  Hybrid testing combines fuzz testing and concolic execution. It leverages
fuzz testing to test easy-to-reach code regions and uses concolic execution to
explore code blocks guarded by complex branch conditions. However, its code
coverage-centric design is inefficient in vulnerability detection. First, it
blindly selects seeds for concolic execution and aims to explore new code
continuously. However, as statistics show, a large portion of the explored code
is often bug-free. Therefore, giving equal attention to every part of the code
during hybrid testing is a non-optimal strategy. It slows down the detection of
real vulnerabilities by over 43%. Second, classic hybrid testing quickly moves
on after reaching a chunk of code, rather than examining the hidden defects
inside. It may frequently miss subtle vulnerabilities despite that it has
already explored the vulnerable code paths. We propose SAVIOR, a new hybrid
testing framework pioneering a bug-driven principle. Unlike the existing hybrid
testing tools, SAVIOR prioritizes the concolic execution of the seeds that are
likely to uncover more vulnerabilities. Moreover, SAVIOR verifies all
vulnerable program locations along the executing program path. By modeling
faulty situations using SMT constraints, SAVIOR reasons the feasibility of
vulnerabilities and generates concrete test cases as proofs. Our evaluation
shows that the bug-driven approach outperforms mainstream automated testing
techniques, including state-of-the-art hybrid testing systems driven by code
coverage. On average, SAVIOR detects vulnerabilities 43.4% faster than DRILLER
and 44.3% faster than QSYM, leading to the discovery of 88 and 76 more
uniquebugs,respectively.Accordingtotheevaluationon11 well fuzzed benchmark
programs, within the first 24 hours, SAVIOR triggers 481 UBSAN violations,
among which 243 are real bugs.
