A few billion lines of code later: using static analysis to find bugs in the real world

Authors:
Al Bessey;Ken Block;Ben Chelf;Andy Chou;Bryan Fulton;Seth Hallem;Charles Henri-Gros;Asya Kamsky;Scott McPeak;Dawson Engler
Affiliations:
Coverity, Inc.;Coverity, Inc.;Coverity, Inc.;Coverity, Inc.;Coverity, Inc.;Coverity, Inc.;Coverity, Inc.;Coverity, Inc.;Coverity, Inc.;Stanford University, Stanford, CA
Venue:
Communications of the ACM
Year:
2010

Citing 8
Cited 76

A static analyzer for finding dynamic programming errors

Software—Practice & Experience
Automatically validating temporal safety properties of interfaces

SPIN '01 Proceedings of the 8th international SPIN workshop on Model checking of software
Flow-sensitive type qualifiers

PLDI '02 Proceedings of the ACM SIGPLAN 2002 Conference on Programming language design and implementation
ESP: path-sensitive program verification in polynomial time

PLDI '02 Proceedings of the ACM SIGPLAN 2002 Conference on Programming language design and implementation
A system and language for building system-specific, static analyses

PLDI '02 Proceedings of the ACM SIGPLAN 2002 Conference on Programming language design and implementation
Extended static checking for Java

PLDI '02 Proceedings of the ACM SIGPLAN 2002 Conference on Programming language design and implementation
Context- and path-sensitive memory leak detection

Proceedings of the 10th European software engineering conference held jointly with 13th ACM SIGSOFT international symposium on Foundations of software engineering
Checking system rules using system-specific, programmer-written compiler extensions

OSDI'00 Proceedings of the 4th conference on Symposium on Operating System Design & Implementation - Volume 4

Towards a unified fault-detection benchmark

Proceedings of the 9th ACM SIGPLAN-SIGSOFT workshop on Program analysis for software tools and engineering
SUDS: an infrastructure for creating dynamic software defect detection tools

Automated Software Engineering
The Google FindBugs fixit

Proceedings of the 19th international symposium on Software testing and analysis
Visual analysis of code security

Proceedings of the Seventh International Symposium on Visualization for Cyber Security
TypeChef: toward type checking #ifdef variability in C

FOSD '10 Proceedings of the 2nd International Workshop on Feature-Oriented Software Development
On the shoulders of giants

Proceedings of the FSE/SDP workshop on Future of software engineering research
The case for software evolution

Proceedings of the FSE/SDP workshop on Future of software engineering research
Human-centric software engineering

Proceedings of the FSE/SDP workshop on Future of software engineering research
FITE: future integrated testing environment

Proceedings of the FSE/SDP workshop on Future of software engineering research
Familiarity breeds contempt: the honeymoon effect and the role of legacy code in zero-day vulnerabilities

Proceedings of the 26th Annual Computer Security Applications Conference
Practical experiences of applying source-level WCET flow analysis on industrial code

ISoLA'10 Proceedings of the 4th international conference on Leveraging applications of formal methods, verification, and validation - Volume Part II
EASY meta-programming with Rascal

GTTSE'09 Proceedings of the 3rd international summer school conference on Generative and transformational techniques in software engineering III
ConSeq: detecting concurrency bugs through sequential errors

Proceedings of the sixteenth international conference on Architectural support for programming languages and operating systems
S2E: a platform for in-vivo multi-path analysis of software systems

Proceedings of the sixteenth international conference on Architectural support for programming languages and operating systems
Static program analysis of large embedded code base: an experience

Proceedings of the 4th India Software Engineering Conference
Taming reflection: Aiding static analysis in the presence of reflection and custom class loaders

Proceedings of the 33rd International Conference on Software Engineering
Why software quality improvement fails (and how to succeed nevertheless)

Proceedings of the 33rd International Conference on Software Engineering
Evolving patches for software repair

Proceedings of the 13th annual conference on Genetic and evolutionary computation
A formalization of the C99 standard in HOL, isabelle and Coq

MKM'11 Proceedings of the 18th Calculemus and 10th international conference on Intelligent computer mathematics
Finding resource-release omission faults in Linux

PLOS '11 Proceedings of the 6th Workshop on Programming Languages and Operating Systems
Configuration coverage in the analysis of large-scale system software

PLOS '11 Proceedings of the 6th Workshop on Programming Languages and Operating Systems
Beyond Green: Evolution to Adaptability and Recyclability

GREENCOM '11 Proceedings of the 2011 IEEE/ACM International Conference on Green Computing and Communications
Bootstrapping energy debugging on smartphones: a first look at energy bugs in mobile devices

Proceedings of the 10th ACM Workshop on Hot Topics in Networks
REASSURE: a self-contained mechanism for healing software using rescue points

IWSEC'11 Proceedings of the 6th International conference on Advances in information and computer security
Finding resource-release omission faults in Linux

ACM SIGOPS Operating Systems Review
Configuration coverage in the analysis of large-scale system software

ACM SIGOPS Operating Systems Review
AutoLog: facing log redundancy and insufficiency

Proceedings of the Second Asia-Pacific Workshop on Systems
The S2E Platform: Design, Implementation, and Applications

ACM Transactions on Computer Systems (TOCS) - Special Issue APLOS 2011
A case for unlimited watchpoints

ASPLOS XVII Proceedings of the seventeenth international conference on Architectural Support for Programming Languages and Operating Systems
ATDetector: improving the accuracy of a commercial data race detector by identifying address transfer

