First, a few bugs from a list of common bug were chosen and patterns describing these bugs were inferred. Then, detectors searching for such patterns were implemented as plug-ins to FindBugs static analyzer. Finally, detectors were used to detect bugs in development version of JBoss AS. Results are presented at the end of this paper.

Jan Raška: Reactions of the jumping spider Evarcha arcuata to aposematic true bugs Abstract: This paper studies the effect of qualities of a prey on predatory behaviour of Evarcha arcuata (Araneae: Salticidae). Naturally coloured aposematic larveae of Pyrrhocoris apterus have been compared to two types of prey: 1) to identically coloured but in defensive secretion different larvae of Scantius aegyptius, and 2) differently coloured larvae of white mutants of P. apterus. The defensive secretion of S. aegyptius has been found less effective in the first interaction with predator than that of P. apterus, however, after several trials the difference of reactions of the spider has not been noticeable. When changed the species of prey, E. arcuata has symmetrically and considerably generalised between the two species. Significant difference has been established in memory test - while P. apterus has been avoided even after one day, S. aegyptius has been attacked as thought the spiders were naive. The learning sequence has been similar in both colour forms of P. apterus; the generalisation of the two colours has been symetrical as well. Both colour forms succeeded in memory test (e.g. spiders have proven difference in comparison with the naive ones), however, white mutants have been successfully attacked...

The focus of current formal verification methods is mitigating the state explosion problem. One of these formal methods is predicate abstraction, which reduces concrete states of a system to bitvectors of true/false valuations of a set of predicates. Predicate abstraction comes in two flavors, over-approximation and under-approximation. A drawback of over-approximation is that it produces too many spurious errors for data-intensive applications. A more recent under-approximation technique which does not produce spurious errors, does abstract matching on concrete states (AMCS). AMCS adds behaviors to an abstract system by augmenting the set of initial predicates, making use of a theorem prover. The logic behind this approach is that if an error is found in the early coarse abstractions of the system, we save space and time. Our research improves AMCS by providing a refinement technique which guarantees termination. Our technique finds errors in less time and space by using an abstract state splitting algorithm based on intervals, which does not require a theorem prover.

No description available.

Bed bugs (Hemiptera:Cimicidae) are a common, hematophagous ectoparasite of humans and other animals, and are experiencing an international resurgence. Cimicids have been implicated in the transmission many disease agents, including various Bartonella species, however disease transmission has not yet been confirmed. Bartonella spp. are transmitted by a variety of arthropods, including fleas, lice and sand flies, and it is speculated that bed bugs may also serve as a potential vector. In this study, we used an artificial membrane to feed two groups of adult Cimex lectularius rabbit blood, either infected or uninfected with Bartonella henselae. After two weeks, the presence of Bartonella henselae was assessed via PCR, and salivary glands from infected and uninfected bed bugs were dissected and processed for transmission electron microscopy. We were unable to visually identify Bartonella henselae in the images, and therefore unable to confirm the role of bed bugs in B. henselae transmission.

