WYSIWIB: Exploiting Fine-Grained Program Structure in a Scriptable API-Usage Protocol Finding Process
- Authors:
- Subtitle:
- exploiting fine-grained program structure in a scriptable API-usage protocol-finding process
- DOI:
- 10.1002/spe.2102
- Abstract:
- Bug-finding tools rely on specifications of what is correct or incorrect code. As it is difficult for a tool developer or user to anticipate all possible specifications, strategies for inferring specifications have been proposed. These strategies obtain probable specifications by observing common characteristics of code or execution traces, typically focusing on sequences of function calls. To counter the observed high rate of false positives, heuristics have been proposed for ranking or pruning the results. These heuristics, however, can result in false negatives, especially for rarely used functions. In this paper, we propose an alternate approach to specification inference, in which the user guides the inference process using patterns of code that reflect the user's understanding of the conventions and design of the targeted software project. We focus on specifications describing the correct usage of API functions, which we refer to as API protocols. Our approach builds on the Coccinelle program matching and transformation tool, which allows a user to construct patterns that reflect the structure of the code to be matched. We evaluate our approach on the source code of the Linux kernel, which defines a very large number of API functions with varying properties. Linux is also critical software, implying that fixing even bugs involving rarely used protocols is essential. In our experiments, we use our approach to find over 3000 potential API protocols, with an estimated false positive rate of under 15% and use these protocols to find over 360 bugs in the use of API functions. Copyright (c) 2012 John Wiley Sons, Ltd.
- Type:
- Journal article
- Language:
- English
- Published in:
- Software: Practice and Experience, 2013, Vol 43, Issue 1, p. 67-92
- Keywords:
- Linux; bug finding; program analysis
- Main Research Area:
- Science/technology
- Publication Status:
- Published
- Review type:
- Peer Review
- Conference:
- 2009 IEEE/IFIP International Conference on Dependable Systems & Networks, 2013
- Submission year:
- 2013
- Scientific Level:
- Scientific
- ID:
- 234055071
