Pointer disambiguation via strict inequalities

Abstract

The design and implementation of static analyses that disambiguate pointers has been a focus of research since the early days of compiler construction. One of the challenges that arise in this context is the analysis of languages that support pointer arithmetics, such as C, C++ and assembly dialects. This paper contributes to solve this challenge. We start from an obvious, yet unexplored, observation: if a pointer is strictly less than another, they cannot alias. Motivated by this remark, we use abstract interpretation to build strict less-than relations between pointers. We construct a program representation that bestows the Static Single Information (SSI) property onto our dataflow analysis. SSI gives us a sparse algorithm, whose correctness is easy to ensure. We have implemented our static analysis in LLVM. It runs in time linear on the number of program variables, and, depending on the benchmark, it can be as much as six times more precise than the pointer disambiguation techniques already in place in that compiler.

Combining range and inequality information for pointer disambiguation

“…Testimony to this observation is the fact that the most well-known alias analyses, such as Andersen's [Andersen (1994)] or Steensgard's [Steensgaard (1996)] formulation, do not address this problem. This paper, which subsumes three years of research partially published in two previous works [Maalej et al (2017); Paisante et al (2016)], provides a theoretical and practical framework that fills this omission.…”

“…Both these techniques have spurred a long string of publications within the programming languages literature. We do not know of another work that joins both these research directions into a single path, except for the two papers that we have recently published, and that this document expands [Maalej et al (2017); Paisante et al (2016)]. In the rest of this section we discuss how we extend that previous work or ours, and how we differ from the current state-of-the-art literature on alias and less-than analyses.…”

“…Pointer Disambiguation via Strict Inequalities. A precursor of our Less-Than check is described in our previous work [Maalej et al (2017)]. Our past experience has let us evolve that disambiguation technique along three different directions: for Pointer Disambiguation », accepted in Science of Computer Programming, 2017…”

“…We consider the program snippet in figure 27. In [Maalej et al (2017) . We want to disambiguate pointers p1 and p3 which are both defined from the same base pointer p. Our previous disambiguation check would answer "may alias" for those two pointers: however, in this work we answer "no alias".…”

The computer for the 21st century: present security & privacy challenges

“…In the second front, researchers have devised analyses that infer the contents [48] and the size of arrays [49] in weakly-typed programming languages. More importantly, recent years have seen a new flurry of algorithms designed to analyze C/C++ style pointer arithmetics [50][51][52][53]. The wide adoption of higher-level programming languages coupled with the construction of new tools to analyze lower-level languages is exciting.…”