SUDS: An Infrastructure for Creating Bug Detection Tools Eric Larson October 1, 2007 Seattle University

What is SUDS? SUDS is an infrastructure to facilitate the construction of software bug detection tools. SUDS primarily used to create dynamic bug detection tools. Contains static analysis phases used to improve / focus dynamic bug detection. At the heart of SUDS is a C to (instrumented) C converter.

Program (preprocessed Overview of SUDS Program (preprocessed C source code) SUDS AST Parse Simplify Simplified AST Analyze Analysis Results Instrumentation Model Instrument Instrumented Source Code Instrumented Executable Link

Static Analysis Standard compiler analyses Tainted propagation Control flow graph / call graph Data flow analysis (mostly intraprocedural) Flow-sensitive pointer analysis (Hind et. al.) Tainted propagation Propagates tainted attribute of variables (forward) User can modify infrastructure to change what tainted means Program slicing Propagates interesting uses backwards User can modify slicing criterion (can be all statements that have this property or characteristic) Context-insensitive

Instrumentation Direct SUDS where to add instrumentation. Add instrumentation based on statement, expression, or event. Support functions allow users to easily pass parameters into the instrumentation functions. Write the instrumentation routines. Can use provided state table: allows the instrumented program to keep track of additional state when the program is running. Can take advantage of results from static analysis phases.

Example of how SUDS is used Goal: To detect buffer overflows for array references that uses data that came from input. Tainted analysis: All input data is tainted. Program slicing: All data that can lead to an array reference is in the slice. Instrumentation: Track all arrays and their sizes. Track pointers to arrays. Track integers that are tainted and in the slice. At array references, check for bugs.

Results: Finding Bugs Program SUDS SPLINT VALGRIND Bugs Same Bugs New Bugs anagram 2 ft ks 3 yacr2 betaftpd 1 gaim ghttpd openssh didn't work thttpd

Results: Performance 0.06 1.88 31.33 3.15 52.50 1.32 22.00 58.1% 0.18 Program Base line Valgrind SUDS Unoptimized SUDS Optimized Perf. Improve % Time Ratio anagram 0.06 1.88 31.33 3.15 52.50 1.32 22.00 58.1% ft 0.18 5.92 32.89 5.32 29.56 0.88 4.89 83.5% ks 0.05 4.16 83.20 3.96 79.20 0.45 9.00 88.6% yacr2 0.12 3.83 31.92 22.63 188.58 11.87 98.92 47.5% betaftpd 0.07 6.43 0.53 7.57 0.27 3.86 49.1% ghttpd 0.52 35.60 68.46 1.08 2.08 0.69 1.33 36.1% openssh 0.70 didn't work 1.00 1.43 0.91 1.30 9.0% thttpd 0.15 0.29 1.93 2.57 17.13 1.78 30.7%

Future Work Add phase(s) that attempt to detect bugs using static analysis. Certain types of bugs can use data flow analysis but need to prune false alarms. Develop static analysis phases that improve the quality of dynamic bug detection, not just the performance.

Questions