Implementation of an array bound checker

Using dynamic analysis to discover polynomial and array invariants

“…2]). We only consider functions with scalar inputs such as g (7,8). We note that existing dynamic analysis methods cannot find these array relations either.…”

“…Array invariants involving user-defined functions, e.g., [7]. Our approach extends to invariants involving function composition, such as g (f (A[.…”

Analyzing Memory Accesses in x86 Executables

“…Initial inputs to the untrusted program were annotated with typestate information and linear constraints. The analyses developed by Xu et al were based on classical theorem-proving techniques: the typestate-checking algorithm used the induction-iteration method [30] to synthesize loop invariants and Omega [23] to decide Presburger formulas. In contrast, the goal of the system described in the present paper is to recover information from an x86 executable that permits the creation of intermediate representations similar to those that can be created for a program written in a high-level language.…”

A Class of Polynomially Solvable Range Constraints for Interval Analysis without Widenings and Narrowings

“…Many program analysis and verification algorithms and tools have the need to solve linear integer constraints or its extensions, such as for checking array bounds to ensure memory safety [15,38,16,35] and for detecting buffer overruns for security applications [36], and for array dependency analysis for parallel compilers [31,32,29,33,7,6]. However, solving integer linear constraints is a difficult problem [22], and only very special cases have efficient algorithms [30,3].…”