Beyond Tests

Automated program repair is an emerging technology that seeks to automatically rectify errors and vulnerabilities. Repair techniques are driven by a correctness criterion often in the form of test suite. Such test-based may produce overfitting patches, where patches produced fail on tests outside suite driving repair. In this work, we present method fixes vulnerabilities without need for voluminous Given vulnerability as evidenced exploit, technique extracts constraint representing with help sanitizers. The extracted serves proof obligation our synthesized patch should satisfy. met propagating locations deemed be “suitable” fix locations. An implementation approach (E xtract F ix ) top KLEE symbolic execution engine shows its efficacy fixing wide range taken from ManyBugs benchmark, real-world CVEs Google’s OSS-Fuzz framework. We believe work presents way forward problem generalizing observable hazards/vulnerabilities (as constraint) single failing or exploit.