An Empirical Study of OSS-Fuzz Bugs
https://arxiv.org/pdf/2103.11518
Method
"We conduct the first empirical study of OSS-Fuzz, analyzing 23,907 bugs found in 316 projects. We examine the characteristics of fuzzer-found faults, the lifecycles of such faults, and the evolution of fuzzing campaigns over time."
Population
"examining over 4 years of data and 23,907 fuzzer-discovered bugs found in 316 software projects"
What it does not show
No control group of comparable unfuzzed projects, so there is no counterfactual defect rate. Does not measure compute cost, engineer triage burden or duplicate-report rates directly.
Zhen Yu Ding, Claire Le Goues
Detection and repair are fast — a median of five days to detect a regression and 5.3 days to fix. And the yield is mostly not security: of 23,907 bugs, 98 received a CVE. Flaky bugs, 13% of the corpus, are overwhelmingly never fixed at 86% unfixed against 12% for the rest.
Tier II: Large-N observational study of a real public bug database with no comparison group of unfuzzed projects.