{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T16:20:57Z","timestamp":1783009257440,"version":"3.54.5"},"reference-count":87,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"7","license":[{"start":{"date-parts":[[2024,7,1]],"date-time":"2024-07-01T00:00:00Z","timestamp":1719792000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2024,7,1]],"date-time":"2024-07-01T00:00:00Z","timestamp":1719792000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2024,7,1]],"date-time":"2024-07-01T00:00:00Z","timestamp":1719792000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001459","name":"Ministry of Education - Singapore","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001459","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Centre for Research on Intelligent Software Engineering (RISE) at Singapore Management University"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IIEEE Trans. Software Eng."],"published-print":{"date-parts":[[2024,7]]},"DOI":"10.1109\/tse.2024.3395412","type":"journal-article","created":{"date-parts":[[2024,4,30]],"date-time":"2024-04-30T19:11:53Z","timestamp":1714504313000},"page":"1747-1767","source":"Crossref","is-referenced-by-count":4,"title":["Concretely Mapped Symbolic Memory Locations for Memory Error Detection"],"prefix":"10.1109","volume":"50","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2389-1881","authenticated-orcid":false,"given":"Haoxin","family":"Tu","sequence":"first","affiliation":[{"name":"School of Computing and Information Systems, Singapore Management University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4336-8548","authenticated-orcid":false,"given":"Lingxiao","family":"Jiang","sequence":"additional","affiliation":[{"name":"School of Computing and Information Systems, Singapore Management University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-4894-2672","authenticated-orcid":false,"given":"Jiaqi","family":"Hong","sequence":"additional","affiliation":[{"name":"School of Computing and Information Systems, Singapore Management University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3974-590X","authenticated-orcid":false,"given":"Xuhua","family":"Ding","sequence":"additional","affiliation":[{"name":"School of Computing and Information Systems, Singapore Management University, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8674-4948","authenticated-orcid":false,"given":"He","family":"Jiang","sequence":"additional","affiliation":[{"name":"School of Software, Dalian University of Technology, Dalian, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1088\/1742-6596\/2001\/1\/012006"},{"key":"ref2","first-page":"99","article-title":"HeapHopper: Bringing bounded model checking to heap implementation security","volume-title":"Proc. USENIX Secur. Symp.","author":"Eckert","year":"2018"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2021.3121994"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/CGO.2011.5764689"},{"key":"ref5","first-page":"1037","article-title":"PTAuth: Temporal memory safety via robust points-to authentication","volume-title":"Proc. USENIX Secur. Symp.","author":"farkhani","year":"2021"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/CGO.2019.8661202"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.13"},{"key":"ref8","article-title":"CVE-2022-0667: Assertion failure on delayed DS lookup","year":"2023"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-33826-7_16"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1016\/j.scico.2012.10.011"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/1250734.1250746"},{"key":"ref12","first-page":"1","article-title":"AddressSanitizer: A fast address sanity checker","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Serebryany","year":"2012"},{"key":"ref13","first-page":"209","article-title":"Klee: Unassisted and automatic generation of high-coverage tests for complex systems programs","volume-title":"Proc. USENIX Conf. Operating Syst. Des. Implementation (OSDI)","author":"Cadar","year":"2008"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3468596"},{"key":"ref15","article-title":"Contemporary automatic program analysis","author":"Cohen","year":"2023"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/1455518.1455522"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/s10515-013-0122-2"},{"key":"ref18","first-page":"65","article-title":"PG-KLEE: Trading soundness for coverage","volume-title":"Proc. ACM\/IEEE Int. Conf. Softw. Eng. (ICSE)","author":"Rutledge","year":"2020"},{"key":"ref19","first-page":"151","article-title":"Automated whitebox fuzz testing","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp. (NDSS)","author":"Godefroid","year":"2008"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2012.6227168"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/1755913.1755946"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/2884781.2884807"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180247"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2013.6606623"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/1966445.1966475"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/3314221.3314610"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/3213846.3213867"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00022"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/3428215"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/2560217.2560219"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.31"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354224"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3395363.3397363"},{"key":"ref34","article-title":"Juliet test suite 