  Fuzzing has been an important approach for finding bugs and vulnerabilities
in programs. Many fuzzers deployed in industry run daily and can generate an
overwhelming number of crashes. Diagnosing such crashes can be very challenging
and time-consuming. Existing fuzzers typically employ heuristics such as code
coverage or call stack hashes to weed out duplicate reporting of bugs. While
these heuristics are cheap, they are often imprecise and end up still reporting
many "unique" crashes corresponding to the same bug. In this paper, we present
FuzzerAid that uses fault signatures to group crashes reported by the fuzzers.
Fault signature is a small executable program and consists of a selection of
necessary statements from the original program that can reproduce a bug. In our
approach, we first generate a fault signature using a given crash. We then
execute the fault signature with other crash inducing inputs. If the failure is
reproduced, we classify the crashes into the group labeled with the fault
signature; if not, we generate a new fault signature. After all the crash
inducing inputs are classified, we further merge the fault signatures of the
same root cause into a group. We implemented our approach in a tool called
FuzzerAid and evaluated it on 3020 crashes generated from 15 real-world bugs
and 4 large open source projects. Our evaluation shows that we are able to
correctly group 99.1% of the crashes and reported only 17 (+2) "unique" bugs,
outperforming the state-of-the-art fuzzers.
