Validating static warnings via testing code fragments
Validating static warnings via testing code fragments
复制标题
DOI：
10.1145/3460319.3464832
复制
发表时间：
2021-06
期刊：
影响因子：
--
通讯作者：
Ashwin Kallingal Joshy;Xueyuan Chen;Benjamin Steenhoek;Wei Le
中科院分区：
文献类型：
--
作者：
Ashwin Kallingal Joshy;Xueyuan Chen;Benjamin Steenhoek;Wei Le
静态分析是发现软件缺陷和漏洞的重要方法。然而，检查和确认静态警告是具有挑战性和耗时的。在本文中，我们提出了一种新的解决方案，自动生成测试用例的基础上，静态警告，以验证真和假阳性。我们设计了一个语法修补算法，可以从静态警告中生成语法有效、语义保持的可执行代码片段。我们开发了一个构建和测试系统，使用模糊器，KLEE和Valgrind自动测试代码片段。我们使用12个真实的C项目和两个商业静态分析工具的1955个警告来评估我们的技术。我们成功地构建了68.5%的代码片段，并生成了1003个测试用例。通过自动测试，我们确定了48个真阳性和27个假阳性，以及205个可能的假阳性。我们使用Helium匹配了4个CVE和真实世界的bug，它们只由我们的工具触发，而不是其他基线工具。我们发现，测试代码片段是可伸缩的和有用的;它可以触发测试整个程序或测试过程未能触发的错误。
Static analysis is an important approach for finding bugs and vulnerabilities in software. However, inspecting and confirming static warnings are challenging and time-consuming. In this paper, we present a novel solution that automatically generates test cases based on static warnings to validate true and false positives. We designed a syntactic patching algorithm that can generate syntactically valid, semantic preserving executable code fragments from static warnings. We developed a build and testing system to automatically test code fragments using fuzzers, KLEE and Valgrind. We evaluated our techniques using 12 real-world C projects and 1955 warnings from two commercial static analysis tools. We successfully built 68.5% code fragments and generated 1003 test cases. Through automatic testing, we identified 48 true positives and 27 false positives, and 205 likely false positives. We matched 4 CVE and real-world bugs using Helium, and they are only triggered by our tool but not other baseline tools. We found that testing code fragments is scalable and useful; it can trigger bugs that testing entire programs or testing procedures failed to trigger.