1.3","year":"2023"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/1542476.1542504"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/1806651.1806657"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3460319.3464807"},{"key":"ref38","first-page":"781","article-title":"FUZE: Towards facilitating exploit generation for kernel use-after-free vulnerabilities","volume-title":"Proc. USENIX Secur. Symp.","author":"Wu","year":"2018"},{"key":"ref39","article-title":"Memory safety","year":"2023"},{"key":"ref40","article-title":"Implementation of memmove","year":"2023"},{"key":"ref41","article-title":"Implementation of memmove in Glibc","year":"2023"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/2568225.2568278"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1017\/9781316771273"},{"key":"ref44","article-title":"KLEE may miss use-after-free in call to Libc function","author":"Dolan-Gavitt","year":"2023"},{"key":"ref45","article-title":"Heap feng shui in Javascript","author":"Sotirov","year":"2023"},{"key":"ref46","first-page":"1647","article-title":"MAZE: Towards automated heap feng shui","volume-title":"Proc. USENIX Secur. Symp.","author":"Wang","year":"2021"},{"key":"ref47","first-page":"763","article-title":"Automatic heap layout manipulation for exploitation","volume-title":"Proc. USENIX Secur. Symp.","author":"Heelan","year":"2018"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363212"},{"key":"ref49","article-title":"Simple theorem prover, an efficient SMT solver for bitvectors","year":"2023"},{"key":"ref50","article-title":"A theorem prover from Microsoft Research","year":"2023"},{"key":"ref51","article-title":"Tips for allocating memory","year":"2023"},{"key":"ref52","first-page":"1111","article-title":"Automatic techniques to systematically discover new heap exploitation primitives","volume-title":"Proc. USENIX Secur. Symp.","author":"Yun","year":"2020"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/3338906.3338936"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.17"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/3182657"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/1961296.1950396"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2017.8115671"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.29007\/dc9b"},{"key":"ref59","article-title":"A building automation tool","author":"Make","year":"2023"},{"key":"ref60","article-title":"A traditional unix macro processor","author":"M4","year":"2023"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484813"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/2544173.2509553"},{"key":"ref63","article-title":"A test coverage program in GNU GCC tool-chain","year":"2023"},{"key":"ref64","article-title":"A powerful intermediate representation for efficient compiler transformations and analysis","author":"IR","year":"2023"},{"key":"ref65","article-title":"Measuring the coverage achieved by symbolic execution","author":"Cadar","year":"2022"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510185"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2015.33"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/1993498.1993532"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2015.33"},{"key":"ref70","article-title":"Missing a double free when heap pointers are compared","author":"Dudka","year":"2023"},{"key":"ref71","article-title":"Confirmation of the bug in Case 1","year":"2023"},{"key":"ref72","article-title":"Confirmation of the bug in Case 2","year":"2023"},{"key":"ref73","article-title":"A tool for static C\/C++ code analysis","year":"2023"},{"key":"ref74","article-title":"A source code analysis tool that finds bugs in C, C++, and objective-C program","year":"2023"},{"key":"ref75","article-title":"A static code analysis tool for improving quality and reducing defects","year":"2023"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180178"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/WPC.1996.501129"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1002\/(SICI)1097-024X(20000710)30:8<907::AID-SPE324>3.0.CO;2-I"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1145\/1646353.1646374"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1145\/2491411.2501854"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1145\/3293882.3330554"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2023.23232"},{"key":"ref83","article-title":"Cppcheck: A tool for static C\/C++ code analysis","author":"Marjam\u00e4ki","year":"2023"},{"key":"ref84","article-title":"A fast and accurate static analysis solution for C\/C++","volume-title":"C#, Lua codes","year":"2023"},{"key":"ref85","first-page":"125","article-title":"Purify: Fast detection of memory leaks and access errors","volume-title":"Proc. USENIX Winter\u201992 Conf.","author":"Hastings","year":"1992"},{"key":"ref86","first-page":"57","article-title":"Mudflap: Pointer use checking for C\/C++","volume-title":"Proc. 1st Annu. GCC Developers\u2019 Summit","author":"Eigler","year":"2003"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2019.00089"}],"container-title":["IEEE Transactions on Software Engineering"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/32\/10601498\/10510589.pdf?arnumber=10510589","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,22]],"date-time":"2024-07-22T17:56:24Z","timestamp":1721670984000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10510589\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,7]]},"references-count":87,"journal-issue":{"issue":"7"},"URL":"https:\/\/doi.org\/10.1109\/tse.2024.3395412","relation":{},"ISSN":["0098-5589","1939-3520","2326-3881"],"issn-type":[{"value":"0098-5589","type":"print"},{"value":"1939-3520","type":"electronic"},{"value":"2326-3881","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,7]]}}}