Studying and Improving the Soundness of Input-Based Feature-Oriented Debloating

The paper consists of two parts: a study of the soundness of feature-oriented debloating techniques that use inputs as the feature specification and a new blocking method BLOCKAUGwe proposed for soundness improvement. Feature-oriented debloating techniques aim to eliminate code bloat related to unneeded program features. Many of these techniques rely on a usage profile, typically provided as a set of inputs, for specification. Such input-based techniques tend to produce debloated programs that are overfitted to the inputs provided, introducing soundness issues often as bugs and vulnerabilities that pose severe threats to the program correctness and security. No prior work has systematically investigated the soundness of current debloating techniques and analyzed the types and causes of the soundness issues they introduce. To fill this gap, we conducted a study in which we applied 7 input-based techniques to 18 programs from two existing benchmarks for debloating and used three fuzzers with various sanitizers to detect soundness issues introduced by these techniques. Our results show that current techniques are highly unsound, as they can introduce a number of issues that lead to program crashes. A key reason for the issue introduction is the inappropriate deletion of soundness-related code such as conditional statements checking invalid cases, which, if missing, can result in unexpected program state and unconditioned execution.To improve the soundness of input-based debloating, we explored a blocking method that can be applied to coverage-based debloating. The core idea is to identify every deleted branch resulted from coverage-based code pruning and, instead of leaving the branch as empty, augment it to prevent any execution from passing through the branch and causing problems. To assess the effectiveness of the method, we used it to augment the debloated programs generated by four coverage-based techniques and evaluated the soundness and generality of the augmented programs. We found that the blocking method can significantly improve soundness, at the cost of only slightly increasing the program size. Although it can change program semantics, it does not significantly affect the generality by weakening the program’s ability in handling other feature-related inputs not seen while debugging. Moreover, the blocking method can forbid unexpected execution of any inputs the program should not have processed, thereby improving the program trustworthiness.