2021
DOI: 10.1007/978-3-030-81688-9_14
|View full text |Cite
|
Sign up to set email alerts
|

An SMT Solver for Regular Expressions and Linear Arithmetic over String Length

Abstract: We present a novel length-aware solving algorithm for the quantifier-free first-order theory over regex membership predicate and linear arithmetic over string length. We implement and evaluate this algorithm and related heuristics in the Z3 theorem prover. A crucial insight that underpins our algorithm is that real-world regex and string formulas contain a wealth of information about upper and lower bounds on lengths of strings, and such information can be used very effectively to simplify operations on automa… Show more

Help me understand this report

Search citation statements

Order By: Relevance

Paper Sections

Select...
2
1
1
1

Citation Types

0
24
0

Year Published

2021
2021
2023
2023

Publication Types

Select...
4
2
1

Relationship

3
4

Authors

Journals

citations
Cited by 21 publications
(24 citation statements)
references
References 37 publications
0
24
0
Order By: Relevance
“…Each equation should be read as an assignment of the right-hand side term to the left-hand side variable, and is processed in this direction. We initially ignore the constraint (5).…”
Section: Motivating Examplementioning
confidence: 99%
See 2 more Smart Citations
“…Each equation should be read as an assignment of the right-hand side term to the left-hand side variable, and is processed in this direction. We initially ignore the constraint (5).…”
Section: Motivating Examplementioning
confidence: 99%
“…Consider now also (5), modelling a simple form of injection attack. We can observe that this additional constraint is inconsistent with the derived constraint (7), since the intersection of the asserted regular languages is empty.…”
Section: Motivating Examplementioning
confidence: 99%
See 1 more Smart Citation
“…During the development of an extension to cope with regular membership constraints within our SMT solver Z3str3RE [9] we analysed a huge set of over 100,000 industrial influenced benchmarks gathered by the authors of ZaligVinder [23] and identified 22425 instances containing at least one regular expression membership constraint. This set includes instances from the AppScan [32], Bandit-Fuzz, 6 JOACO [30], Kaluza [28], Norn [3], Sloth [20], Stranger [31], and Z3str3regression [8] benchmarks.…”
Section: From Practice To Theorymentioning
confidence: 99%
“…The value of this theoretical analysis of present data is massive, since the sub-theory occurring the most within the benchmarks is actually PSPACE-complete, as we show within this work. Most notably, these results lead to an algorithm implemented within Z3str3 showing superior performance compared to its competitors [9]. The algorithm itself was directly informed by the ideas we used in proofs of the theorems presented in this work.…”
Section: Introductionmentioning
confidence: 99%