1. Validating static warnings via testing code fragments
- Author
-
Xueyuan Chen, Ashwin Kallingal Joshy, Wei Le, and Benjamin Steenhoek
- Subjects
FOS: Computer and information sciences ,Computer science ,Static program analysis ,02 engineering and technology ,computer.software_genre ,Computer Science - Software Engineering ,Software ,020204 information systems ,0202 electrical engineering, electronic engineering, information engineering ,Code (cryptography) ,False positive paradox ,D.2.5 ,business.industry ,D.2.4 ,020207 software engineering ,computer.file_format ,Static analysis ,F.3.1 ,Software Engineering (cs.SE) ,Test case ,Scalability ,Data mining ,Executable ,business ,computer - Abstract
Static analysis is an important approach for finding bugs and vulnerabilities in software. However, inspecting and confirming static warnings are challenging and time-consuming. In this paper, we present a novel solution that automatically generates test cases based on static warnings to validate true and false positives. We designed a syntactic patching algorithm that can generate syntactically valid, semantic preserving executable code fragments from static warnings. We developed a build and testing system to automatically test code fragments using fuzzers, KLEE and Valgrind. We evaluated our techniques using 12 real-world C projects and 1955 warnings from two commercial static analysis tools. We successfully built 68.5% code fragments and generated 1003 test cases. Through automatic testing, we identified 48 true positives and 27 false positives, and 205 likely false positives. We matched 4 CVE and real-world bugs using Helium, and they are only triggered by our tool but not other baseline tools. We found that testing code fragments is scalable and useful; it can trigger bugs that testing entire programs or testing procedures failed to trigger., In Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis July 11 to 17, 2021, Denmark. 13 pages
- Published
- 2021