SymRadar: PoC-Centered Bounded Verification for Vulnerability Repair

Abstract

In this paper, we tackle the problem of patch verification. While automated vulnerability repair (AVR) techniques are gaining traction, it is not sufficient to merely generate patches; providing evidence of their correctness is also essential. However, the current state-of-the-art patch verification methods are not sufficiently effective. To address this issue, we propose SymRadar, a patch verification tool that performs under-constrained symbolic execution (UC-SE) on the patched function. Unlike standard UC-SE, SymRadar conducts UC-SE in the vicinity of the crash-inducing input. We demonstrate that SymRadar is more effective than existing patch verification methods. Another challenge in verifying patches generated by AVR tools is the large number of patches generated. To address this, we propose a novel optimization technique that allows SymRadar to handle multiple patches efficiently. Our experimental evaluation demonstrates that SymRadar is both effective and efficient in verifying patches generated by AVR tools.