LibAlchemy: A Two-Layer Persistent Summary Design for Taming Third-Party Libraries in Static Bug-Finding Systems
Abstract
Despite the benefits of using third-party libraries (TPLs), the misuse of TPL functions raises quality and security concerns. Using traditional static analysis to detect bugs caused by TPL function is non-trivial. One promising solution would be to automatically generate and persist the summaries of TPL functions offline and then reuse these summaries in compositional static analysis online. However, when dealing with millions of lines of TPL code, the summaries designed by existing studies suffer from an unresolved paradox. That is, a highly precise form of summary leads to an unaffordable space and time overhead, while an imprecise one seriously hurts its precision or recall.
BibTeX
@inproceedings{Wu-al:ICSE24,
author = {Rongxin Wu and
Yuxuan He and
Jiafeng Huang and
Chengpeng Wang and
Wensheng Tang and
Qingkai Shi and
Xiao Xiao and
Charles Zhang},
title = {{LibAlchemy:} A {Two-Layer} Persistent Summary Design for Taming {Third-Party} Libraries in Static {Bug-Finding} Systems},
booktitle = {ICSE},
pages = {105:1--105:13},
publisher = {{ACM}},
year = {2024},
}