Generation of Violation Witnesses by Under-Approximating Abstract Interpretation

Milanese, Marco; Miné, Antoine

doi:10.1007/978-3-031-50524-9_3

Cited by 3 publications

References 48 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

Mopsa-C: Improved Verification for C Programs, Simple Validation of Correctness Witnesses (Competition Contribution)

Monat,

Milanese,

Parolini

et al. 2024

Lecture Notes in Computer Science

View full text Add to dashboard Cite

We present advances we brought to Mopsa for SV-Comp 2024. We significantly improved the precision of our verifier in the presence of dynamic memory allocation, library calls such as , -based loops, and integer abstractions. We introduced a witness validator for correctness witnesses. Thanks to these improvements, Mopsa won SV-Comp’s SoftwareSystems category by a large margin, scoring 2.5 times more points than the silver medalist, Bubaak-SpLit.

show abstract

Mopsa-C: Improved Verification for C Programs, Simple Validation of Correctness Witnesses (Competition Contribution)

Monat,

Milanese,

Parolini

et al. 2024

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

Parallel program analysis on path ranges

Haltermann,

Jakobs,

Richter

et al. 2024

Science of Computer Programming

View full text Add to dashboard Cite

Limits and Difficulties in the Design of Under-Approximation Abstract Domains

Ascari,

Bruni,

Gori

2024

ACM Trans. Program. Lang. Syst.

View full text Add to dashboard Cite

The main goal of most static analyses is to prove the absence of bugs : if the analysis reports no alarms then the program will not exhibit any unwanted behaviours. For this reason, they are designed to over-approximate program behaviours and, consequently, they can report some false alarms. O’Hearn’s recent work on incorrectness has renewed the interest in the use of under-approximations for bug finding , because they only report true alarms. In principle, Abstract Interpretation techniques can handle under-approximations as well as over-approximations, but, in practice, few attempts were developed for the former, notwithstanding the much wider literature on the latter. In this paper we investigate the possibility of exploiting under-approximation abstract domains for bug-finding analyses. First we restrict to consider concrete powerset domains and highlight some intuitive asymmetries between over- and under-approximations. Then, we prove that the effectiveness of abstract domains defined by Under-approximation Galois connection is limited, because the analysis is likely to return trivial results whenever common transfer functions are encoded in the program. To this aim, we introduce the original concepts of non-emptying functions and highly surjective function family and we prove the nonexistence of abstract domains able to under-approximate such functions in a non-trivial way. We show many examples of finite and infinite numerical domains, as well as other generic domains. In all such cases, we prove the impossibility of performing nontrivial analyses via under-approximating Galois connections.

show abstract

Generation of Violation Witnesses by Under-Approximating Abstract Interpretation

Cited by 3 publications

References 48 publications

Mopsa-C: Improved Verification for C Programs, Simple Validation of Correctness Witnesses (Competition Contribution)

Mopsa-C: Improved Verification for C Programs, Simple Validation of Correctness Witnesses (Competition Contribution)

Parallel program analysis on path ranges

Limits and Difficulties in the Design of Under-Approximation Abstract Domains

Contact Info

Product

Resources

About