Trigger condition based test generation for finding security bugs

Abstract

Software vulnerabilities become methods by which an attacker can take control of the victim's system, and those critical bugs cluster in dangerous spot codes. However, fuzz testing provides low code coverage and serious security bugs may be missed potentially, while symbolic execution based testing encounters path explosion and bug trigger problem. To deal with the security issue above, we highlight two kinds of dangerous spot codes which mostly likely to trigger buffer overflows at runtime: dangerous functions and instructions. We define the conditions on which dangerous spot code can trigger a bug: input-dependent operand, feasible execution path, and trigger conditions. Then we give algorithm for trigger point directed search in order to find the shortest feasible path in CFG, and formalize the trigger conditions for integer overflow, string buffer overflow, array out of bound and division by zero bugs. At last we evaluate the implementation in four benchmark programs in Ubuntu Linux, showing that our method improves the coverage rate of trigger point and trigger rate of overflows efficiently.