# BoostPolyGlot: A Structured IR Generation-Based Fuzz Testing Framework for GCC Compiler Frontend
## 4 Results and Discussion
### Vulnerability-Reproduction Efficiency Comparison  
In the field of software security testing, vulnerability-reproduction efficiency is a key indicator for measuring the performance of testing tools. Its numerical manifestation directly reflects the actual effectiveness of the tool in uncovering software vulnerabilities, which holds a crucial and non-negligible significance for ensuring software quality and security. In order to fully verify the effectiveness of BoostPolyGlot, this experiment conducted a systematic comparison of the vulnerability-reproduction efficiencies of BoostPolyGlot, AFL, and PolyGlot for the three typical vulnerabilities of CVE-2018-12886, CVE-2020-13844, and CVE-2021-20231. The specific data are detailed in Table 2.  
Analysis of the table data shows that BoostPolyGlot is significantly more efficient than AFL and PolyGlot in detecting the above three types of vulnerabilities. In the reproduction of the CVE-2018-12886 buffer overflow vulnerability, BoostPolyGlot took 871 s, representing  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**CVE-ID** & **AFL** & **PolyGlot** & **BoostPolyGlot** \\ \hline CVE-2018-12886 & 1235 s (+29.5\%) & 1078 s (+19.2\%) & 871 s \\ CVE-2020-13844 & 3724 s (+34.5\%) & 3197 s (+23.7\%) & 2439 s \\ CVE-2021-20231 & 18,731 s (+47.8\%) & 12,057 s (+19.0\%) & 9775 s \\ \hline \hline \end{tabular}
\end{table}
Table 2: Vulnerability-reproduction efficiency comparison.  
a 29.5% improvement compared to AFL's 1235 s and a 19.2% improvement compared to PolyGlot's 1078 s. It was the only tool among the three that managed to control the reproduction time within 1000 s. This vulnerability originated from a defect in the handling of negative loop step sizes in the tree-ssa-loop-niter.c module of the GCC compiler, which led loop variables to access the buffer out of bounds. BoostPolyGlot pre-constructed loop test cases in the input corpus, which contained negative step sizes and boundary values. By combining static loop structure analysis, it accurately covered the unhandled negative step size logic in the module. This approach reduced the ineffective attempts caused by random mutations.  
For the CVE-2020-13844 dead code elimination error, BoostPolyGlot took 2439 s for reproduction, representing a 34.5% improvement compared to AFL's 3724 s and a 23.7% improvement compared to PolyGlot's 3197 s. Thus, its efficiency advantage was further expanded. This vulnerability was caused by the misjudment in the tree-ssa-dec.c module that the code within the loop was unreachable, resulting in the incorrect removal of the critical boundary-checking logic. BoostPolyGlot performed extraction and insertion operations on IR nodes. Specifically, by changing the loop conditions, it enabled constant variables to break through their initial limitations, thus allowing test cases to quickly reach the compiler defects.  
In the reproduction of the CVE-2021-20231 vectorization-optimization memory-alignment error, BoostPolyGlot took 9775 s. This represented a 47.8% improvement compared to AFL's 18,731 s and a 19.0% improvement compared to PolyGlot's 12,057 s, with the largest improvement margin among the three types of vulnerabilities. This vulnerability was caused by the failure of the tree-vect-stmts.c module to verify the 16-byte memory-alignment constraint when generating the MOVDQA vectorization instruction. BoostPolyGlot employed a dynamic weight adjustment strategy to monitor the code coverage of test cases in real time. It preferentially mutated the IR nodes related to vectorization instructions, effectively targeting the code paths with missing alignment constraints in the testing process. This demonstrated its deep exploration ability of the vectorization logic.  
In summary, BoostPolyGlot's superior performance in detecting these three vulnerabilities underscores its effectiveness.