La validation des logiciels est une partie cruciale dans le cycle de leur développement. Deux techniques de vérification et de validation se sont démarquées au cours de ces dernières années : l’analyse statique et l’analyse dynamique. Les points forts et faibles des deux techniques sont complémentaires. Nous présentons dans cette thèse une combinaison originale de ces deux techniques. Dans cette combinaison, l’analyse statique signale les instructions risquant de provoquer des erreurs à l’exécution, par des alarmes dont certaines peuvent être de fausses alarmes, puis l’analyse dynamique (génération de tests) est utilisée pour confirmer ou rejeter ces alarmes. L’objectif de cette thèse est de rendre la recherche d’erreurs automatique, plus précise, et plus efficace en temps. Appliquée à des programmes de grande taille, la génération de tests, peut manquer de temps ou d’espace mémoire avant de confirmer certaines alarmes comme de vraies erreurs ou conclure qu’aucun chemin d’exécution ne peut atteindre l’état d’erreur de certaines alarmes et donc rejeter ces alarmes. Pour surmonter ce problème, nous proposons de réduire la taille du code source par le slicing avant de lancer la génération de tests. Le slicing transforme un programme en un autre programme plus simple, appelé slice, qui est équivalent au programme initial par rapport à certains critères. Quatre utilisations du slicing sont étudiées. La première utilisation est nommée all. Elle consiste à appliquer le slicing une seule fois, le critère de simplification étant l’ensemble de toutes les alarmes du programme qui ont été détectées par l’analyse statique. L’inconvénient de cette utilisation est que la génération de tests peut manquer de temps ou d’espace et les alarmes les plus faciles à classer sont pénalisées par l’analyse d’autres alarmes plus complexes. Dans la deuxième utilisation, nommée each, le slicing est effectué séparément par rapport à chaque alarme. Cependant, la génération de tests est exécutée pour chaque programme et il y a un risque de redondance d’analyse si des alarmes sont incluses dans d’autres slices. Pour pallier ces inconvénients, nous avons étudié les dépendances entre les alarmes et nous avons introduit deux utilisations avancées du slicing, nommées min et smart, qui exploitent ces dépendances. Dans l’utilisation min, le slicing est effectué par rapport à un ensemble minimal de sous-ensembles d’alarmes. Ces sous-ensembles sont choisis en fonction de dépendances entre les alarmes et l’union de ces sous-ensembles couvre l’ensemble de toutes les alarmes. Avec cette utilisation, on a moins de slices qu’avec each, et des slices plus simples qu’avec all. Cependant, l’analyse dynamique de certaines slices peut manquer de temps ou d’espace avant de classer certaines alarmes, tandis que l’analyse dynamique d’une slice éventuellement plus simple permettrait de les classer. L’utilisation smart consiste à appliquer l’utilisation précédente itérativement en réduisant la taille des sous-ensembles quand c’est nécessaire. Lorsqu’une alarme ne peut pas être classée par l’analyse dynamique d’une slice, des slices plus simples sont calculées. Nous prouvons la correction de la méthode proposée. Ces travaux sont implantés dans sante, notre outil qui relie l’outil de génération de tests PathCrawler et la plate-forme d’analyse statique Frama-C. Des expérimentations ont montré, d’une part, que notre combinaison est plus performante que chaque technique utilisée indépendamment et, d’autre part, que la vérification devient plus rapide avec l’utilisation du slicing. De plus, la simplification du programme par le slicing rend les erreurs détectées et les alarmes restantes plus faciles à analyser / Software validation remains a crucial part in software development process. Two major techniques have improved in recent years, dynamic and static analysis. They have complementary strengths and weaknesses. We present in this thesis a new original combination of these methods to make the research of runtime errors more accurate, automatic and reduce the number of false alarms. We prove as well the correction of the method. In this combination, static analysis reports alarms of runtime errors some of which may be false alarms, and test generation is used to confirm or reject these alarms. When applied on large programs, test generation may lack time or space before confirming out certain alarms as real bugs or finding that some alarms are unreachable. To overcome this problem, we propose to reduce the source code by program slicing before running test generation. Program slicing transforms a program into another simpler program, which is equivalent to the original program with respect to certain criterion. Four usages of program slicing were studied. The first usage is called all. It applies the slicing only once, the simplification criterion is the set of all alarms in the program. The disadvantage of this usage is that test generation may lack time or space and alarms that are easier to classify are penalized by the analysis of other more complex alarms. In the second usage, called each, program slicing is performed with respect to each alarm separately. However, test generation is executed for each sliced program and there is a risk of redundancy if some alarms are included in many slices. To overcome these drawbacks, we studied dependencies between alarms on which we base to introduce two advanced usages of program slicing : min and smart. In the min usage, the slicing is performed with respect to subsets of alarms. These subsets are selected based on dependencies between alarms and the union of these subsets cover the whole set of alarms. With this usage, we analyze less slices than with each, and simpler slices than with all. However, the dynamic analysis of some slices may lack time or space before classifying some alarms, while the dynamic analysis of a simpler slice could possibly classify some. Usage smart applies previous usage iteratively by reducing the size of the subsets when necessary. When an alarm cannot be classified by the dynamic analysis of a slice, simpler slices are calculated. These works are implemented in sante, our tool that combines the test generation tool PathCrawler and the platform of static analysis Frama-C. Experiments have shown, firstly, that our combination is more effective than each technique used separately and, secondly, that the verification is faster after reducing the code with program slicing. Simplifying the program by program slicing also makes the detected errors and the remaining alarms easier to analyze

