Reachability Confirmation of Statically Detected Defects Using Dynamic Analysis

Static and dynamic analysis of programs are well known approaches to the problem of automatic program behaviour analysis. Both methods have advantages and limitations. Static analysis has lack of precision for the sake of scalability. On the other hand, dynamic analysis has 100% precision while reaching defect point, but suffers from scalability issues. This paper describes an approach to confirmation of reachability of defects that were found by static analysis with help of dynamic analysis. The approach focuses on defects for which static analysis tool manages to generate a path which may contain branch conditions from the source of possible error to its sink (source-sink defects). The combination of different methods allows to circumvent limitations and multiply their advantages. Preliminary experiments on several open source projects show that real true positive defects can be confirmed to be reachable using the approach and some false positives can be proved.