Fine-grain memory object representation in symbolic execution

Dynamic Symbolic Execution (DSE) has seen risingpopularity as it allows to check applications for behaviours suchas error patterns automatically. One of its biggest challenges is thestate space explosion problem: DSE tries to evaluate all possibleexecution paths of an application. For every path, it needs torepresent the allocated memory and its accesses. Even thoughdifferent approaches have been proposed to mitigate the statespace explosion problem, DSE still needs to represent a multitudeof states in parallel to analyse them. If too many states arepresent, they cannot fit into memory, and DSE needs to terminatethem prematurely or store them on disc intermediately. Witha more efficient representation of allocated memory, DSE canhandle more states simultaneously, improving its performance.In this work, we introduce an enhanced, fine-grain and efficientrepresentation of memory that mimics the allocations of testedapplications. We tested GNU Coreutils using three differentsearch strategies with our implementation on top of the symbolicexecution engine KLEE. We achieve a significant reduction ofthe memory consumption of states by up to 99.06% (mean DFS:2%, BFS: 51%, Cov.: 49%), allowing to represent more states inmemory more efficiently. The total execution time is reduced byup to 97.81% (mean DFS: 9%, BFS: 7%, Cov.:4%)—a speedupof 49x in comparison to baseline KLEE