Automatic Fix for C Integer Errors by Precision Improvement
This research is sponsored in part by National Natural Science Foundation of China (Grant No. 91218302, 61402248) and the Ministry of Industry and Information Technology IT funds (Research and application of TCN key technologies) of China.
Computer Software and Applications Conference (COMPSAC), 2016 IEEE 40th Annual
Integer errors in C program may lead to serious failures and vulnerabilities. They are harbored in a wide range of programs including mature software such as Linux kernel. Code reviewing is laborious and cannot guarantee reliable fixes for errors. Addressing potential errors in the development phase is error-prone even for experts and essentially hinders developing efficiency. In this paper we propose a novel approach to automate fix for C integer errors. Our approach directly replaces original C integers with dynamic-precision integers to fix potential errors without detecting them in advance. Many errors can be fixed by precision improvement without changing the design of application. We implement a tool CIntFix to automatically fix C integer errors. CIntFix succeeds in fixing all 5414 programs in NIST's Juliet test suite from 7 weakness categories. Meanwhile, on Juliet test suite and SPEC CINT2000 benchmarks, CIntFix processes C source code at the rate of 0.157s/KLOC and the fixed programs have 18.0% slowdown on average. The results show that CIntFix is capable to fix integer errors in real-world C programs.
Locate the Document
X. Cheng, M. Zhou, X. Song, M. Gu and J. Sun, "Automatic Fix for C Integer Errors by Precision Improvement," 2016 IEEE 40th Annual Computer Software and Applications Conference (COMPSAC), Atlanta, GA, 2016, pp. 2-11.