Implementation and evaluation of cross translation unit symbolic execution for C family languages

Horväth, Gábor; Szécsi, Péter; Gera, Zoltán; Krupp, Dániel; Pataki, Norbert

doi:10.1145/3183440.3195041

Cited by 2 publications

(3 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…During symbolic execution, the core will simultaneously build an exploded graph [12]. This graph describes the entire analysis -nodes could represent new information the analyzer learned while evaluating a statement, such as a new constraint on a symbolic expression, the end of a code block, call to a function, end of a function call, or even checker-specific information (e.g.…”

Section: Clang Static Analyzermentioning

confidence: 99%

Detecting Uninitialized Variables in C++ with the Clang Static Analyzer

Umann

Porkoláb

2020

Acta Cybern

View full text Add to dashboard Cite

Uninitialized variables have been a source of errors since the beginning of software engineering. Some programming languages (e.g. Java and Python) will automatically zero-initialize such variables, but others, like C and C++, leave their state undefined. While laying aside initialization in C and C++ might be a performance advantage if an initial value can't be supplied, working with such variables is an undefined behavior, and is a common source of instabilities and crashes. To avoid such errors, whenever meaningful initialization is possible, it should be used. Tools for detecting these errors run time have existed for decades, but those require the problematic code to be executed. Since in many cases the number of possible execution paths are combinatoric, static analysis techniques emerged as an alternative. In this paper, we overview the technique for detecting uninitialized C++ variables using the Clang Static Analyzer, and describe various heuristics to guess whether a specific variable was left in an undefined state intentionally. We implemented a prototype tool based on our idea and successfully tested it on large open source projects.

show abstract

Section: Clang Static Analyzermentioning

confidence: 99%

Detecting Uninitialized Variables in C++ with the Clang Static Analyzer

Umann

Porkoláb

2020

Acta Cybern

View full text Add to dashboard Cite

show abstract

“…CSA performs a context-sensitive interprocedural data-flow analysis via graph reachability [7] and relies on a set of checkers, which implement the logic for detecting specific types of bugs [5], [8]. Each path in a function is explored, which includes taking separate branches and different loop unrollings.…”

Section: The Clang Static Analyzermentioning

confidence: 99%

“…The control-flow analysis evaluates function calls inside the same translation unit (TU); if the symbolic execution engine finds a function call implemented in another TU, then the call is skipped and pointers and references passed as parameters are invalidated while the function return value is assumed to be unknown. Cross translation unit support (CTU) is under development [8]; it is not part of the CSA main branch yet.…”

Section: The Clang Static Analyzermentioning

confidence: 99%

SMT-Based Refutation of Spurious Bug Reports in the Clang Static Analyzer

Gadelha¹,

Steffinlongo

Cordeiro

et al. 2019

2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)

View full text Add to dashboard Cite

We describe and evaluate a bug refutation extension for the Clang Static Analyzer (CSA) that addresses the limitations of the existing built-in constraint solver. In particular, we complement CSA's existing heuristics that remove spurious bug reports. We encode the path constraints produced by CSA as Satisfiability Modulo Theories (SMT) problems, use SMT solvers to precisely check them for satisfiability, and remove bug reports whose associated path constraints are unsatisfiable. Our refutation extension refutes spurious bug reports in 8 out of 12 widely used open-source applications; on average, it refutes ca. 7% of all bug reports, and never refutes any true bug report. It incurs only negligible performance overheads, and on average adds 1.2% to the runtime of the full Clang/LLVM toolchain. A demonstration is available at https://www.youtube.com/watch?v=ylW5iRYNsGA.

show abstract

Implementation and evaluation of cross translation unit symbolic execution for C family languages

Cited by 2 publications

References 0 publications

Detecting Uninitialized Variables in C++ with the Clang Static Analyzer

Detecting Uninitialized Variables in C++ with the Clang Static Analyzer

SMT-Based Refutation of Spurious Bug Reports in the Clang Static Analyzer

Contact Info

Product

Resources

About