Abstract

Automatic detection of bugs in programs is an extremely important direction of current research and development in the field of program reliability and security assurance. Earlier studies covered, methods for program analysis that combine the dynamic symbolic execution, randomized testing, and static analysis. In this paper, a formal model for detecting bugs using the symbolic execution of programs and its implementation for detecting the buffer bounds violation is presented. A formal model of the program symbolic execution is described, and a theorem on detecting a bug on the basis of the violation of the operation domain is formulated and proved. An implementation of the buffer bounds violation analyzer in the process of symbolic program execution is described, and the application of the implemented prototype for analyzing a set of programs in Debian Linux is presented. The experiments confirm the actionability of the proposed method.

中文翻译：

---

通过程序的符号执行检测错误的正式模型

摘要

在程序可靠性和安全性保证领域，自动检测程序中的错误是当前研究和开发的极其重要的方向。较早的研究涵盖了程序分析的方法，这些方法结合了动态符号执行，随机测试和静态分析。在本文中，提出了一种使用程序的符号执行来检测错误的形式化模型及其用于检测缓冲区界限冲突的实现。描述了程序符号执行的形式模型，并提出并证明了基于违反操作域的错误检测定理。描述了在符号程序执行过程中缓冲区边界违反分析器的实现，并介绍了已实现的原型在Debian Linux中分析一组程序的应用。实验证实了该方法的可行性。