Pinpoint: fast and precise sparse value flow analysis for million lines of code

Abstract

When dealing with millions of lines of code, we still cannot have the cake and eat it: sparse value-flow analysis is powerful in checking source-sink problems, but existing work cannot escape from the “pointer trap” – a precise points-to analysis limits its scalability and an imprecise one seriously undermines its precision. We present Pinpoint, a holistic approach that decomposes the cost of high-precision points-to analysis by precisely discovering local data dependence and delaying the expensive inter-procedural analysis through memorization. Such memorization enables the on-demand slicing of only the necessary inter-procedural data dependence and path feasibility queries, which are then solved by a costly SMT solver. Experiments show that Pinpoint can check programs such as MySQL (around 2 million lines of code) within 1.5 hours. The overall false positive rate is also very low (14.3% - 23.6%). Pinpoint has discovered over forty real bugs in mature and extensively checked open source systems. And the implementation of Pinpoint and all experimental results are freely available.

Conquering the extensional scalability problem for value-flow analysis frameworks

“…Figure 3 shows a running example using the value-flow graph where we check the null-deference and the free-global-pointer bugs following the workflow illustrated in Figure 2. Given a program, we first follow the previous work [12,38,42] to build the value-flow graph in order to check the two properties with the precision of path-sensitivity. Here, path-sensitivity means that when searching paths on the value-flow graph, we invoke an SMT solver to solve path conditions and other property-specific constraints to prune infeasible paths.…”

“…Second, despite many studies on value-flow analysis [12,30,38,41,42], we still have a lack of general and extensible specification models that can maximize the opportunities of sharing analysis results across the processes of checking different properties. Some of the existing studies only focus on checking a specific property (e.g., memory leak [42]), while others adopt different specifications to check the same value-flow property (e.g., double free [12,38]). Preliminaries.…”

“…Value-flow analysis [12,30,38,41], which tracks how values are stored and loaded in a program, underpins the inspection of a very broad category of software properties, such as memory safety (e.g., null dereference, double free, etc. ), resource usage (e.g., memory leak, file usage, etc.…”

“…For example, our evaluation shows that CSA cannot path-sensitively check twenty properties for many programs in ten hours. Pinpoint [38], another recent analyzer, exhausted 256GB of memory for only eight properties.…”

Unification-based Pointer Analysis without Oversharing

“…In verification and bug-finding, PTA is often used as a pre-analysis to limit the implicit dependencies between values stored in memory. This is typically followed by a deeper, more expensive, path-sensitive analysis (e.g., [1], [2], [3]). In both applications, the efficiency of PTA is crucial since it directly impacts compilation and verification times, while precision of the analysis determines its usability.…”