Proceedings of the 44th Annual IEEE/ACM International Symposium on Microarchitecture
AEGIS Automated Science Targeting for the MER Opportunity Rover

ACM Transactions on Intelligent Systems and Technology (TIST)
A road to a formally verified general-purpose operating system

ISARCS'10 Proceedings of the First international conference on Architecting Critical Systems
High false positive detection of security vulnerabilities: a case study

Proceedings of the 50th Annual Southeast Regional Conference
Automated error diagnosis using abductive inference

Proceedings of the 33rd ACM SIGPLAN conference on Programming Language Design and Implementation
SuperC: parsing all of C by taming the preprocessor

Proceedings of the 33rd ACM SIGPLAN conference on Programming Language Design and Implementation
Fully automatic and precise detection of thread safety violations

Proceedings of the 33rd ACM SIGPLAN conference on Programming Language Design and Implementation
Inferring definite counterexamples through under-approximation

NFM'12 Proceedings of the 4th international conference on NASA Formal Methods
System-specific static code analyses: a case study in the complex embedded systems domain

Software Quality Control
Software needs seatbelts and airbags

Communications of the ACM
Software Needs Seatbelts and Airbags

Queue - Debugging
Language design and analyzability: a retrospective

Software—Practice & Experience
Use, disuse, and misuse of automated refactorings

Proceedings of the 34th International Conference on Software Engineering
Leveraging test generation and specification mining for automated bug detection without false positives

Proceedings of the 34th International Conference on Software Engineering
Statically checking API protocol conformance with mined multi-object specifications

Proceedings of the 34th International Conference on Software Engineering
Extending static analysis by mining project-specific rules

Proceedings of the 34th International Conference on Software Engineering
Industrial application of concolic testing approach: a case study on libexif by using CREST-BV and KLEE

Proceedings of the 34th International Conference on Software Engineering
A study on improving static analysis tools: why are we not using them?

Proceedings of the 34th International Conference on Software Engineering
SymDrive: testing drivers without devices

OSDI'12 Proceedings of the 10th USENIX conference on Operating Systems Design and Implementation
Green: reducing, reusing and recycling constraints in program analysis

Proceedings of the ACM SIGSOFT 20th International Symposium on the Foundations of Software Engineering
XIAO: tuning code clones at hands of engineers in practice

Proceedings of the 28th Annual Computer Security Applications Conference
Self-healing multitier architectures using cascading rescue points

Proceedings of the 28th Annual Computer Security Applications Conference
Effective pattern-driven concurrency bug detection for operating systems

Journal of Systems and Software
Detecting missing method calls as violations of the majority rule

ACM Transactions on Software Engineering and Methodology (TOSEM)
Static correspondence and correlation between field defects and warnings reported by a bug finding tool

Software Quality Control
A novel approach for discovering barriers in using automatic static analysis

Proceedings of the 17th International Conference on Evaluation and Assessment in Software Engineering
Almost-correct specifications: a modular semantic framework for assigning confidence to warnings

Proceedings of the 34th ACM SIGPLAN conference on Programming language design and implementation
Variable and thread bounding for systematic testing of multithreaded programs

Proceedings of the 2013 International Symposium on Software Testing and Analysis
Dynamically validating static memory leak warnings

Proceedings of the 2013 International Symposium on Software Testing and Analysis
Why don't software developers use static analysis tools to find bugs?

Proceedings of the 2013 International Conference on Software Engineering
Pathways to technology transfer and adoption: achievements and challenges (mini-tutorial)

Proceedings of the 2013 International Conference on Software Engineering
Effective dynamic detection of alias analysis errors

Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering
Will you still compile me tomorrow? static cross-version compiler validation

Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering
Making parallel programs reliable with stable multithreading

Communications of the ACM
Scalable and incremental software bug detection

Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering
File systems deserve verification too!

Proceedings of the Seventh Workshop on Programming Languages and Operating Systems
Social influences on secure development tool adoption: why security tools spread

Proceedings of the 17th ACM conference on Computer supported cooperative work & social computing
Native ×86 decompilation using semantics-preserving structural analysis and iterative control-flow structuring

SEC'13 Proceedings of the 22nd USENIX conference on Security
FIE on firmware: finding vulnerabilities in embedded systems using symbolic execution

SEC'13 Proceedings of the 22nd USENIX conference on Security
DEFINED: deterministic execution for interactive control-plane debugging

USENIX ATC'13 Proceedings of the 2013 USENIX conference on Annual Technical Conference
The Solid* toolset for software visual analytics of program structure and metrics comprehension: From research prototype to product

Science of Computer Programming
The Solid* toolset for software visual analytics of program structure and metrics comprehension: From research prototype to product

Science of Computer Programming
Concurrency testing using schedule bounding: an empirical study

Proceedings of the 19th ACM SIGPLAN symposium on Principles and practice of parallel programming
Trace driven dynamic deadlock detection and reproduction

Proceedings of the 19th ACM SIGPLAN symposium on Principles and practice of parallel programming
A Study of Linux File System Evolution

ACM Transactions on Storage (TOS)
Runtime verification of microcontroller binary code

Science of Computer Programming
A study of Linux file system evolution

FAST'13 Proceedings of the 11th USENIX conference on File and Storage Technologies

Quantified Score

Hi-index	48.25

Visualization

Abstract

How Coverity built a bug-finding tool, and a business, around the unlimited supply of bugs in software systems.