Symbolic pointer analysis for detecting memory leaks

Memory leaks represent a remarkable problem for mobile app developers since a waste of memory due to bad programming practices may reduce the available memory of the device, slow down the apps, reduce their responsiveness and, in the worst cases, they may cause the crash of the app. A common cause of memory leaks in the specific context of Android apps is the bad handling of the events tied to the Activity Lifecycle. In order to detect and characterize these memory leaks, we present FunesDroid, a tool-supported black box technique for the automatic detection of memory leaks tied to the Activity Lifecycle in Android apps. FunesDroid implements a testing approach that can find memory leaks by analyzing unnecessary heap object replications after the execution of three different sequences of Activity Lifecycle events. In the paper, we present an exploratory study that shows the capability of the proposed technique to detect memory leaks and to characterize them in terms of their size, persistence and growth trend. The study also illustrates how memory leak causes can be detected with the support of the information provided by the FunesDroid tool.

A new method for software safety analysis is presented which uses program slicing and constraint solving to construct and analyze path conditions , conditions defined on a program's input variables which must hold for information flow between two points in a program. Path conditions are constructed from subgraphs of a program's dependence graph, specifically, slices and chops. The article describes how constraint solvers can be used to determine if a path condition is satisfiable and, if so, to construct a witness for a safety violation, such as an information flow from a program point at one security level to another program point at a different security level. Such a witness can prove useful in legal matters.The article reviews previous research on path conditions in program dependence graphs; presents new extensions of path conditions for arrays, pointers, abstract data types, and multithreaded programs; presents new decomposition formulae for path conditions; demonstrates how interval analysis and BDDs (binary decision diagrams) can be used to reduce the scalability problem for path conditions; and presents case studies illustrating the use of path conditions in safety analysis. Applying interval analysis and BDDs is shown to overcome the combinatorial explosion that can occur in constructing path conditions. Case studies and empirical data demonstrate the usefulness of path conditions for analyzing practical programs, in particular, how illegal influences on safety-critical programs can be discovered and analyzed.

For C++ programs often appear memory leaks, cross-border access memory and memory does not match the release of error, we have analyzed existing memory error detection tools and methods, implemented in the Linux platform to run the memory testing tool MemDetect prototype based on the open source dynamic instrumentation-Valgrind using function family's memory information block management method and life cycle method. The prototype can detect memory leaks, cross-border access memory and memory does not match the release problems effectively, the validity and efficiency of the prototype are proved by comparing with Purify Rational.

Software vulnerabilities become one of the top threats to world security in the coming decade. The most of such vulnerabilities are based on memory leaks and memory corruption. Many memory access monitoring tools exist, but most of them suffer from high overhead what makes it impossible to use such tools in the "real world" software projects. The goal of this research is to develop and investigate a memory access monitoring tool that detects memory leaks and corruption using tagged memory without reduce of an original application performance.

A memory-related vulnerability detection approach based on vulnerability model with Petri Net

In software security testing, fuzz testing and symbolic execution are two main testing techniques. Fuzz testing finds program bugs by executing the target program with random inputs it generates while monitoring the execution for abnormal behaviors. Though fuzz testing is able to explore deep into a program's state space efficiently, it usually cannot guarantee the code coverage ratio in many situations. Symbolic execution treats a program's input as symbols and executes the program with such symbolic input. Symbolic execution tries to explore the whole state space of a program by analyzing all of the program's paths. Symbolic execution always guarantees the code coverage ratio in theory, but for real programs it has many problems such as path explosion. Our new method, hybrid fuzz testing, combines the benefits of fuzz testing and symbolic execution. Symbolic execution will start to work and to generate new program input when fuzz testing cannot increase the code coverage ratio. The experiment result implies that our hybrid fuzz testing method can obviously increase the code coverage ratio efficiently in reasonable resources using.

In the context of test data generation, symbolic execution gets more attention as computing power increases continuously. Experiments show that test generation tools based on symbolic execution can get high coverage and find bugs on real applications. However, symbolic execution still has limitations in handling some complex program structures such as pointers, arrays and library functions. To address the problem, this study proposes a technique called lazy symbolic execution, which combines symbolic execution with a lazy evaluation strategy. The authors approach is motivated by the observation that some program structures can be reasoned about symbolically and the others have to be evaluated concretely. Traditional symbolic execution can cope with the former well, whereas lazy symbolic evaluation is used to handle the latter. However, lazy symbolic evaluation introduces intermediate variables into path constraints. To eliminate those variables, concrete values for some input variables are first obtained by constraint solving or searching processes. Then, the given path is executed again using inputs consisting of concrete and symbolic values. The procedure is repeated until all intermediate variables are wiped out. The authors have implemented a prototype tool and performed some experiments. The empirical results show the effectiveness of their approach.

