February 26, 2004:
A System to Generate Test Data and Symbolically Execute Programs
CLARKE, L
IEEE Transactions on Software Engineering SE-2, 3 (September 1976),
215-222.
Only hard copy available.
March 25, 2004:
Prolangs research talk. Presenters: PROLANGSers
April 1, 2004:
Exploiting Purity for Atomicity
Cormac Flanagan (University of California, Santa Cruz) , Stephen
Freund (Williams College), Shaz Qadeer (Microsoft Research)
Please come to PROLANGS to get a copy for the paper. Presenter: Thomas J Marlowe Slides
April 8, 2004:
Invited Speaker : Larry
Kovad Beyond Code Generation: Using compiler technology for security and
software defect identification
Compiler and optimization technology has a rich history. Traditional use of the technology has been for code generation through a variety of
intra- and inter-procedural code analyses. We have been exploring the use of
the same basic techniques to address hard problems in security and software
defect identification. A number of factors make the analysis problems
more challenging. A significant trend in software development is the
reuse of components -- from libraries to entire applications. Often
the source code for these components is not available. The size and
complexity of the software to be analyzed can be quite large, making the analysis
even more challenging. This talk will give a high level overview of
two of our projects that use whole program control and data flow analyses:
We have been developing a variety of security analyses of Java applications (e.g., servlets, applets, applications). For example, one
of the most difficult challenges for an application developer or system
administrator is identifying the security authorization requirements of
Java applications ("Permissions" to grant the application). The
traditional approach is either to turn off security or to run test
cases to observe authorization failures and add the required Permissions to
the authorization database until the application no longer fails. This
talk describes a better approach that automatically computes the
authorization policy for an application.
Another project, called SABER, uses whole program analysis to identify
coding defects in application code. Saber identifies code that may
result in performance problems, outright failure of an application, or
violates "best practices" (coding conventions). For example, a performance
may result when an application uses a class or method that is known to
result in poor performance when used in a particular context (e.g.,
calling the garbage collector during garbage collection). This talk
will
give an overview of the types of defects that SABER can discover.