SymRadar: PoC-Centered Bounded Verification for Vulnerability Repair
In this paper, we tackle the problem of patch verification. While automated vulnerability repair (AVR) techniques are gaining traction, it is not sufficient to merely generate patches; providing evidence of their correctness is also essential. However, the current state-of-the-art patch verification methods are not sufficiently effective. To address this issue, we propose SymRadar, a patch verification tool that performs under-constrained symbolic execution (UC-SE) on the patched function. Unlike standard UC-SE, SymRadar conducts UC-SE in the vicinity of the crash-inducing input. We demonstrate that SymRadar is more effective than existing patch verification methods. Another challenge in verifying patches generated by AVR tools is the large number of patches generated. To address this, we propose a novel optimization technique that allows SymRadar to handle multiple patches efficiently. Our experimental evaluation demonstrates that SymRadar is both effective and efficient in verifying patches generated by AVR tools.
Wed 15 AprDisplayed time zone: Brasilia, Distrito Federal, Brazil change
14:00 - 15:30 | Testing and Analysis 4Research Track / SE In Practice (SEIP) at Oceania IX Chair(s): Anil Koyuncu Bilkent University | ||
14:00 15mTalk | SymRadar: PoC-Centered Bounded Verification for Vulnerability Repair Research Track | ||
14:15 15mTalk | Fine-Grained Analyses for Evolution-Aware Runtime Verification Research Track Pengyue Jiang Cornell University, Kevin Guan Cornell University, M. Mahdi Khosravi Middle East Technical University, Moustafa Ismail Middle East Technical University, Marcelo d'Amorim North Carolina State University, Owolabi Legunsen Cornell University | ||
14:30 15mTalk | An Empirical Study on Static Application Security Testing (SAST) Tools for PythonDistinguished Paper Award Research Track Liu Zhuohang Nankai University, Zhi Wang Nankai University, Haotong Liu Nankai University, Wanpeng Li University of Liverpool | ||
14:45 15mTalk | NotDec: WebAssembly Decompilation With Inter-Procedural Type Recovery Research Track Jikai Wang Huazhong University of Science and Technology, Ningyu He Hong Kong Polytechnic University, Tianming Liu Huazhong University of Science and Technology, Junhai Wang Huazhong University of Science and Technology, Haoyu Wang Huazhong University of Science and Technology Media Attached File Attached | ||
15:00 15mTalk | PyXray: Practical Cross-Language Call Graph Construction through Object Layout Analysis Research Track Georgios Alexopoulos University of Athens, Thodoris Sotiropoulos ETH Zurich, Georgios Gousios Endor Labs, Zhendong Su ETH Zurich, Dimitris Mitropoulos University of Athens Pre-print | ||
15:15 15mTalk | HapCheck: DSL-Based Static Bug Detection Framework for OpenHarmony SE In Practice (SEIP) Xitong Zhong Beihang University, Chang Liu Beihang University, Runlin Liu Beihang University, Zifu Xu Beihang University, Zhengyao Liu Beihang University, Juqi Zhou Beihang University, Gang Fan Huawei Hong Kong Research Centre, Mingyi Zhou Beihang University, Xiang Gao Beihang University, Li Li Beihang University | ||