We present a new approach to automated reasoning about higher-order programs by endowing symbolic execution with a notion of higher-order, symbolic values. To validate our approach, we use it to develop and evaluate a system for verifying and refuting behavioral software contracts of components in a functional language, which we call soft contract verification . In doing so, we discover a mutually beneficial relation between behavioral contracts and higher-order symbolic execution. Contracts aid symbolic execution by providing a rich language of specifications serving as a basis of symbolic higher-order values; the theory of blame enables modular verification and leads to the theorem that verified components can't be blamed ; and the run-time monitoring of contracts enables soft verification whereby verified and unverified components can safely interact. Conversely, symbolic execution aids contracts by providing compile-time verification and automated test case generation from counter-examples to verification. This relation between symbolic exuection and contracts engenders a virtuous cycle encouraging the gradual use of contracts. Our approach is able to analyze first-class contracts, recursive data structures, unknown functions, and control-flow-sensitive refinements of values, which are all idiomatic in dynamic languages. It makes effective use of off-the-shelf solvers to decide problems without heavy encodings. Counterexample search is sound and relatively complete with respect to a first-order solver for base type values and counter-examples are reported as concrete values, including functions. Therefore, it can form the basis of automated verification and bug-finding tools for higher-order programs. The approach is competitive with a range of existing tools—including type systems, flow analyzers, and model checkers—on their own benchmarks. We have built a prototype to analyze programs written in Racket and report on its effectiveness in verifying and refuting contracts.

Symbolic execution is a powerful, systematic analysis that has received much visibility in the last decade. Scalability however remains a major challenge for symbolic execution. Compositional analysis is a well-known general purpose methodology for increasing scalability. This paper introduces a new approach for compositional symbolic execution. Our key insight is that we can summarize each analyzed method as a memoization tree that captures the crucial elements of symbolic execution, and leverage these memoization trees to efficiently replay the symbolic execution of the corresponding methods with respect to their calling contexts. Memoization trees offer a natural way to compose in the presence of heap operations, which cannot be dealt with by previous work that uses logical formulas as summaries for compositional symbolic execution. Our approach also enables efficient target oriented symbolic execution for error detection or program coverage. Initial experimental evaluation based on a prototype implementation in Symbolic Path Finder shows that our approach can be up to an order of magnitude faster than traditional non-compositional symbolic execution.

Smart contracts are executable programs that enable the building of a\nprogrammable trust mechanism between multiple entities without the need of a\ntrusted third-party. Researchers have developed several security scanners in\nthe past couple of years. However, many of these analyzers either do not scale\nwell, or if they do, produce many false positives. This issue is exacerbated\nwhen bugs are triggered only after a series of interactions with the functions\nof the contract-under-test. A depth-n vulnerability, refers to a vulnerability\nthat requires invoking a specific sequence of n functions to trigger. Depth-n\nvulnerabilities are time-consuming to detect by existing automated analyzers,\nbecause of the combinatorial explosion of sequences of functions that could be\nexecuted on smart contracts.\n In this paper, we present a technique to analyze depth-n vulnerabilities in\nan efficient and scalable way by combining symbolic execution and data\ndependency analysis. A significant advantage of combining symbolic with static\nanalysis is that it scales much better than symbolic alone and does not have\nthe problem of false positive that static analysis tools typically have. We\nhave implemented our technique in a tool called MPro, a scalable and automated\nsmart contract analyzer based on the existing symbolic analysis tool\nMythril-Classic and the static analysis tool Slither. We analyzed 100 randomly\nchosen smart contracts on MPro and our evaluation shows that MPro is about\nn-times faster than Mythril-Classic for detecting depth-n vulnerabilities,\nwhile preserving all the detection capabilities of Mythril-Classic.\n

Change impact analysis techniques estimate the potential effects of changes made to software. Directed Incremental Symbolic Execution (DiSE) is a Java PathFinder extension that computes the impact of changes on program execution behaviors. The results of DiSE are a set of impacted path conditions that can be efficiently processed by a subsequent client analysis. Path conditions, however, may not be intuitive for software developers without the context of the source code. In this paper we present a framework for visualizing the results of DiSE. The visualization includes annotated source code and control ow graphs indicating program statements that are changed and statements that may be impacted by the changes. A simulation mode enables users to also observe the impact of changes on symbolic execution of the program, by showing the changes to the path conditions as the user steps through the sequences of statements executed.

sushi and tardis are two automatic test generators for Java programs. They generate test suites, aiming to satisfy the branch coverage adequacy criterion. Both tools exploit symbolic execution to analyze the control flow paths of the program under test and generate path conditions, i.e., constraints on the program inputs that determine the execution of a path, focusing in particular on control flow paths that lead to uncovered branches. Then, sushi and tardis exploit these path conditions with a search-based algorithm to generate unit tests (in JUnit) that execute those program paths. In this paper we report the results of sushi and tardis at the seventh edition of the unit testing tool competition at the 2019 edition of the International Workshop on Search-Based Software testing.

Symbolic evaluation is a form of static program analysis in which symbolic expressions are used to denote the values of program variables and computations. It does not require the user to specify which path at a conditional branch to follow nor how many cycles of a loop to consider. Instead, a symbolic evaluator uses conditional expressions to represent the uncertainty that arises from branching and develops and attempts to solve recurrence relations that describe the behavior of loop variables.

Programmers can benefit from static source code analysis techniques in various ways: they can understand their code better, test it more effectively, debug it more efficiently, and so on. However, they often face the challenge of discovering how to reproduce faulty executions that cause runtime errors. The term symbolic execution refers to a static source code analysis method that can help with this challenge. In this paper, we are showing a symbolic execution-based analysis method to find the source of a runtime error. The method uses a control-flow graph to select the execution paths reaching the targeted runtime error. The algorithm is implemented as part of the RefactorErl static program analysis and transformation framework.

An integrated dynamic memory tracing tool for C++