GARUDA

Abstract

Symbolic execution is a widely employed technique in vulnerability detection. However, it faces an acute problem of state space explosion when analyzing programs that dynamically allocate memory. In this work we present GARUDA that makes the symbolic execution heap-aware to mitigate the state space explosion problem. We show that GARUDA can detect vulnerabilities in real-world software and can generate inputs to trigger two more safety violations than the winner of the TestComp2021 testing competition in the heap safety category of TestComp2021 benchmarks.