Null dereference verification via over-approximated weakest pre-conditions analysis

Madhavan, Ravichandhran; Komondoor, Raghavan

doi:10.1145/2048066.2048144

Cited by 22 publications

(13 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Another option is to use the predicates as elements of an abstract domain in static analysis (abstract interpretation). We could extend the technique described in [32], which aims to verify the correctness of dereferences using weakest preconditions and backward data flow analysis, so that it handles collections more precisely. We might also consider interpolation-based model checking procedures [22,24,35] that construct the abstraction on-the-fly during the traversal of the program state space.…”

Section: Resultsmentioning

confidence: 99%

Predicate abstraction of Java programs with collections

Parízek

Lhoták

2012

SIGPLAN Not.

View full text Add to dashboard Cite

Our goal is to develop precise and scalable verification techniques for Java programs that use collections and properties that depend on their content.We apply the popular approach of predicate abstraction to Java programs and collections. The main challenge in this context is precise and compact modeling of collections that enables practical verification.We define a predicate language for modeling the observable state of Java collections at the interface level. Changes of the state by API methods are captured by weakest preconditions. We adapt existing techniques for construction of abstract programs. Most notably, we designed optimizations based on specific features of the predicate language.We evaluated our approach on Java programs that use collections in advanced ways. Our results show that interesting properties, such as consistency between multiple collections, can be verified using our approach. The properties are specified using logic formulas that involve predicates introduced by our language.

show abstract

Section: Resultsmentioning

confidence: 99%

Predicate abstraction of Java programs with collections

Parízek

Lhoták

2012

SIGPLAN Not.

View full text Add to dashboard Cite

show abstract

“…The base analysis was originally proposed, discussed, and evaluated by Madhavan and Komondoor [4]. The key elements of the base analysis are a base lattice of formulas, backwards transfer functions for each kind of statement that overapproximate the corresponding wp 1 semantics, as well as an inter-procedural component, based on a variant of Sharir-Pneuli's [5] tabulation based approach.…”

Section: The Base Analysismentioning

confidence: 99%

“…In this section we give an overview of the abstract lattice and transfer functions used by this analysis, as well as a few other key features of this analysis. A detailed discussion of this analysis can be found in a previous publication [4]. The data-flow lattice of the base analysis is described in Figure 2.…”

Section: Base Analysismentioning

confidence: 99%

“…Approaches for null-dereference verification that preceded our publication [4] on the base analysis, for instance, [17,18], are based on a forward analysis, and are meant to verify all dereferences in a program in one go. The base analysis is demand-driven in many ways; i.e., it only does work that is required to verify the given root dereference.…”

Section: Advantages Of a Backwards Analysismentioning

confidence: 99%

“…One would expect our analysis to run faster, because a sliced program is generally smaller than a full program. However, it was observed [4] that the time saved by performing the analysis on the sliced program did not compensate the time spent in computing the slice in the first place.…”

Section: Comparison With a Simple Alternative Approachmentioning

confidence: 99%

See 2 more Smart Citations

Two techniques to improve the precision of a demand-driven null-dereference verification approach

Margoor

Komondoor

2015

Science of Computer Programming

Self Cite

View full text Add to dashboard Cite

The problem addressed in this paper is sound, scalable, demand-driven nulldereference verification for Java programs. Our approach consists conceptually of a base analysis, plus two major extensions for enhanced precision. The base analysis is a dataflow analysis wherein we propagate formulas in the backward direction from a given dereference, and compute a necessary condition at the entry of the program for the dereference to be potentially unsafe. The extensions are motivated by the presence of certain "difficult" constructs in real programs, e.g., virtual calls with too many candidate targets, and library method calls, which happen to need excessive analysis time to be analyzed fully. The base analysis is hence configured to skip such a difficult construct when it is encountered by dropping all information that has been tracked so far that could potentially be affected by the construct. Our extensions are essentially more precise ways to account for the effect of these constructs on information that is being tracked, without requiring full analysis of these constructs. The first extension is a novel scheme to transmit formulas along certain kinds of def-use edges, while the second extension is based on using manually constructed backwarddirection summary functions of library methods. We have implemented our approach, and applied it on a set of real-life benchmarks. The base analysis is on average able to declare about 84% of dereferences in each benchmark as safe, while the two extensions push this number up to 91%.

show abstract

Per-Dereference Verification of Temporal Heap Safety via Adaptive Context-Sensitive Analysis

et al. 2019

View full text Add to dashboard Cite

We address the problem of verifying the temporal safety of heap memory at each pointer dereference. Unlike separation-logic-based approaches, our whole-program analysis approach is undertaken from the perspective of pointer analysis, allowing us to leverage the advantages of and advances in pointer analysis to improve precision and scalability. A dereference ω, say, via pointer q is unsafe iff there exists a deallocation ψ, say, via pointer p such that on a control-flow path ρ, p aliases with q (with both pointing to an object o representing an allocation), denoted A ψ ω (ρ), and ψ reaches ω on ρ via control flow, denoted R ψ ω (ρ). Applying directly any existing pointer analysis, which is typically solved separately with an associated control-flow reachability analysis, will render such verification highly imprecise, since ∃ρ.Ae., ∃ does not distribute over ∧). For precision, we solve ∃ρ.A ψ ω (ρ) ∧ R ψ ω (ρ), with a control-flow path ρ containing an allocation o, a deallocation ψ and a dereference ω abstracted by a tuple of three contexts (c o , c ψ , c ω ). For scalability, a demand-driven full context-sensitive (modulo recursion) pointer analysis, which operates on pre-computed def-use chains with adaptive context-sensitivity, is used to infer (c o , c ψ , c ω ), without losing soundness or precision. Our evaluation shows that our approach can successfully verify the safety of 81.3% (or 93,141 114,508 ) of all the dereferences in a set of 10 C programs totalling 1,166 KLOC.

show abstract

Null dereference verification via over-approximated weakest pre-conditions analysis

Cited by 22 publications

References 18 publications

Predicate abstraction of Java programs with collections

Predicate abstraction of Java programs with collections

Two techniques to improve the precision of a demand-driven null-dereference verification approach

Per-Dereference Verification of Temporal Heap Safety via Adaptive Context-Sensitive Analysis

Contact Info

Product

Resources

About