Poster: Static Detection of Configuration-Dependent Bugs in Configurable Software

Configurable software systems enable developers to configure at compile time a single variant of the system to tailor it towards specific environments and features. Although traditional static analysis tools can assist developers in software development and maintenance, they can only run on a concrete configuration of a configurable software system. Thus, it is necessary to derive many configurations so that the configuration-specific parts of the source code can be checked. To avoid this tedious and error-prone process, we propose an approach to automatically derive a set of configurations that cover as many combinations of configuration-specific blocks of code or source files as possible. We represent a C program with CPP directives (e.g., #ifdef) with a CPP control-flow graph (CPP-CFG) in which CPP expressions are condition nodes and #ifdef blocks are statement nodes. We then explore possible paths on CPP-CFG with dynamic symbolic execution and depth-first search algorithms, and correspondingly, producing possible combinations of concrete blocks of C code, on which an existing static analysis tool can run. Our preliminary evaluation on a benchmark of configuration-dependent bugs on Linux shows that our approach can detect more bugs than a state-of-the-art tool.