The Floating-Point Extension of Symbolic Execution Engine for Bug Detection

Wu, Xingming; Xu, Zhenbo; Yan, Dong Song; Wu, Tianyong; Yan, Jun; Zhang, Jian

doi:10.1109/apsec.2016.045

Cited by 4 publications

(1 citation statement)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Canalyze-fp [68] also uses symbolic execution to detect floating-point exceptions, and uses the floating-point theory supported by the SMT solver Z3. 15 math.h/cmath functions are approximated by just considering their (theoretical) ranges, e.g., a constraint such as y = exp(x) is approximated to y ≥ 0 ∧ y ≤ +∞.…”

Section: Comparison With the State Of The Artmentioning

confidence: 99%

A Practical Approach to Verification of Floating-Point C/C++ Programs with math.h/cmath Functions

Bagnara

Chiari

Gori

et al. 2020

ACM Trans. Softw. Eng. Methodol.

View full text Add to dashboard Cite

Verification of C/C<bold>++</bold> programs has seen considerable progress in several areas, but not for programs that use these languages’ mathematical libraries. The reason is that all libraries in widespread use come with no guarantees about the computed results. This would seem to prevent any attempt at formal verification of programs that use them: without a specification for the functions, no conclusion can be drawn statically about the behavior of the program. We propose an alternative to surrender. We introduce a pragmatic approach that leverages the fact that most <monospace>math.h/cmath</monospace> functions are almost piecewise monotonic: as we discovered through exhaustive testing, they may have glitches , often of very small size and in small numbers. We develop interval refinement techniques for such functions based on a modified dichotomic search, which enable verification via symbolic execution based model checking, abstract interpretation, and test data generation. To the best of our knowledge, our refinement algorithms are the first in the literature to be able to handle non-correctly rounded function implementations, enabling verification in the presence of the most common implementations. We experimentally evaluate our approach on real-world code, showing its ability to detect or rule out anomalous behaviors.

show abstract

Section: Comparison With the State Of The Artmentioning

confidence: 99%