Embedded Files
Abstract
Abstract
Static analysis is an important approach for finding bugs and vulnerabilities in software. However, inspecting and confirming static warnings are challenging and time-consuming. In this paper, we present a novel solution that automatically generates test cases based on static warnings to validate true and false positives. We designed a syntactic patching algorithm that can generate syntactically valid, semantic preserving executable code fragments from static warnings. We developed a build and testing system to automatically test code fragments using fuzzers, KLEE and Valgrind. We evaluated our techniques using 12 real-world C projects and 1955 warnings from two commercial static analysis tools. We successfully built 68.5% code fragments and generated 1003 test cases. Through automatic testing, we identified 48 true positives and 27 false positives, and 205 likely false positives. We matched 4 CVE and real-world bugs using Helium, and they are only triggered by our tool but not other baseline tools. We found that testing code fragments is scalable and useful; it can trigger bugs that testing entire programs or testing procedures failed to trigger.
Artifact
Artifact
The data set used/produced during the evaluation can be found at Zenodo.
Appendix A: Proof Sketches
Appendix A: Proof Sketches
Proof sketches for Theorems 1 and 2 are published below. This document acts as an appendix to our original work.
ICSE21_Helium_proofsketch_31-08-2020.pdfPage updated
Google Sites
Report abuse