StrSolve: Solving string constraints lazily

Automated Software Engineering

Volumn 19, Issue 4, 2012, Pages 531-559

  Hooimeijer, Pieter ^a   Weimer, Westley ^a  

^a NONE   (United States)

Author keywords

Decision procedure; Regular language; Scalability; String

Indexed keywords

FORMAL LANGUAGES; LOGIC PROGRAMMING; SCALABILITY;

CONSTRAINT SOLVING; CONTEMPORARY TECHNIQUES; DECISION PROCEDURE; INPUT CONSTRAINTS; ORDERS OF MAGNITUDE; RECENT RESEARCHES; SATISFYING ASSIGNMENTS; STRING;

SOFTWARE TESTING;

EID: 84865235665     PISSN: 09288910     EISSN: 15737535     Source Type: Journal    
DOI: 10.1007/s10515-012-0111-x     Document Type: Article

References (51)

1. R. Axelsson K. Heljanko M. Lange 2008 Analyzing context-free grammars using an incremental sat solver International Colloquium on Automata, Languages and Programming 410 422 10.1007/978-3-540-70583-3-34 10.1007/978-3-540-70583-3- 34
2. Axelsson, R.; Heljanko, K.; Lange, M.: Analyzing context-free grammars using an incremental sat solver. In: International Colloquium on Automata, Languages and Programming, pp. 410-422 (2008). doi: 10.1007/978-3-540-70583-3-34
3. Balzarotti, D.; Cova, M.; Felmetsger, V.; Jovanovic, N.; Kirda, E.; Kruegel, C.; Vigna, G.: Saner: composing static and dynamic analysis to validate sanitization in web applications. In: IEEE Symposium on Security and Privacy, pp. 387-401 (2008)
4. Bjørner, N.; Tillmann, N.; Voronkov, A.: Path feasibility analysis for string-manipulating programs. In: Tools and Algorithms for the Construction and Analysis of Systems (2009)
5. R.E. Bryant 1986 Graph-based algorithms for boolean function manipulation IEEE Trans. Comput. 35 8 677 691 0593.94022 10.1109/TC.1986.1676819
6. Cadar, C.; Godefroid, P.; Khurshid, S.; Pasareanu, C.S.; Sen, K.; Tillmann, N.; Visser, W.: Symbolic execution for software testing in practice: preliminary assessment. In: International Conference on Software Engineering, pp. 1066-1071 (2011)
7. Christensen, A.S.; Møller, A.; Schwartzbach, M.I.: Precise analysis of string expressions. In: International Symposium on Static Analysis, pp. 1-18 (2003)
8. de Moura, L.M.; Bjørner, N.: Z3: an efficient SMT solver. In: Tools and Algorithms for the Construction and Analysis of Systems (2008)
9. D. Detlefs G. Nelson J.B. Saxe 2005 Simplify: a theorem prover for program checking J. ACM 52 3 365 473 10.1145/1066100.1066102 2146512 10.1145/1066100.1066102 (Pubitemid 43078377)
10. Eén, N.; Sörensson, N.: An extensible sat-solver. In: Theory and Applications of Satisfiability Testing, pp. 502-518 (2003)
11. Fu, X.; Li, C.C.: Modeling regular replacement for string constraint solving. In: Muñoz, C. (ed.) Proceedings of the Second NASA Formal Methods Symposium (NFM 2010), NASA/CP-2010-216215, NASA, Langley Research Center, Hampton, VA 23681-2199, USA, pp. 67-76 (2010)
12. Fu, X.; Powell, M.; Bantegui, M.; Li, C.C.: Simple linear string constraints. Form. Asp. Comput. 1-45 (2012). doi: 10.1007/s00165-011-0214-3
13. Fujitsu Laboratories: Fujitsu develops technology to enhance comprehensive testing of Java programs (2010). URL http://www.fujitsu.com/ global/news/pr/archives/month/2010/20100112-02.html
14. Ganesh, V.; Dill, D.L.: A decision procedure for bit-vectors and arrays. In: Computer-Aided Verification, pp. 519-531 (2007)
15. Godefroid, P.; Klarlund, N.; Sen, K.: DART: directed automated random testing. In: Programming Language Design and Implementation (2005)
16. Godefroid, P.; Kiezun, A.; Levin, M.Y.: Grammar-based whitebox fuzzing. In: Programming Language Design and Implementation (2008a)
17. Godefroid, P.; Levin, M.; Molnar, D.: Automated whitebox fuzz testing. In: Network Distributed Security Symposium (2008b)
18. Henriksen, J.; Jensen, J.; Jørgensen, M.; Klarlund, N.; Paige, B.; Rauhe, T.; Sandholm, A.: Mona: monadic second-order logic in practice. In: TACAS '95. LNCS, vol. 1019. Springer, Berlin (1995)
19. Hooimeijer, P.; Veanes, M.: An evaluation of automata algorithms for string analysis. In: Verification, Model Checking, and Abstract Interpretation, pp. 248-262 (2011)
20. Hooimeijer, P.; Weimer, W.: A decision procedure for subset constraints over regular languages. In: Programming Languages Design and Implementation, pp. 188-198 (2009)
21. Hooimeijer, P.; Weimer, W.: Solving string constraints lazily. In: Automated Software Engineering, pp. 377-386 (2010)
22. Hooimeijer, P.; Livshits, B.; Molnar, D.; Saxena, P.; Veanes, M.: Fast and precise sanitizer analysis with bek. In: USENIX Security Symposium, pp. 1-15 (2011)
23. L. Ilie S. Yu 2003 Follow automata Inf. Comput. 186 1 140 162 10.1016/S0890-5401(03)00090-7 2001743 1059.68063 10.1016/S0890-5401(03)00090-7
