  Directed greybox fuzzing (DGF) can quickly discover or reproduce bugs in
programs by seeking to reach a program location or explore some locations in
order. However, due to their static stage division and coarse-grained energy
scheduling, prior DGF tools perform poorly when facing multiple target
locations (targets for short).
  In this paper, we present multiple targets directed greybox fuzzing which
aims to reach multiple programs locations in a fuzzing campaign. Specifically,
we propose a novel strategy to adaptively coordinate exploration and
exploitation stages, and a novel energy scheduling strategy by considering more
relations between seeds and target locations. We implement our approaches in a
tool called LeoFuzz and evaluate it on crash reproduction, true positives
verification, and vulnerability exposure in real-world programs. Experimental
results show that LeoFuzz outperforms six state-of-the-art fuzzers, i.e., QYSM,
AFLGo, Lolly, Berry, Beacon and WindRanger in terms of effectiveness and
efficiency. Moreover, LeoFuzz has detected 23 new vulnerabilities in real-world
programs, and 11 of them have been assigned CVE IDs.
