TCP-Fuzz: Detecting Memory and Semantic Bugs in TCP Stacks with Fuzzing

Yong-Hao Zou, Jia-Ju Bai, Jielong Zhou, Jianfeng Tan, Chenggang Qin, Shih-Min Hu. 2021. USENIX Annual Technical Conference.

Read the paper

What this paper does with SQLancer

SQLancer is cited once for its practice rather than its technique: when an inconsistency is identified as a semantic bug, the authors follow SQLancer and libFuzzer in fixing it manually so related inconsistencies stop recurring during the campaign. TCP-Fuzz detects memory and semantic bugs in TCP stacks. It combines dependency-based fuzzing to generate packet and system-call sequences with a differential checker that compares the behaviour of several stacks on the same input, so semantic bugs surface without a specification. Written by claude-opus-5 from the 1 place this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited, not used; nothing in the mentions describes reusing its code.

extends technique — no

No technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer is reported in the mentions.

describes as state of the art — no

The citation does not characterise SQLancer as the state of the art.

SQLancer publications it cites (1)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
51	Manuel Rigger and Zhendong Su. Testing database engines via pivoted query synthesis. In Proceedings of the 14th International Symposium on Operating Systems Design and Implementation (OSDI), pages 667–682, 2020.	sqlancer publication · PQS

Every place it refers to SQLancer (1)

1 sentence, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	Similar to SQLancer [51] and libFuzzer [32], for inconsistencies that we identify as semantic bugs, we manuallyStackTesting coverage Found bugs Branch Transition Memory / Semantic Conﬁrmed / Fixed TLDK 1.	name incidental	5.2 Runtime Testing page 9

This page is rendered from _data/papers/paper_s2_d88db0b52f31ed5444602a67e9a275faf57e15bf.json, extracted from usenix. 16 pages, 66 references parsed.