An Empirical Study on API-Misuse Bugs in Open-Source C Programs

Demystifying regular expression bugs

“…The library usage studies have explored the motivation of library migration (Kabinna et al 2016), how to choose the best library candidate (Mileva et al 2009), which version should be used (Mileva et al 2009), and how to automate the migration of the underlying API library from one to another (Wu et al 2015;Kapur et al 2010;Teyton et al 2012). The API usage studies have explored mining API usage patterns (Zhong et al 2009), detecting API misuses (Gu et al 2019;Amann et al 2018;Kechagia et al 2019;Amann et al 2016;Bae et al 2014), studying API evolution (Zhang et al 2021;Shi et al 2011;Dig and Johnson 2006;Kim et al 2011), and automatic refactoring for API changes (Perkins 2005;Thung et al 2020) via documentation (Shi et al 2011;Ko et al 2014;Zhang et al 2021;Dig and Johnson 2006), source code and its change history (Thung et al 2020;Dig and Johnson 2006), and bytecode (Perkins 2005). The majority of API-misuse detectors are via static analysis and suffer from low precision and recall in practice (Gu et al 2019;Amann et al 2018) while Catcher (Kechagia et al 2019) is a hybrid detector for crash-prone API misuses.…”

“…In this work we include both static and dynamic API changes since the missing of API parameter validation, redundant API calls, and missing or incorrect exception handling are all regard as API misuses (Gu et al 2019). We do not distinguish the usage of library from that of API since they are connected closely and one can be studied for the other.…”