search

SRI-CSL / OCCAM

OCCAM: Object Culling and Concretization for Assurance Maximization
BSD 3-Clause "New" or "Revised" License
26 stars 10 forks source link

Over-specialization #54

Open caballa opened 3 years ago

caballa commented 3 years ago

The configuration priming (CP) can produce too specialized programs that cannot be actually executed.

Recall that CP has two phases: bytecode interpretation and lifting LLVM values to LLVM constants. For the second phase, the lifting excludes pointer values to avoid overfitting but this is not sufficient.

There are system calls such as socket, getuid, etc which generate integers which should not be part of the specialized programs because they are not reusable across multiple executions. A similar issue raises when pointers are casted to integers and then those integers are also part of the specialized program. This can cause that the specialized binary accesses to memory allocated during configuration priming which is not available after.

Probably the solution is to modify configuration priming to lift a LLVM value only if the value is input-dependent.

caballa commented 3 years ago

This limitation affects #48 , #50, #52, and #53