Static API Specification Mining: Exploiting Source Code Model Checking - Mining Software Specifications: Methodologies and Applications - page 137

~/Redhat-9.0/routed/ripquery/query.c
#include <sys/socket.h>
int main (...){
...
s = socket (...);
...
cc = recvfrom (s, ...)
...
if (cc < 0){
...
close (s);
exit (1);
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

...
close (s)
...
}

FIGURE 5.16: Code snippet from routed-0.17-14.

of control-flow edges, i.e., Control Flow Graph (CFG) edges. Our adaptation
identies two types of paths { Error Path and Normal Path. There are two
types of error paths. Any path from the beginning of the main procedure
to an exit call (such as exit ) in the error block of some API is called the
Error Exit-Path. For example, all paths ending at the exit call at Line 11 in
Figure 5.16 are error exit-paths ( exit call inside EB( recvfrom )). Any path from
the beginning of the main procedure to a return call in the error block of some
API is called the Error Return-Path. For example, in Figure 5.17, all paths
ending at the return call at Lines 12 ( return call inside EB( XftFontOpenName ))
and 20 ( return call inside EB( XftColorAllocValue )) are error return-paths.
Error exit-paths and error return-paths are together known as error paths. A
normal path is any path from the beginning of the main procedure to the end
of the main procedure without any API errors. For example, any path from
Line 3 to Line 15 in Figure 5.16 is a normal path. For a given path, a trace
is the print of all statements that exist along that path. Error paths, error
exit-paths, error return-paths, and normal paths have corresponding traces:
error traces, error exit-traces, error return-traces, and normal traces. Error
exit-traces and error return-traces are together known as error traces. In our
analysis, we restrict the traces to those that can be captured by a Finite State
Machine [8]. Two APIs are said to be related if they manipulate at least one
(or more) common variable(s). For example, in Figure 5.16, APIs recvfrom
and close are related to the API socket . The socket API produces s , which
is consumed by the APIs recvfrom and close . A scenario is a set of related
APIs in a given trace. A given trace can have multiple scenarios. For example,