Automatically Detecting Error Handling Bugs Using Error Specifications
summary
Automated tool EPEX uses under constrained symbolic execution plus explicit error specifications to explore only error paths and flag incorrect handling. It runs inside Clang/client on 867k lines across nine SSL/TLS projects, reports 132 candidates of which 102 are confirmed (78% precision), finds 53 bugs that break SSL/TLS guarantees, and reduces false alarms by cross‑site consistency checks; 256 functions got specs (38 unique), and the evaluation shows low false negatives and practical runtime for nightly builds.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:40Error handling is especially problematic in C
- 4:06Error path exploration
- 5:11Generic error handling oracle
- 6:46Bug localization
- 7:14Minimize false positives
- 9:33How does EPEx work?
- 11:38How hard is creating error specs?
- 13:00Implementing EPEx in Clang
- 13:40Evaluation subjects
- 14:00Accuracy
- 14:17Running time
- 16:23OpenSSL
- 17:18GnuTLS
- 18:36A sample false positive
- 20:27Conclusions
related talks
59mUnder-approximation for Scalable Bug Detection
29mFinding real bugs in big programs with incorrectness logic
20mAutomatic and Incremental Repair for Speculative Information Leaks
18mSecuring Erlang and Elixir applications
27mTrusted JavaScript Language Environments with ESMeta
44mA Practical Approach to Error Handling
42mContemporary Automatic Program Analysis
44mA Practical Approach to Error Handling