A foundation for flow-based program matching

Brunel, Julien; Doligez, Damien; Hansen, René Rydhof; Lawall, Julia; Muller, Gilles

doi:10.1145/1480881.1480897

Cited by 19 publications

(2 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…On the other hand, Coccinelle [6] focuses on the CFG of a C function instead of its AST. It uses CTL-VW (a variant of FO-CTL) to describe and retrieve a sequence of statements within a CFG.…”

Section: Related Workmentioning

confidence: 99%

“…It is essential that end-users can specify what they are looking for since each project has conventions, norms, and specificity that must be taken into account. There are many existing formalisms to specify queries, and they either use the Abstract Syntax Tree (AST) as their source of information [10,4,14,12,20] or the Control Flow Graph (CFG) of functions [6]. However, each one provides additional and complementary information.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Source Code Analysis with a Temporal Extension of First-Order Logic

Come¹,

Brunel²,

Doose³

2018

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Formal methods and static analysis are widely used in software development, in particular in the context of safety-critical systems. They can be used to prove that the software behavior complies with its specification: the software correctness. In this article, we address another usage of these methods: the verification of the quality of the source code, i.e., the compliance with guidelines, coding rules, design patterns. Such rules can refer to the structure of the source code through its Abstract Syntax Tree (AST) or to execution paths in the Control Flow Graph (CFG) of functions. AST and CFGs offer complementary information and current methods are not able to exploit both of them simultaneously. In this article, we propose an approach to automatically verifying the compliance of an application with specifications (coding rules) that reason about both the AST of the source code and the CFG of its functions. To formally express the specification, we introduce FO ++ , a logic defined as a temporal extension of many-sorted first-order logic. In our framework, verifying the compliance of the source code comes down to the model-checking problem for FO ++ . We present a correct and complete model checking algorithm for FO ++ and establish that the model checking problem of FO ++ is PSPACE-complete. This approach is implemented into Pangolin, a tool for analyzing C++ programs. We use Pangolin to analyze two middle-sized opensource projects, looking for violations of six coding rules and report on several detected violations.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Source Code Analysis with a Temporal Extension of First-Order Logic

Come¹,

Brunel²,

Doose³

2018

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

Simplifying the construction of source code transformations via automatic syntactic restructurings

Newman

Bartman

Collard

et al. 2017

J Software Evolu Process

View full text Add to dashboard Cite

A set of restructurings to systematically normalize selective syntax in C++ is presented. The objective is to convert variations in syntax of specific portions of code into a single form to simplify the construction of large, complex program transformation rules. Current approaches to constructing transformations require developers to account for a large number of syntactic cases, many of which are syntactically different but semantically equivalent. The work identifies classes of such syntactic variations and presents normalizing restructurings to simplify each variation to a single, consistent syntactic form. The normalizing restructurings for C++ are presented and applied to two open source systems for evaluation. The evaluation uses the system's test cases to validate that the normalizing restructurings do not affect the systems' tested behavior. In addition, a set of example transformations that benefit from the prior application of normalizing restructurings are presented along with a small survey to assess the effect of the readability of the resultant code.

show abstract

WYSIWIB: exploiting fine‐grained program structure in a scriptable API‐usage protocol‐finding process

et al. 2012

View full text Add to dashboard Cite

International audienceBug-finding tools rely on specifications of what is correct or incorrect code. As it is difficult for a tool developer or user to anticipate all possible specifications, strategies for inferring specifications have been proposed. These strategies obtain probable specifications by observing common characteristics of code or execution traces, typically focusing on sequences of function calls. To counter the observed high rate of false positives, heuristics have been proposed for ranking or pruning the results. These heuristics, however, can result in false negatives, especially for rarely used functions. In this paper, we propose an alternate approach to specification inference, in which the user guides the inference process using patterns of code that reflect the user's understanding of the conventions and design of the targeted software project. We focus on specifications describing the correct usage of API functions, which we refer to as API protocols. Our approach builds on the Coccinelle program matching and transformation tool, which allows a user to construct patterns that reflect the structure of the code to be matched. We evaluate our approach on the source code of the Linux kernel, which defines a very large number of API functions with varying properties. Linux is also critical software, implying that fixing even bugs involving rarely used protocols is essential. In our experiments, we use our approach to find over 3000 potential API protocols, with an estimated false positive rate of under 15% and use these protocols to find over 360 bugs in the use of API functions

show abstract

A foundation for flow-based program matching

Cited by 19 publications

References 31 publications

Source Code Analysis with a Temporal Extension of First-Order Logic

Source Code Analysis with a Temporal Extension of First-Order Logic

Simplifying the construction of source code transformations via automatic syntactic restructurings

WYSIWIB: exploiting fine‐grained program structure in a scriptable API‐usage protocol‐finding process

Contact Info

Product

Resources

About