Context-, flow-, and field-sensitive data-flow analysis using synchronized Pushdown systems

Späth, Johannes; Ali, Karim; Bodden, Eric

doi:10.1145/3290361

Cited by 61 publications

(48 citation statements)

References 56 publications

(60 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Pushdown systems solve context-free language reachability and have been studied intensively [3,9,21,23,34]. Synchronized Pushdown Systems (SPDS) [39] are one of the core contributions of the dissertation.…”

Section: Synchronized Pushdown Systemsmentioning

confidence: 99%

See 1 more Smart Citation

Applications of Synchronized Pushdown Systems

Späth

2020

Ernst Denert Award for Software Engineering 2019

Self Cite

View full text Add to dashboard Cite

A precise static data-flow analysis transforms the program into a context-sensitive and field-sensitive approximation of the program. It is challenging to design an analysis of this precision efficiently due to the fact that the analysis is undecidable per se. Synchronized pushdown systems (SPDS) present a highly precise approximation of context-sensitive and field-sensitive data-flow analysis. This chapter presents some data-flow analyses that SPDS can be used for. Further on, this chapter summarizes two other contributions of the thesis “Synchronized Pushdown System for Pointer and Data-Flow Analysis” called Boomerang and IDEal. Boomerang is a demand-driven pointer analysis that builds on top of SPDS and minimizes the highly computational effort of a whole-program pointer analysis by restricting the computation to the minimal program slice necessary for an individual query. IDEal is a generic and efficient framework for data-flow analyses, e.g., typestate analysis. IDEal resolves pointer relations automatically and efficiently by the help of Boomerang. This reduces the burden of implementing pointer relations into an analysis. Further on, IDEal performs strong updates, which makes the analysis sound and precise.

show abstract

Section: Synchronized Pushdown Systemsmentioning

confidence: 99%

“…In several experiments presented within publications [38,39] as well as in the dissertation [37], we compare an IDE al -based typestate analysis to a state-of-the-art typestate analysis, we show that the new concept of separating alias information and weights for typestate yields additional performance benefits.…”

Section: Typestate Analyses Based On Ide Almentioning

confidence: 99%

Applications of Synchronized Pushdown Systems

Späth

2020

Ernst Denert Award for Software Engineering 2019

Self Cite

View full text Add to dashboard Cite

show abstract

“…Another interesting framework for data-flow analysis is Weighted Pushdown Systems (WPDS) [25,28]. WPDS is able to compute an analysis within a stack automaton.…”

Section: Future Workmentioning

confidence: 99%

PhASAR: An Inter-procedural Static Analysis Framework for C/C++

Schubert

Hermann

Bodden

2019

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Static program analysis is used to automatically determine program properties, or to detect bugs or security vulnerabilities in programs. It can be used as a stand-alone tool or to aid compiler optimization as an intermediary step. Developing precise, inter-procedural static analyses, however, is a challenging task, due to the algorithmic complexity, implementation effort, and the threat of state explosion which leads to unsatisfactory performance. Software written in C and C++ is notoriously hard to analyze because of the deliberately unsafe type system, unrestricted use of pointers, and (for C++) virtual dispatch. In this work, we describe the design and implementation of the LLVM-based static analysis framework PhASAR for C/C++ code. PhASAR allows data-flow problems to be solved in a fully automated manner. It provides class hierarchy, call-graph, points-to, and data-flow information, hence requiring analysis developers only to specify a definition of the data-flow problem. PhASAR thus hides the complexity of static analysis behind a high-level API, making static program analysis more accessible and easy to use. PhASAR is available as an open-source project. We evaluate PhASAR's scalability during whole-program analysis. Analyzing 12 real-world programs using a taint analysis written in PhASAR, we found PhASAR's abstractions and their implementations to provide a whole-program analysis that scales well to real-world programs. Furthermore, we peek into the details of analysis runs, discuss our experience in developing static analyses for C/C++, and present possible future improvements. Data or code related to this paper is available at: [34].

show abstract

“…The former analysis result is more accurate than the latter. Field-sensitive analysis [17]- [19] ensures the accuracy of the analysis of complex variables by considering the relationships among complex data types such as structures and their members. Path-sensitive analysis [20]- [23] adds consideration of path conditions in the code.…”

Section: B Data Flow Analysismentioning

confidence: 99%

Memory Leak Detection in IoT Program Based on an Abstract Memory Model SeqMM

et al. 2019

View full text Add to dashboard Cite

With the rapid growth of the Internet-of-Things (IoT), security issues for the IoT are becoming increasingly serious. Memory leaks are a common and harmful software defect for IoT programs running on resource-limited devices. Static analysis is an effective method for memory leak detection, however, because the existing methods cannot fully describe the memory state of IoT programs at run time, false positives and false negatives frequently occur. To improve the precision of memory leak detection, we propose an abstract memory model SeqMM to describe sequential storage structures. SeqMM differs from other abstract memory models in its ability to handle both points-to analysis and numerical analysis of pointers, which contributes to eliminating false positives in defect detection. In addition, based on the analysis of the sequential storage structure, we introduce the analysis of its operations in C programs, including transfer operations and predicate operations. Moreover, we present a memory leak detection algorithm by determining the state of the program points related to allocated memory blocks. The experimental results of five real projects indicate that the false positive rates of DTSC_SeqMM, Klocwork12 and DTSC_RSTVL are 29.0%, 15.0% and 40.6% respectively, and the corresponding false negative rates are 0%, 22.7% and 13.6%. INDEX TERMS Memory leak, sequential storage structure, abstract memory model, data flow analysis.

show abstract

Context-, flow-, and field-sensitive data-flow analysis using synchronized Pushdown systems

Cited by 61 publications

References 56 publications

Applications of Synchronized Pushdown Systems

Applications of Synchronized Pushdown Systems

PhASAR: An Inter-procedural Static Analysis Framework for C/C++

Memory Leak Detection in IoT Program Based on an Abstract Memory Model SeqMM

Contact Info

Product

Resources

About