WYSIWIB: exploiting fine-grained program structure in a scriptable API-usage protocol-finding process

SUMMARY Bug‐finding tools rely on specifications of what is correct or incorrect code. As it is difficult for a tool developer or user to anticipate all possible specifications, strategies for inferring specifications have been proposed. These strategies obtain probable specifications by observing c...

Full description

Saved in:
Bibliographic Details
Published in:Software, practice & experience Vol. 43; no. 1; pp. 67 - 92
Main Authors: Lawall, Julia L., Brunel, Julien, Palix, Nicolas, Hansen, René Rydhof, Stuart, Henrik, Muller, Gilles
Format: Journal Article
Language:English
Published: Chichester, UK John Wiley & Sons, Ltd 01.01.2013
Wiley Subscription Services, Inc
Wiley
Subjects:
API
bug finding
Computer programs
Computer Science
Construction equipment
Heuristic
Inference
Linux
Operating Systems
program analysis
Software
Software Engineering
Specifications
Strategy
Linux
bug finding
program analysis
ISSN:0038-0644, 1097-024X
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:SUMMARY Bug‐finding tools rely on specifications of what is correct or incorrect code. As it is difficult for a tool developer or user to anticipate all possible specifications, strategies for inferring specifications have been proposed. These strategies obtain probable specifications by observing common characteristics of code or execution traces, typically focusing on sequences of function calls. To counter the observed high rate of false positives, heuristics have been proposed for ranking or pruning the results. These heuristics, however, can result in false negatives, especially for rarely used functions. In this paper, we propose an alternate approach to specification inference, in which the user guides the inference process using patterns of code that reflect the user's understanding of the conventions and design of the targeted software project. We focus on specifications describing the correct usage of API functions, which we refer to as API protocols. Our approach builds on the Coccinelle program matching and transformation tool, which allows a user to construct patterns that reflect the structure of the code to be matched. We evaluate our approach on the source code of the Linux kernel, which defines a very large number of API functions with varying properties. Linux is also critical software, implying that fixing even bugs involving rarely used protocols is essential. In our experiments, we use our approach to find over 3000 potential API protocols, with an estimated false positive rate of under 15% and use these protocols to find over 360 bugs in the use of API functions. Copyright © 2012 John Wiley & Sons, Ltd.
Bibliography:This is an extended version of the article 'WYSIWIB: A Declarative Approach to Finding API Protocols and Bugs in Linux Code' that was presented at the 2009 IEEE/IFIP International Conference on Dependable Systems and Networks.
ArticleID:SPE2102
istex:3147194B8E9F5B02960E7325CCF445DD58EF24CB
ark:/67375/WNG-78P5RH23-K
This is an extended version of the article ‘WYSIWIB: A Declarative Approach to Finding API Protocols and Bugs in Linux Code’ that was presented at the 2009 IEEE/IFIP International Conference on Dependable Systems and Networks.
Julien Brunel's current address: ONERA, Toulouse, France
ObjectType-Article-1
SourceType-Scholarly Journals-1
content type line 14
ObjectType-Feature-2
content type line 23
ISSN:0038-0644
1097-024X
DOI:10.1002/spe.2102