Identifying the root causes of memory bugs using corrupted memory location suppression

Abstract

We present a general approach for automatically isolating the root causes of memory-related bugs in software. Our approach is based on the observation that most memory bugs involve uses of corrupted memory locations. By iteratively suppressing (nullifying) the effects of these corrupted memory locations during program execution, our approach gradually isolates the root cause of a memory bug. Our approach can work for common memory bugs such as buffer overflows, uninitialized reads, and double frees. However, our approach is particularly effective in finding root causes for memory bugs in which memory corruption propagates during execution until an observable failure such as a program crash occurs.

A state alteration and inspection-based interactive debugger

“…State alteration has been used to automatically localize faults [30], [13], [2]. Zhang et al [30] proposed predicate switching to constrain the search space of program state changes explored during bug location.…”

“…Zhang et al [30] proposed predicate switching to constrain the search space of program state changes explored during bug location. Corrupted memory location suppression [13] attempts to identify the root cause of memory bugs by iteratively suppressing the cause of the memory failure. Chandra et al [2] report repair candidates based on value replacement.…”

BugFix: A learning-based tool to assist developers in fixing bugs

“…Value Replacement [17] involves searching for the suspicious statements at which values can be replaced during the execution of a failing run to cause the run to become passing. Suppression [18] can be used to isolate the root causes of memory bugs by iteratively suppressing the effects of known corrupted memory locations during program execution.…”

Effective and efficient localization of multiple faults using value replacement

“…Predicate Switching [25] attempts to isolate erroneous code by identifying predicates whose outcomes can be altered during a failing run to cause it to become passing. Execution Suppression [10] is a technique that iteratively isolates memory corruption during a failing execution to identify the root cause of a memory-related failure. Value Replacement [9], discussed extensively in the current work, is also a state-altering technique.…”