Validating static warnings via testing code fragments

In this paper, we present a novel solution that automatically generates test cases based on static warnings to validate true and false positives. We found that testing code fragments is scalable and useful; it can trigger bugs that testing entire programs or testing procedures failed to trigger, including 4 verified CVE and real-world bugs.