  Greybox fuzzing is a proven and effective testing method for the detection of
security vulnerabilities and other bugs in modern software systems. Greybox
fuzzing can also be used in combination with a sanitizer, such as
AddressSanitizer (ASAN), to further enhance the detection of certain classes of
bugs such as buffer overflow and use-after-free errors. However, sanitizers
also introduce additional performance overheads, and this can degrade the
performance of greybox mode fuzzing -- measured in the order of 2.36X for
fuzzing with ASAN -- partially negating the benefit of using a sanitizer in the
first place. Recent research attributes the extra overhead to program
startup/teardown costs that can dominate fork-mode fuzzing.
  In this paper, we present a new memory error sanitizer design that is
specifically optimized for fork-mode fuzzing. The basic idea is to mark object
boundaries using randomized tokens rather than disjoint metadata (as used by
traditional sanitizer designs). All read/write operations are then instrumented
to check for the token, and if present, a memory error will be detected. Since
our design does not use a disjoint metadata, it is also very lightweight,
meaning that program startup and teardown costs are minimized for the benefit
of fork-mode fuzzing. We implement our design in the form of the ReZZan tool,
and show an improved fuzzing performance overhead of 1.14-1.27X, depending on
the configuration.
