一句话：提出 EESI 静态分析，借助开发者提供的错误处理领域知识推断 C 函数的错误返回值集合，并用于自动发现错误处理缺陷。
本文研究使用返回码惯用法（return-code idiom）的 C 程序中的错误处理问题：错误是否存在及其类型被编码在函数返回值中，而错误处理不当会导致安全漏洞与数据丢失。作者提出 EESI，一种静态分析，用于推断函数在出错时可能返回的值集合，即函数错误规约，该规约随后可用于识别错误处理相关的缺陷。EESI 的核心思想是以开发者提供的错误处理领域知识来引导（bootstrap）分析，并结合过程内流敏感分析与过程间上下文不敏感分析，以同时保证精度与可扩展性。作者实现了工具 ECC，用以展示如何利用 EESI 推断的函数错误规约自动发现错误处理缺陷。在 9 个程序上，ECC 检测出 246 个缺陷，其中 110 个已被确认；220 个为此前未知的缺陷，其中 99 个得到确认，且已有两个补丁被合并进 OpenSSL。
Error-handling code responds to the occurrence of runtime errors. Failure to correctly handle errors can lead to security vulnerabilities and data loss. This paper deals with error handling in software written in C that uses the return-code idiom: the presence and type of error is encoded in the return value of a function. This paper describes EESI, a static analysis that infers the set of values that a function can return on error. Such a function error-specification can then be used to identify bugs related to incorrect error handling. The key insight of EESI is to bootstrap the analysis with domain knowledge related to error handling provided by a developer. EESI uses a combination of intraprocedural, flow-sensitive analysis and interprocedural, context-insensitive analysis to ensure precision and scalability. We built a tool ECC to demonstrate how the function error-specifications inferred by EESI can be used to automatically find bugs related to incorrect error handling. ECC detected 246 bugs across 9 programs, of which 110 have been confirmed. ECC detected 220 previously unknown bugs, of which 99 are confirmed. Two patches have already been merged into OpenSSL.
@inproceedings{paperbot5066,
title = {Effective error-specification inference via domain-knowledge expansion},
author = {Daniel DeFreez and Haaken Martinson Baldwin and Cindy Rubio-González and Aditya V. Thakur},
booktitle = {FSE},
year = {2019},
doi = {10.1145/3338906.3338960}
}