IntRepair: Informed Repairing of Integer Overflows

• Published in: IEEE transactions on software engineering Vol. 47; no. 10; pp. 2225 - 2241
• Main Authors: Muntean, Paul, Monperrus, Martin, Sun, Hao, Grossklags, Jens, Eckert, Claudia
• Format: Journal Article
• Language: English
• Published: New York IEEE 01.10.2021; IEEE Computer Society
• Subjects: Application programs; Applications programs; C (programming language); Computer software; Electric fuses; Engines; Fault detection; Fuses; integer overflow; Integer programming; Integers; Maintainability; Maintenance engineering; Model checking; Program repair; Repair; Runtime; Runtimes; Software; software bug; software fault; Software testing; Source code; source code refactoring; Source codes; static program analysis; symbolic execution
• ISSN: 0098-5589; 1939-3520; 1939-3520
• DOI: 10.1109/TSE.2019.2946148

Integer overflows have threatened software applications for decades. Thus, in this paper, we propose a novel technique to provide automatic repairs of integer overflows in C source code. Our technique, based on static symbolic execution, fuses detection , repair generation and validation . This technique is implemented in a prototype named IntRepair . We applied IntRepair to 2,052 C programs (approx. 1 million lines of code) contained in SAMATE's Juliet test suite and 50 synthesized programs that range up to 20 KLOC. Our experimental results show that IntRepair is able to effectively detect integer overflows and successfully repair them, while only increasing the source code (LOC) and binary (Kb) size by around 1 percent, respectively. Further, we present the results of a user study with 30 participants which shows that IntRepair repairs are more than 10x efficient as compared to manually generated code repairs.