<p>Det här examensarbetet är baserat på idéer ur ett uppdrag från företaget Saab Aerotech men är ett eget arbete.</p><p>Målet var att undersöka om det finns behov av ett verktyg som statiskt kan detektera dynamiska minneshanteringsproblem, som till exempel minnesläckage, i applikationer skrivna i C/C++. På grund av att minneshanteringsfel i C/C++ länge har varit ett känt problem undersökte vi detta och de befintliga lösningarna till det.</p><p>Vi fann två metoder till lösningar som de flesta verktyg använde sig av; statisk och dynamisk detektering. De flesta verktyg löste problemet genom att dynamiskt detektera minnesläckor och andra brister som till exempel buffer overflows. Ett verktyg löste dock problemet genom att statisk detektera minneshanteringsfel i källkoden för applikationerna. Eftersom alla befintliga lösningar har någon form av ineffektivitet så har vi undersökt möjligheten att utveckla ett mer effektivt verktyg. Vi har kommit fram till att denna möjlighet finns men det kräver enormt mycket tid och arbete att göra ett komplett verktyg som detekterar minneshanteringsfel statiskt.</p><p>Vår prototyp detekterar dynamiska minneshanteringsproblem i källkoden statiskt. Vi har använt oss av hjälpverktygen Flex och Bison för att utveckla vår prototyp av verktyget. Prototypen kan analysera källkod skriven i programspråken C och C++ och klarar att detektera minnesläckage, felaktiga avallokeringar av minne, dangling pointers, samt läsning från och skrivning till ogiltiga minnesområden. På grund av tidsbrist har vi i nuläget inte implementerat något stöd för klasser och objekt i prototypen.</p> / <p>This bachelor’s project is our own project, but it is based on ideas from an assignment from the Saab Aerotech company.</p><p>The goal was to investigate if there is a need for a tool that statically can detect dynamic memory management errors, such as memory leaks, in applications written in C/C++. Since the problem of memory management errors in the C/C++ languages has been known for a long time, we decided to investigate this and the existing solutions.</p><p>We found that most tools used two methods as solutions; static and dynamic detection. Most of these tools solve the problem by dynamically detecting memory leaks and other deficiencies such as buffer overflows. However, one of these tools used static detection of these deficiencies by scanning the source code of the applications. Since all the existing solutions have some kind of inefficiency, we have investigated the possibility to develop a more efficient tool. We concluded that this is possible but it will take a lot of time and effort to implement a complete tool that statically detects memory management errors.</p><p>Our prototype statically detects dynamic memory management problems in the source code. We have used the tools Flex and Bison to develop our prototype of a static detection tool. The prototype analyzes source code written in the programming languages C and C++ and is capable of detecting memory leaks, invalid deallocations of memory, dangling pointers and reading from and writing to invalid memory areas. Currently, due to lack of time, we have not implemented any support for classes and objects in the prototype.</p>

Programmers compose programs in multiple languages to combine the advantages of innovations in new high-level programming languages with decades of engineering effort in legacy libraries and systems. For language inter-operation, language designers provide two classes of multilingual programming interfaces: (1) foreign function interfaces and (2) code generation interfaces. These interfaces embody the semantic mismatch for developers and multilingual systems builders. Their programming rules are difficult or impossible to verify. As a direct consequence, multilingual programs are full of bugs at interface boundaries, and debuggers cannot assist developers across these lines. This dissertation shows how to use composition of single language systems and interposition to improve the safety of multilingual programs. Our compositional approach is scalable by construction because it does not require any changes to single-language systems, and it leverages their engineering efforts. We show it is effective by composing a variety of multilingual tools that help programmers eliminate bugs. We present the first concise taxonomy and formal description of multilingual programming interfaces and their programming rules. We next compose three classes of multilingual tools: (1) Dynamic bug checkers for foreign function interfaces. We demonstrate a new approach for automatically generating a dynamic bug checker by interposing on foreign function interfaces, and we show that it finds bugs in real-world applications including Eclipse, Subversion, and Java Gnome. (2) Multilingual debuggers for foreign function interfaces. We introduce an intermediate agent that wraps all the methods and functions at language boundaries. This intermediate agent is sufficient to build all the essential debugging features used in single-language debuggers. (3) Safe macros for code generation interfaces. We design a safe macro language, called Marco, that generates programs in any language and demonstrate it by implementing checkers for SQL and C++ generators. To check the correctness of the generated programs, Marco queries single-language compilers and interpreters through code generation interfaces. Using their error messages, Marco points out the errors in program generators. In summary, this dissertation presents the first concise taxonomy and formal specification of multilingual interfaces and, based on this taxonomy, shows how to compose multilingual tools to improve safety in multilingual programs. Our results show that our compositional approach is scalable and effective for improving safety in real-world multilingual programs. / text

No description available.

No description available.