Floating-Point Memory Safety Analysis via Static and Symbolic Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Whitebox fuzzing techniques are inadequate for efficiently analyzing and solving floating-point instructions, leading to inefficiencies and potential path explosion issues, especially as constraints become more complex.
Innovation Solution
A combination of lightweight local path-insensitive static analysis and symbolic execution is employed to identify and evaluate floating-point instructions and conditional statements, determining memory safety by injecting symbolic values and monitoring their usage in memory address calculations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If whitebox fuzzing techniques are used to analyze floating-point instructions, then security testing capability is improved, but analysis efficiency deteriorates and path explosion issues occur
Solution Approach 1:
The patent segments the analysis into two distinct phases: a lightweight static analysis phase that performs path-insensitive analysis to compute sets of memory addresses and registers, and a symbolic execution phase that focuses only on relevant paths. This segmentation avoids the path explosion problem by not attempting to analyze all possible execution paths in detail, thereby improving analysis efficiency while maintaining security testing capability.
Solution Approach 2:
The patent applies partial action by performing path-insensitive static analysis that computes over-approximations of memory addresses and registers without fully exploring all execution paths. This partial analysis provides sufficient information for security testing while avoiding the computational burden of complete path exploration, thus maintaining reliability while improving productivity.
2Adaptability or versatility
If existing analysis capabilities are extended to handle floating-point instructions, then analysis coverage is improved, but path explosion issues worsen
Solution Approach 1:
The patent separates the analysis into a static phase that handles floating-point instructions through path-insensitive analysis, computing sets of possible memory addresses and registers, and a symbolic execution phase that handles control flow. This segmentation allows the system to adapt to floating-point instructions without encountering path explosion, as the static phase provides sufficient information without exploring all paths.
Solution Approach 2:
The patent introduces an intermediary static analysis phase that computes sets of memory addresses and registers before symbolic execution. This intermediary analysis provides summarized information that guides the symbolic execution, allowing the system to handle floating-point instructions effectively without the complexity of path explosion.
3Measurement precision
If path-sensitive symbolic execution is performed on floating-point instructions, then precision is improved, but computational complexity increases
Solution Approach 1:
The patent segments the analysis precision requirements: the static analysis phase provides path-insensitive over-approximations for memory addresses and registers, while symbolic execution provides precise path-sensitive analysis only where needed. This segmentation achieves sufficient precision for security testing without the full computational complexity of path-sensitive analysis throughout.
Solution Approach 2:
The patent applies partial precision by using path-insensitive static analysis that computes over-approximations rather than exact path-sensitive information. This partial precision is sufficient for detecting security vulnerabilities while avoiding the high computational complexity of complete path-sensitive analysis.
Data Source
AI summary
Concepts and technologies are described herein for determining memory safety of floating-point computations. The concepts and technologies described herein analyze code to determine if any floating-point computations exist in the code, and if so, if the floating-point computations are memory safe. The analysis can include identifying floating-point instructions and conditional statements in the code. The code can be symbolically executed, and behavior of the floating-point instructions and the conditional statements can be monitored to determine if a floating point calculation is ever involved in computation of any memory address during the execution of the code.