Fizzer: New Gray-Box Fuzzer

AbstractFizzer is a new gray-box fuzzer. In contrast to common gray-box fuzzers that aim to cover both and branches of branching instructions, Fizzer primarily aims to cover both possible values and of Boolean expressions in the program. When a generated test evaluates a so-called atomic Boolean expression to one of these values, our fuzzer computes the distance to the other value, detects bytes that influence this distance, and applies gradient descent on these bytes to flip the value. In Test-Comp 2024, Fizzer placed third in the category Cover-Branches after FuSeBMC and FuSeBMC-AI.