24. Kiezun, A.; Ganesh, V.; Guo, P.J.; Hooimeijer, P.; Ernst, M.D.: Hampi: a solver for string constraints. In: International Symposium on Software Testing and Analysis, pp. 105-116 (2009)
25. Lakhotia, K.; McMinn, P.; Harman, M.: Handling dynamic data structures in search based testing. In: Proceedings of the Genetic and Evolutionary Computation Conference, pp. 1759-1766 (2008)
26. Lakhotia, K.; McMinn, P.; Harman, M.: Automated test data generation for coverage: haven't we solved this problem yet? In: Testing Academia and Industry Conference, pp. 95-104 (2009)
27. K. Lakhotia P. McMinn M. Harman 2010 An empirical investigation into branch coverage for c programs using cute and Austin J. Syst. Softw. 83 12 2379 2391 10.1016/j.jss.2010.07.026
28. Li, N.; Xie, T.; Tillmann, N.; de Halleux, J.; Schulte, W.: Reggae: automated test generation for programs using complex regular expressions. In: Automated Software Engineering Short Paper (2009)
29. Majumdar, R.; Sen, K.: Hybrid concolic testing. In: International Conference on Software Engineering, pp. 416-426 (2007)
30. Majumdar, R.; Xu, R.G.: Directed test generation using symbolic grammars. In: Automated Software Engineering, pp. 134-143 (2007)
31. Y. Minamide 2005 Static approximation of dynamically generated web pages International Conference on the World Wide Web 432 441 http://doi.acm.org/10. 1145/1060745.1060809
32. Minamide, Y.: Static approximation of dynamically generated web pages. In: International Conference on the World Wide Web, pp. 432-441 (2005). http://doi.acm.org/10.1145/1060745.1060809
33. Møller, A.; Schwartzbach, M.I.: The pointer assertion logic engine. In: Programming Language Design and Implementation, pp. 221-231 (2001)
34. Moskewicz, M.W.; Madigan, C.F.; Zhao, Y.; Zhang, L.; Malik, S.: Chaff: engineering an efficient sat solver. In: Design Automation Conference, pp. 530-535 (2001) (Pubitemid 32841010)
35. Necula, G.C.: Proof-carrying code. In: Principles of Programming Languages, pp. 106-119 (1997)
36. Pasareanu, C.S.; Mehlitz, P.C.; Bushnell, D.H.; Gundy-Burlet, K.; Lowry, M.R.; Person, S.; Pape, M.: Combining unit-level symbolic execution and system-level concrete execution for testing NASA software. In: International Symposium on Software Testing and Analysis, pp. 15-26 (2008)
37. Saxena, P.; Akhawe, D.; Hanna, S.; Mao, F.; McCamant, S.; Song, D.: A symbolic execution framework for javascript. In: IEEE Symposium on Security and Privacy, pp. 513-528 (2010)
38. Sipser, M.: Introduction to the Theory of Computation, 2nd edn. Course Technology, Independence (1997)
39. Su, Z.; Wassermann, G.: The essence of command injection attacks in web applications. In: Principles of Programming Languages, pp. 372-382 (2006)
40. Tateishi, T.; Pistoia, M.; Tripp, O.: Path- and index-sensitive string analysis based on monadic second-order logic. In: ISSTA '11, pp. 166-176. ACM, New York (2011)
41. Veanes, M.; de Halleux, P.; Tillmann, N.: Rex: symbolic regular expression explorer. In: International Conference on Software Testing, Verification and Validation, pp. 498-507 (2010)
42. Veanes, M.; Hooimeijer, P.; Livshits, B.; Molnar, D.; Bjørner, N.: Symbolic finite state transducers: algorithms and applications. In: Principles of Programming Languages, pp. 137-150 (2012)
43. Wassermann, G.; Su, Z.: Sound and precise analysis of web applications for injection vulnerabilities. In: Programming Languages Design and Implementation, pp. 32-41 (2007) (Pubitemid 47630673)
44. Wassermann, G.; Su, Z.: Static detection of cross-site scripting vulnerabilities. In: International Conference on Software Engineering (2008)
45. Weimer, W.; Nguyen, T.; Le Goues, C.; Forrest, S.: Automatically finding patches using genetic programming. In: International Conference on Software Engineering, pp. 364-374 (2009)
46. Xie, Y.; Aiken, A.: Saturn: a SAT-based tool for bug detection. In: Computer Aided Verification, pp. 139-143 (2005) (Pubitemid 41431726)
47. Xie, Y.; Aiken, A.: Static detection of security vulnerabilities in scripting languages. In: USENIX Security Symposium, pp. 179-192 (2006)
48. Yu, F.; Alkhalaf, M.; Bultan, T.: Generating vulnerability signatures for string manipulating programs using automata-based forward and backward symbolic analyses. In: Automated Software Engineering, pp. 605-609 (2009a)
49. Yu, F.; Bultan, T.; Ibarra, O.H.: Symbolic string verification: combining string analysis and size analysis. In: Tools and Algorithms for the Construction and Analysis of Systems (2009b)
50. Yu, F.; Bultan, T.; Ibarra, O.H.: Relational string verification using multi-track automata. In: Conference on Implementation and Application of Automata, pp. 290-299 (2010)
51. Yu, F.; Alkhalaf, M.; Bultan, T.: Patching vulnerabilities with sanitization synthesis. In: International Conference on Software Engineering, pp. 251-260 (2011)