Industrial application of concolic testing approach: A case study on libexif by using CREST-BV and KLEE

Abstract

As smartphones become popular, manufacturers such as Samsung Electronics are developing smartphones with rich functionality such as a camera and photo editing quickly, which accelerates the adoption of open source applications in the smartphone platforms. However, developers often do not know the detail of open source applications, because they did not develop the applications themselves. Thus, it is a challenging problem to test open source applications effectively in short time. This paper reports our experience of applying concolic testing technique to test libexif, an open source library to manipulate EXIF information in image files. We have demonstrated that concolic testing technique is effective and efficient at detecting bugs with modest effort in industrial setting. We also compare two concolic testing tools, CREST-BV and KLEE, in this testing project. Furthermore, we compare the concolic testing results with the analysis result of the Coverity Prevent static analyzer. We detected a memory access bug, a null pointer dereference bug, and four divide-by-zero bugs in libexif through concolic testing, none of which were detected by Coverity Prevent.

Industrial Application of Concolic Testing on Embedded Software: Case Studies

“…Samsung Electronics and KAIST will continue collaboration to overcome such limitations (see Section VIII-C) [20], [19].…”

“…This step requires human expertise on a target domain. For example, Kim et al [19] demonstrated that testing strategies on selecting symbolic input affects bug detection capability through a case study on the open source libexif library. 01:int main() { 02: int x, y,z, max_num=0; 03: CREST_int(x); // Declaration of x, y, z 04: CREST_int(y); // as symbolic integer 05: CREST_int(z); // variables 06: 07: if(x >= y) { 08:…”

How we get there: a context-guided search strategy in concolic testing

“…For example, when a PC contains complex constraints such as non-linear expressions or floating point operations of which SMT solvers cannot deal with efficiently [15,21], concolic testing can simplify the constraints with concrete values to solve it. Even though this concretisation may introduce imprecision, it allows concolic testing to generate input values where symbolic execution may not [17,10].…”

CCCD: Concolic code clone detection

“…Concolic analysis combines concrete and symbolic values in order to traverse all possible paths (up to a given length) of an application [6]. CCCD is innovative for several reasons.…”