Questions tagged [symbolic-execution]
10 questions
3
votes
1 answer
How a Symbolic Evaluator Generates Test Input for this Example
Say we have some complicated function that determines if a string matches an XSS attack string, and throws an error or does something else in that case.
function somethingWithXSSVulnerability(x) {
var regex = /(.*)<\/script>/
if…
Lance Pollard
- 2,323
- 1
- 19
- 34
3
votes
2 answers
Solving the Path Explosion Problem in Symbolic Execution
Looking at the Symbolic Execution limitations, there are some good solutions to the "Environment interactions" problems. However, the solutions to the path explosion problem are less than ideal.
Solutions to the path explosion problem generally use…
Lance Pollard
- 2,323
- 1
- 19
- 34
2
votes
1 answer
Algorithm for finding the minimum factorization of a tensor product expression
I originally asked a question on the Mathematica stack exchange on a similar topic here.
But it seems like my question actually extends beyond Mathematica. The issue is the following. Let $a,b,d$ be elements of some vector space $V$ over…
Jack
- 125
- 4
1
vote
0 answers
Literature on recusively applying predicated transformations to a symbol tree to match some target symbol tree
I am working on a problem that can be simplified to consist of the following:
an initial symbol tree
a list of interpretations (an interpretation is a transformation guarded by a predicate)
a predicate describing what the target symbol tree should…
Ottid Mes
- 11
- 1
1
vote
0 answers
How does checking correctness with Weakest Preconditions work?
We have this example:
{true}
assume x > 1;
y := x * 2;
z := x + 2;
assert y > z;
{true}
They then show this:
{true}
wp(assume x > 1, x * 2 > x + 2) = x>1 -> x*2 > x+2
assume x > 1;
wp(y := x * 2, y > x + 2) = x * 2 > x + 2
y := x * 2;
wp(z := x +…
Lance Pollard
- 2,323
- 1
- 19
- 34
1
vote
1 answer
Can I include some manual effort in creating an otherwise automated research prototype tool?
I am a research student in the area of programming language/software engineering. I am claiming to provide an automated technique to solve a research problem in one of my papers. The prototype tool that I am creating for this paper is required to…
user128983
- 11
- 1
1
vote
1 answer
What are the differences between symbolic execution and SAT solvers?
My understanding is that symbolic execution only deals with specific paths and bad patterns, while SAT solvers, or satisfiability modulo theories in general, provide a much more robust analysis of the program.
Could someone validate the statement…
Paul Razvan Berg
- 184
- 2
- 11
0
votes
0 answers
SLAM (model checking) at microsoft: successors?
The SLAM project at Microsoft (as detailed in this slide) was highly regarded for detecting bugs in Windows device drivers. Some of its key strengths include discovering real bugs, scalability (handling 100k+ lines of code), and fully automated…
0
votes
1 answer
find maximum in arbitrary expression tree
Originally posted on SO.
I have a very simple language that gets compiled to an Expression tree, and then evaluated. Users can define mathematical operations, use variables and control flow. Moreover, from the script it's also possible to read an…
apocalypsis
- 101
- 1
-1
votes
1 answer
High Level description of Turing Machines
How can create a Turing machine that checks whether or not an input string is a well-defined regular expression? For example, it recognizes a language that consists of string over {0,1} and the symbols used to write down REs (U,*,+, ...)
Sasuke Uchiha
- 1
- 1