EndWatch：一种检测真实软件中非终止性的实用方法
EndWatch: A Practical Method for Detecting Non-Termination in Real-World Software
AI总结：
本文提出 EndWatch，通过状态重访预言、SRC 符号推断与具体执行检查，将非终止性检测集成到 AFL 等测试工具中，在基准和真实项目上显著优于现有工具。
摘要：
检测非终止性对于确保程序正确性和安全性至关重要，例如防止拒绝服务攻击。尽管终止性分析已被研究多年，但现有方法的可扩展性有限，仅对小型程序有效。为解决这一问题，我们提出了一种名为 EndWatch 的实用终止性检查技术，通过测试检测由无限循环导致的非终止性。具体而言，我们引入了两种基于检查状态重访来生成非终止性预言的方法：如果程序在同一程序位置返回到先前访问过的状态，则该程序不会终止。这些非终止性预言可集成到测试工具（例如本文使用的 AFL）中，以检测大型程序中的非终止性。对于线性循环，我们对单个循环执行符号执行以推断 State Revisit Conditions（SRC，状态重访条件），并将 SRC 插桩到目标循环中。对于非线性循环，我们对目标循环进行插桩，以在执行期间检查具体状态重访。我们在包含小型程序的标准基准测试和包含大型程序的真实项目上评估了 EndWatch。评估结果表明，EndWatch 在标准基准测试上比最先进工具更有效（检测出87%的非终止程序，而最佳基线仅检测出67%），并且可有效检测真实项目中的非终止性（检测出90%的已知非终止性 CVE 和4个未知漏洞）。
英文摘要：
Detecting non-termination is crucial for ensuring program correctness and security, such as preventing denial-of-service attacks. While termination analysis has been studied for many years, existing methods have limited scalability and are only effective on small programs. To address this issue, we propose a practical termination checking technique, called EndWatch, for detecting non-termination caused by infinite loops through testing. Specifically, we introduce two methods to generate non-termination oracles based on checking state revisits, i.e., if the program returns to a previously visited state at the same program location, it does not terminate. The non-termination oracles can be incorporated into testing tools (e.g., AFL used in this paper) to detect non-termination in large programs. For linear loops, we perform symbolic execution on individual loops to infer State Revisit Conditions (SRCs) and instrument SRCs into target loops. For non-linear loops, we instrument target loops for checking concrete state revisits during execution. We evaluated EndWatch on standard benchmarks with small-sized programs and real-world projects with large-sized programs. The evaluation results show that EndWatch is more effective than the state-of-the-art tools on standard benchmarks (detecting 87% of non-terminating programs while the best baseline detects only 67%), and useful in detecting non-termination in real-world projects (detecting 90% of known non-termination CVEs and 4 unknown bugs).
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
