KLEE

KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs, OSDI 2008

Question

Consider the following C program:

int main(void)
{
    int x, y;
    make_symbolic(&x, sizeof(x));
    if (x % 2 == 0) {
        y = 42 / x;
    } else if (x <= 10) {
        return 0;
    } else {
        y = x - 1;
    }
    printf("%d\n", y);
    return 0;
}

How many paths will reach the printf line, and what are their path conditions?

Question

List two types of bugs that can be caught by KLEE, as well as two types of bugs that cannot be caught by KLEE.

Question

Why do you think KLEE perform better than a simple enumeration strategy (e.g., checking all 232 possible values of x in the above program)?

Question

Provide a list of questions you would like to discuss in class. Feel free to provide any comments on the paper and related topics (e.g., which parts you like and which parts you find confusing).

If you are interested, check the mini checker (the core part consists of ~10 lines of Python code) along with some examples.