Parametric shape analysis via 3-valued logic

Abstract

We present a family of abstract-interpretation algorithms that are capable of determining "shape invariants" of programs that perform destructive updating on dynamically allocated storage. The main idea is to represent the stores that can passibly arise during execution using three-valued logical structures.Questions about properties of stores can be answered by evaluating predicate-logic formulae using Kleene's semantics of three-valued logic:l If a formula evaluates to true, then the formula holds in every store represented by the three-valued structure.l If a formula evaluates to false, then the formula does not hold in any store represented by the three-valued structure.l If a formula evaluates to unknown, then we do not know if this formula always holds, never holds, or sometimes holds and sometimes does not hold in the stores represented by the three-valued structure.Three-valued logical structures are thus a conservative representation of memory stores. The approach described is a parametric framework: It provides the basis for generating a family of shape-analysis algorithms by varying the vocabulary used in the three-valued logic.Permission to make digital or hard copies of all or parl ufthis work for personal or classroom me is granted withwt fee procided that copies are not made or distrihutcd for profit or cnrnmercinl advantage IIKI that copies bear this notice and the full citation on the first page. To copy otherwise. to republid~, to post on sewers or to redistribute tn lists, requires prior specific permission anJ!or a fee.

Inferring specifications to detect errors in code

“…These properties are more similar to the kind of properties that shape analysis techniques (e.g. Balaban et al, 2005;Sagiv et al, 1998Sagiv et al, , 2002 target. However, those techniques aim at proving a property of a program, while our technique provides a lightweight analysis geared at finding bugs.…”

Verification of heap manipulating programs with ordered data by extended forest automata

“…For shape analysis, many other formalisms than FAs have been used, including, e.g., separation logic and various related graph formalisms [10,14,21,29], other logics [18,26], automata [8], or graph grammars [16]. Compared with FAs, these approaches typically handle less general heap structures (often restricted to various classes of lists) [14,29], they are less automated (requiring the user to specify loop invariants [18] or at least inductive definitions of the involved data structures [10,16,21]), or less scalable [8].…”

Scalable data structure detection and classification for C/C++ binaries

“…Shape analysis (Ghiya and Hendren 1996;Sagiv et al 1999;Kuncak et al 2006;Bogudlov et al 2007;Zee et al 2008) is a static analysis technique that discovers and verifies properties of linked, dynamically allocated data structures. It is typically used at compile time to find software bugs or to verify high-level correctness properties of programs.…”