qinghua Zheng, and Ting Liu. 2019. Explaining Regressions via Alignment Slicing and Mending. IEEE Transactions on Software Engineering (2019), 1--1."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2016.2584063"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/3338906.3338966"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/3377811.3380396"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813637"},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/3134600.3134620"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180178"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00057"},{"key":"e_1_3_2_1_44_1","volume-title":"22nd Annual Network and Distributed System Security Symposiu.","author":"Younan Yves","unstructured":"Yves Younan. 2015. FreeSentry: protecting against use-after-free vulnerabilities due to dangling pointers. In 22nd Annual Network and Distributed System Security Symposiu."},{"key":"e_1_3_2_1_45_1","volume-title":"Symbolic Verification of Regular Properties. In 2018 IEEE\/ACM 40th International Conference on Software Engineering. 871--881","author":"Yu H.","unstructured":"H. Yu, Z. Chen, J. Wang, Z. Su, and W. Dong. 2018. Symbolic Verification of Regular Properties. In 2018 IEEE\/ACM 40th International Conference on Software Engineering. 871--881."},{"key":"e_1_3_2_1_46_1","volume-title":"27th USENIX Security Symposium. 745--761","author":"Yun Insu","year":"2018","unstructured":"Insu Yun, Sangho Lee, Meng Xu, Yeongjin Jang, and Taesoo Kim. 2018. QSYM: A practical concolic execution engine tailored for hybrid fuzzing. In 27th USENIX Security Symposium. 745--761."},{"key":"e_1_3_2_1_47_1","unstructured":"Michal Zalewski. 2014. American Fuzzy Lop. http:\/\/lcamtuf.coredump.cx\/afl\/"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2015.80"}],"event":{"name":"ICSE '20: 42nd International Conference on Software Engineering","location":"Seoul South Korea","acronym":"ICSE '20","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering","KIISE Korean Institute of Information Scientists and Engineers","IEEE CS"]},"container-title":["Proceedings of the ACM\/IEEE 42nd International Conference on Software Engineering"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3377811.3380386","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3377811.3380386","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T22:41:39Z","timestamp":1750200099000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3377811.3380386"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,6,27]]},"references-count":48,"alternative-id":["10.1145\/3377811.3380386","10.1145\/3377811"],"URL":"https:\/\/doi.org\/10.1145\/3377811.3380386","relation":{},"subject":[],"published":{"date-parts":[[2020,6,27]]},"assertion":[{"value":"2020-10-01","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}