Effective error-specification inference via domain-knowledge expansion

Abstract

Error-handling code responds to the occurrence of runtime errors. Failure to correctly handle errors can lead to security vulnerabilities and data loss. This paper deals with error handling in software written in C that uses the return-code idiom: the presence and type of error is encoded in the return value of a function. This paper describes EESI, a static analysis that infers the set of values that a function can return on error. Such a function error-specification can then be used to identify bugs related to incorrect error handling. The key insight of EESI is to bootstrap the analysis with domain knowledge related to error handling provided by a developer. EESI uses a combination of intraprocedural, flow-sensitive analysis and interprocedural, context-insensitive analysis to ensure precision and scalability. We built a tool ECC to demonstrate how the function error-specifications inferred by EESI can be used to automatically find bugs related to incorrect error handling. ECC detected 246 bugs across 9 programs, of which 110 have been confirmed. ECC detected 220 previously unknown bugs, of which 99 are confirmed. Two patches have already been merged into OpenSSL.

Synthesizing contracts correct modulo a test generator

“…In this work, our approach uses a testing oracle instead of a verifier for practical reasons (see also discussion regarding verification oracles in Section 3). There have been various approaches to mining specifications based on automata learning [Alur et al 2005;Ammons et al 2002;Henzinger et al 2005;Whaley et al 2002;Xie et al 2006] or dynamic and symbolic analysis [Astorga et al 2018;Csallner et al 2008;DeFreez et al 2019;Le et al 2019]. The predicate synthesis aspect of our work is similar to the PIE approach [Padhi et al 2016] that proposes feature expression synthesis in order to learn preconditions as well as loop invariants, but not strong/tight contracts.…”

Detecting and reproducing error-code propagation bugs in MPI implementations

“…None of the above analyses have been applied to MPI libraries, which differ from Linux in how error codes are transformed and handled. Other work [5,6,10,27,36] mines error-related specifications that can be used for bug detection in Linux and C libraries, but none of these have been used to find bugs in MPI libraries.…”