Abstract:Security bugs like memory errors are constantly introduced to software programs, and recent years have witnessed an increasing number of reported security bugs. Traditional detection approaches are mainly specification-based---detecting violations against a specified rule as security bugs. This often does not work well in practice because specifications are difficult to specify and generalize, leaving complicated and new types of bugs undetected. Recent research thus leans toward deviation-based detection which finds a substantial number of similar cases and detects deviating cases as potential bugs. This, however, suffers from two other problems. First, it requires enough similar cases to find deviations and thus cannot work for custom code that does not have similar cases. Second, code-similarity analysis is probabilistic and challenging, so the detection can be unreliable. Sometimes, similar cases can normally have deviating behaviors under different contexts. In this paper, we propose a novel approach for detecting security bugs based on a new concept called Non-Distinguishable Inconsistencies (NDI). The insight is that if two code paths in a function exhibit inconsistent security states (such as being freed or initialized) that are non-distinguishable from the external, such as the callers, there is no way to recover from the inconsistency from the external, which results in a bug. Such an approach has several strengths. First, it is specification-free and thus can support complicated and new types of bugs. Second, it does not require similar cases and by its nature is deterministic. Third, the analysis is practical by minimizing complicated and lengthy data-flow analysis. We implemented NDI and applied it to well-tested programs, including the OpenSSL library, the FreeBSD kernel, the Apache httpd server, and the PHP interpreter. The results show that NDI works for both large and small programs, and it effectively found 51 new bugs, most of which are otherwise missed by the state-of-the-art detection tools.

Finding and Understanding Defects in Static Analyzers by Constructing Automated Oracles

Supporting secure programming in web applications through interactive static analysis.

An Empirical Study of False Negatives and Positives of Static Code Analyzers From the Perspective of Historical Issues

Statfier: Automated Testing of Static Analyzers Via Semantic-Preserving Program Transformations

Understanding and Detecting Annotation-Induced Faults of Static Analyzers

Find bugs in static bug finders

Efficacy of static analysis tools for software defect detection on open-source projects

Canalyze: a Static Bug-Finding Tool for C Programs.

Practical and accurate pinpointing of configuration errors using static analysis

Patch Space Exploration using Static Analysis Feedback

Research on Static Source Analysis Technology Based on Defect Pattern Matching

Towards More Reliable Automated Program Repair by Integrating Static Analysis Techniques

Evaluating and Integrating Diverse Bug Finders for Effective Program Analysis

Implementing and Executing Static Analysis Using LLVM and CodeChecker

Automatically Inspecting Thousands of Static Bug Warnings with Large Language Model: How Far Are We?

An Approach to Detecting Bugs in Pattern-Based Bug Detectors

Supporting Oracle Construction Via Static Analysis

Non-Distinguishable Inconsistencies As a Deterministic Oracle for Detecting Security Bugs.

Validating Static Warnings via Testing Code Fragments

Improving The Precision Of Static Analysis: Symbolic Execution Based On Ggcc Abstract Syntax Tree

Scaling Symbolic Execution to Large Software Systems