Predator: A Shape Analyzer Based on Symbolic Memory Graphs

Abstract

Abstract. Predator is a shape analyzer that uses the abstract domain of symbolic memory graphs in order to support various forms of low-level memory manipulation commonly used in optimized C code. This paper briefly describes the verification approach taken by Predator and its strengths and weaknesses revealed during its participation in the Software Verification Competition (SV-COMP'14). Verification ApproachPredator is a shape analyzer that uses the abstract domain of symbolic memory graphs (SMGs) in order to support various forms of low-level memory manipulation commonly used in optimized C code. Compared to separation logic-based works [1], which our work is inspired by, SMGs allow one to easily apply various graph-based algorithms to efficiently manipulate with the low-level memory representation.The formal definition of SMGs can be found in [2] together with algorithms of all the operations needed for use of SMGs in a fully automatic shape analysis. This is in particular the case of a specialised unary abstraction operator and a binary join operator that aid termination of the SMG-based shape analysis. The join operator is based on an algorithm that simultaneously traverses a pair of input SMGs and merges their corresponding nodes. The core of the join algorithm is also used by the algorithm implementing the abstraction operator to merge pairs of neighbouring nodes, together with their sub-SMGs (describing the data structures nested below them), into a single list segment. For checking entailment of SMGs, Predator again reuses the join algorithm (extended to compare generality of the SMGs being joined).Predator requires all external functions to be properly modelled wrt. memory safety in order to exclude any side effects that could possibly break soundness of the analysis. Our distribution of Predator includes models of memory allocation functions (like malloc or free) and selected memory manipulating functions (memset, memcpy, memmove, etc.).Since SV-COMP'13, the core algorithms of shape analysis were reimplemented in order to match their description presented in [2]. Consequently, the current implementation is much easier to follow, but at the same time also faster and more precise (as witnessed by the results of SV-COMP'14).

Automatically Proving Termination and Memory Safety for Programs with Pointer Arithmetic

“…More precisely, for the 631 programs in our collection, AProVE shows memory safety for 547 examples. In contrast, the most powerful tool for verifying memory safety at SV-COMP 2016 (Predator [33]) proves memory safety for 431 examples (see [3] for details). However, this comparison is not very meaningful, since Predator considers bounded integers, whereas AProVE assumes integers to be unbounded.…”

“…Acknowledgements We are grateful to the developers of the other tools for termination or memory safety [33,35,43,52,71] for their help with the experiments.…”

Proving Termination and Memory Safety for Programs with Pointer Arithmetic

“…Although our approach is targeted toward termination and only analyzes memory safety as a prerequisite for termination, it turned out that on our collection, AProVE is more powerful than the leading publicly available tools for proving memory safety. To this end, we compared AProVE with the tools CPAchecker [18] and Predator [10] which reached the first and the third place in the category for memory safety at SV-COMP 2014. 18 For the 129 pointer programs in our collection, AProVE can show memory safety for 102 examples, whereas CPAchecker resp.…”

“…We are grateful to the developers of the other tools for termination or memory safety [6,10,12,15,16,18,29] for their help with the experiments.…”