# Not All Seeds Are Important: Fuzzing Guided by Untouched Edges
## 7 Discussion  
In this section, we discuss several limitations of our current implementation:  
1. Our method is implemented on the top of AFL and not on AFL++. The choice to not implement it on AFL++ was due to the fact that AFL++ already integrates the seed scheduling mechanism from AFLFast and other advanced technologies. Porting the untouched edge guidance mechanism into AFL++ would have been complex. We plan to implement our approach to AFL++ in future work. Additionally, it is important to note that our method may not apply to base fuzzers outside of AFL, such as libFuzzer [42] or honggfuzz [1].
2. Coverage bitmap collisions are a common issue in AFL-based fuzzers. AFL-based fuzzers typically use a fixed-size 64 KB bitmap to collect coverage information, which can be adjusted via configuration. The fixed bitmap size might result in different edges being assigned the same edge ID, causing coverage bitmap collisions. Prior research attempts have aimed to optimize this issue by modifying instrumentation [28; 43; 44]. However, with the increase in the size of the target programs, expanding the bitmap to solve collision issues might not lead to significant performance improvements.  
\begin{table}
\begin{tabular}{l c l l c} \hline \hline
**Project** & **Version** & **CVE/Issue** & **Type** & **Fixed Status** \\ \hline LIEF & v0.12.1 & CVE-2022-40922 & segmentation fault & ✓ \\ LIEF & v0.12.1 & CVE-2022-40923 & segmentation fault & ✓ \\ LIEF & v0.12.1 & CVE-2022-43171 & heap buffer overflow & ✓ \\ LIEF & v0.12.1 & CVE-2022-43172 & segmentation fault & ✓ \\ LIEF & v0.12.1 & github-issue-785 & allocator oom & ✓ \\ PcapPlusPlus & v22.11 & CVE-2023-31991 & heap buffer overflow & ✓ \\ libfyaml & v0.7.12 & CVE-2023-31992 & use after free & ✓ \\ libfyaml & v0.7.12 & CVE-2023-31993 & stack buffer overflow & ✓ \\ libfyaml & v0.7.12 & github-issue-56 & stack-buffer-overflow & ✓ \\ sxmlc & v4.5.2 & github-issue-24 & segmentation fault & ✓ \\ sxmlc & v4.5.2 & github-issue-25 & segmentation fault & ✓ \\ configor & v0.9.18 & github-issue-97 & infinite loop & ✓ \\ tom11 & v3.7.1 & github-issue-199 & heap buffer overflow & ✓ \\ \hline \hline \end{tabular}
\end{table}
Table 6: New vulnerabilities found by UntouchFuzz.  
\begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Fuzzer** & **AFL** & **UntouchFuzz** & **Mopt** & **Mopt-u** \\ \hline djpeg & 3998 & **4101** & 4073 & **4397** \\ exiv2 & 12,152 & **12,304** & 12,404 & **12,480** \\ pdftotext & 15,160 & **15,280** & 15,322 & **15,341** \\ tcpdump & 18,208 & **18,556** & 18,467 & **18,734** \\ mp3 gain & 1375 & **1382** & 1378 & **1380** \\ mp42 aac & **3263** & **3263** & 3352 & **3409** \\ tifcp & 5841 & **6659** & 5949 & **6132** \\ readelf & 10,336 & **10,647** & 11,128 & **11,252** \\ mn-new & 5455 & **5601** & 5573 & 5674 \\ xmlint & 10,406 & **10,470** & 10245 & **10,408** \\ bsdtar & 5250 & **5318** & 5270 & **5273** \\ mujs & 9170 & **9210** & 9121 & **9157** \\ \hline Total & 100,614 & 102,791 & 102,282 & **103,637** \\  & (\(-2.16\%\)) & & (\(-1.31\%\)) & \\ \hline \hline \end{tabular}
\end{table}
Table 5: Comparison between AFL, MOpt and UntouchFuzz, MOpt-u.  
3. We conducted fuzzing tests on 12 mainstream benchmark programs, running each program 10 times for 24 h per test. The experimental results demonstrate that, under the given initial corpus conditions, our tool effectively selects better seeds for fuzzing and guides the fuzzer toward maximizing program coverage. However, differences between the initial corpus and the target program can impact the performance of coverage-guided greybox fuzzers [10; 15; 45], causing variations in the evolutionary process and resulting in different outcomes.