Finding and understanding bugs in C compilers

By Xuejun Yang, Yang Chen, Eric Eide, J. Regehr. 2011

1,294 citations recorded by the source corpus.

Subfields: Information Systems, Software

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Information Systems

In Software

Citations in the corpus

DeepXplore: Automated Whitebox Testing of Deep Learning Systems (2017, methodology): “Such differential testing techniques have been applied successfully in the past for detecting logic bugs without manual specifications in a wide variety of traditional software [6, 11, 14, 15, 45, 86].”
Coverage-directed differential testing of JVM implementations (2016, background): “…there do not exist any models or automated means for identifying the root cause of the discrepancy, although many general purposed test case reducers ( e.g. , AST-Based reducer and the modular reducer [31] for CSmith [41]) do exist for pruning the large irrelevant portions from test inputs.”
NEZHA: Efficient Domain-Independent Differential Testing (2017, methodology): “Similarly, existing differential testing tools for C compilers, Java virtual machines, and malware detectors, all include grammars for the respective input format and use domain-speciﬁc mutations [31], [41], [65].”
Steelix: program-state based binary fuzzing (2017, background): “Note that a number of advances have also been made to improve the effectiveness and efficiency of generation-based fuzzing [10, 14, 26, 30, 35, 39, 42, 45, 46, 50].”
Fuzzing with Code Fragments (2012, background): “Surprisingly, the number of fuzzing frameworks that generate test inputs on grammar basis is very limited [7, 17, 22].”
Learning to Fuzz: Application-Independent Fuzz Testing with Probabilistic, Generative Models of Input Data (2016, methodology): “To avoid creating syntactically incorrect programs, Csmith uses built-in filters that encode syntactic constraints not obvious from a grammar.”
Compiler validation via equivalence modulo inputs (2014, background): “Others, however, can cause compilers to silently miscompile a program and produce wrong code, subverting the programmer’s intent.”
Test-case reduction for C compiler bugs (2012, background): “However, we have created two reducers that rely on the fact that Csmith already knows how to create conforming C programs [17].”
Large Language Models Are Zero-Shot Fuzzers: Fuzzing Deep-Learning Libraries via Large Language Models (2022, background): “Additionally, TitanFuzz is the rst work to demonstrate that LLMs can perform both generation-based [30, 80] and mutation-based [39, 50] fuzzing studied for decades [84], while being fully automated, generalizable, and applicable to domains challenging for traditional approaches (such as DL systems).”
Synthesizing benchmarks for predictive modeling (2017, neutral): “Grammar-based fuzz testers have been developed for C [37] and OpenCL [27].”
Skyfire: Data-Driven Seed Generation for Fuzzing (2017, methodology): “CSmith [19], LangFuzz [20], IFuzzer [21], Radamsa [41], and the approach in [18] use the context-free grammar as the specification to generate inputs.”
A design and verification methodology for secure isolated regions (2016, background): “However, compilers are large code bases and have been shown to have bugs and produce wrong code at times [6, 23, 26, 29, 46].”
FairFuzz: A Targeted Mutation Strategy for Increasing Greybox Fuzz Testing Coverage (2017, methodology): “In practice, this trade-off has paid off, and fuzz testers have found numerous correctness bugs and security vulnerabilities in widely used software [9, 14, 25, 26, 28, 34, 39, 41, 43].”
Baldur: Whole-Proof Generation and Repair with Large Language Models (2023, methodology): “For example, CompCert, a C compiler verified using the Coq interactive theorem prover [88], was the only compiler on a list including the ubiquitous GCC and LLVM, in which a comprehensive study found no bugs [106].”
SFADiff: Automated Evasion Attacks and Fingerprinting Using Black-box Differential Automata Learning (2016, methodology): “Differential testing has been used successfully for testing a diverse set of systems including C compilers [32], Java virtual machine implementations [11], SSL/TLS implementations [8], mobile applications for privacy leaks [20], PDF malware detectors [31], and space flight software [18].”