Solving complex path conditions through heuristic search on induced polytopes

Abstract

Test input generators using symbolic and concolic execution must solve path conditions to systematically explore a program and generate high coverage tests. However, path conditions may contain complicated arithmetic constraints that are infeasible to solve: a solver may be unavailable, solving may be computationally intractable, or the constraints may be undecidable. Existing test generators either simplify such constraints with concrete values to make them decidable, or rely on strong but incomplete constraint solvers. Unfortunately, simplification yields coarse approximations whose solutions rarely satisfy the original constraint. Moreover, constraint solvers cannot handle calls to native library methods. We show how a simple combination of linear constraint solving and heuristic search can overcome these limitations. We call this technique Concolic Walk. On a corpus of 11 programs, an instance of our Concolic Walk algorithm using tabu search generates tests with two-to three-times higher coverage than simplification-based tools while being up to five-times as efficient. Furthermore, our algorithm improves the coverage of two state-of-the-art test generators by 21% and 32%. Other concolic and symbolic testing tools could integrate our algorithm to solve complex path conditions without having to sacrifice any of their own capabilities, leading to higher overall coverage.

Combining symbolic execution and search-based testing for programs with complex heap inputs

“…As for any other symbolic execution approach, the results of SUSHI depend on the path exploration strategy. Our evaluation provides additional evidence of the differences and the complementarity between symbolic execution and search-based software testing approaches [2,22,31,35,55].…”

“…Both Lakhotia et al and Dinges and Agha exploit meta-heuristic search procedures to find numeric solutions for path conditions that include non-linear arithmetics and floating point variables that cannot be effectively handled with SMT solvers [22,42]. SUSHI handles non-linear formulas in a similar fashion and extends the target domain to complex data structures.…”

Search-Driven String Constraint Solving for Vulnerability Detection

“…Heuristic search has been already proposed [44] for solving nonlinear arithmetic constraints with operations from unsupported numeric libraries; the heuristics is optimized to explore an n-dimensional space over real numbers. Contrastingly, our approach targets solving string constraints with unsupported, string-manipulating operations and its search heuristics is optimized, in terms of search strategy and fitness functions, for string constraints.…”

“…Contrastingly, our approach targets solving string constraints with unsupported, string-manipulating operations and its search heuristics is optimized, in terms of search strategy and fitness functions, for string constraints. Further, the approach in [44] is evaluated in terms of coverage of test generators, while we evaluated our approach in the context of vulnerability detection.…”

Targeted test input generation using symbolic-concrete backward execution

“…Specifically, the algorithm repeatedly evaluates the program trace on input values, determines how close the branch conditions in the trace are to being satisfied, and modifies some of the inputs to move closer to a full solution. Symcretic execution does not prescribe which heuristic search algorithm to use; possible choices include genetic algorithms and the Concolic Walk algorithm [6].…”