The use of dynamic analysis for generation of input data that demonstrates critical bugs and vulnerabilities in programs

  • Authors:
  • I. K. Isaev;D. V. Sidorov

  • Affiliations:
  • Institute for System Programming, Russian Academy of Sciences, Moscow, Russia 109004;Institute for System Programming, Russian Academy of Sciences, Moscow, Russia 109004

  • Venue:
  • Programming and Computing Software
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

The article presents Avalanche--a dynamic analysis defect detection tool. Avalanche uses dynamic instrumentation provided by Valgrind [1] to collect and analyze the trace of program execution. The result of such an analysis is a set of input data which either shows an error in the program or allows next iteration to cover fragments of the program that were not yet executed and, therefore, checked. Thus, starting from a single test case, Avalanche implements iterative dynamic analysis, repeatedly executing the program with various automatically generated test data, while each execution increases the coverage of code. The article describes Avalanche internals, and discusses the results of analysis of several open source projects with Avalanche, which resulted in detection of over 15 bugs. Many of the detected bugs are confirmed and fixed by developers.