  Guided fuzzing has, in recent years, been able to uncover many new
vulnerabilities in real-world software due to its fast input mutation
strategies guided by path-coverage. However, most fuzzers are unable to achieve
high coverage in deeper parts of programs. Moreover, fuzzers heavily rely on
the diversity of the seed inputs, often manually provided, to be able to
produce meaningful results.
  In this paper, we present Wildfire, a novel open-source compositional fuzzing
framework. Wildfire finds vulnerabilities by fuzzing isolated functions in a
C-program and, then, using targeted symbolic execution it determines the
feasibility of exploitation for these vulnerabilities. Based on our evaluation
of 23 open-source programs (nearly 1 million LOC), we show that Wildfire, as a
result of the increased coverage, finds more true-positives than baseline
symbolic execution and fuzzing tools, as well as state-of-the-art
coverage-guided tools, in only 10% of the analysis time taken by them.
Additionally, Wildfire finds many other potential vulnerabilities whose
feasibility can be determined compositionally to confirm if they are
false-positives. Wildfire could also reproduce all of the known vulnerabilities
and found several previously-unknown vulnerabilities in three open-source
libraries.
