Precise pointer reasoning for dynamic test generation

  • Authors:

  • Bassem Elkarablieh;Patrice Godefroid;Michael Y. Levin

  • Affiliations:

  • UT Austin, Austin, TX, USA;Microsoft Research, Redmond, WA, USA;Microsoft CSE, Redmond, WA, USA

  • Venue:
  • Proceedings of the eighteenth international symposium on Software testing and analysis
  • Year:
  • 2009

Quantified Score

Hi-index 0.02

Visualization

Abstract

Dynamic test generation consists of executing a program while gathering symbolic constraints on inputs from predicates encountered in branch statements, and of using a constraint solver to infer new program inputs from previous constraints in order to steer next executions towards new program paths. Variants of this technique have recently been adopted in several bug detection tools, including our whitebox fuzzer SAGE, which has found dozens of new expensive security-related bugs in many Windows applications and is now routinely used in various Microsoft groups. In this paper, we discuss how to perform precise symbolic pointer reasoning in the context of dynamic test generation. We present a new memory model for representing arbitrary symbolic pointer dereferences to memory regions accessible by a program during its execution, and show that this memory model is the most precise one can hope for in our context, under some realistic assumptions. We also describe how the symbolic constraints generated by our model can be solved using modern SMT solvers, which provide powerful constructs for reasoning about bit-vectors and arrays. This new memory model has been implemented in SAGE, and we present results of experiments with several large Windows applications showing that an increase in precision can often be obtained at a reasonable cost. Better precision in symbolic pointer reasoning means more relevant constraints and fewer imprecise ones, hence better test coverage, more bugs found and fewer redundant test cases.