String Analysis for Software Verification and Security

Bultan, Tevfik; Yu, Fang; Alkhalaf, Muath; Aydin, Abdulbaki

doi:10.1007/978-3-319-68670-7

Cited by 26 publications

(27 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Consider the split segmentation abstract predicate m = ([0, 0] 'a' [2,5], ∅) where C is the constant propagation domain for characters and B the interval domain. m approximates character arrays certainly containing a string of interest which is actually a sequence of 'a', whose length goes from 2 to 5, followed by a null character, e.g., "aa\0" and "aaaaa\0".…”

Section: Example 10mentioning

confidence: 99%

“…In doing so, we will take advantage of the auxiliary function minlen which computes the minimum length of an element m ∈ M, as the upper bound of a split segmentation is possibly followed by a question mark. 2 2 ] such that b denotes the immediately preceding adapted segment bound. On the other hand, m 1 .ns is the result of removing from m 1 .ns the sub-segmentation that goes from the lower bound of m 1 .ns to the upper bound of m 1 .s included.…”

Section: Abstract Semanticsmentioning

confidence: 99%

“…Strings in C are not a basic data type. As a matter of facts, strings in C are represented by zero-terminated arrays of characters and there are libraries that provide functions which allow operating on them [2]. C programs that manipulate strings can suffer from buffer overflows and related issues due to the possible discrepancy between the size of the string and the size of the array (buffer).…”

Section: Introductionmentioning

confidence: 99%

“…low a , high a ∈ E are expressions whose value, given by [[low a ]]ρ and [[high a ]]ρ, respectively represents the lower bound and the upper bound of an array a, i.e., the lower and the upper bound of its indexes range. According to the denotational semantics approach, in [6] the value of an arithmetic expression e is denoted by [[e]]ρ, where: (1) the double square brackets notation denotes the semantic evaluation function and, (2) ρ is an environment mapping program variables (which also may appear in e) to their value. Typically, [[x]]ρ is equivalent to ρ(x), with x ∈ X, and [[n]]ρ, where n is a constant, is equivalent to n itself.…”

mentioning

confidence: 99%

See 3 more Smart Citations

Abstracting Strings for Model Checking of C Programs

et al. 2020

View full text Add to dashboard Cite

Data type abstraction plays a crucial role in software verification. In this paper, we introduce a domain for abstracting strings in the C programming language, where strings are managed as null-terminated arrays of characters. The new domain M-String is parametrized on an index (bound) domain and a character domain. By means of these different constituent domains, M-Strings captures shape information on the array structure as well as value information on the characters occurring in the string. By tuning these two parameters, M-String can be easily tailored for specific verification tasks, balancing precision against complexity. The concrete and the abstract semantics of basic operations on strings are carefully formalized, and soundness proofs are fully detailed. Moreover, for a selection of functions contained in the standard C library, we provide the semantics for character access and update, enabling an automatic lifting of arbitrary string-manipulating code into our new domain. An implementation of abstract operations is provided within a tool that automatically lifts existing programs into the M-String domain along with an explicit-state model checker. The accuracy of the proposed domain is experimentally evaluated on real-case test programs, showing that M-String can efficiently detect real-world bugs as well as to prove that program does not contain them after they are fixed.

show abstract

Section: Example 10mentioning

confidence: 99%

Section: Abstract Semanticsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

mentioning

confidence: 99%

See 2 more Smart Citations

Abstracting Strings for Model Checking of C Programs

et al. 2020

View full text Add to dashboard Cite

show abstract

“…For timing side channels, many analysis and verification techniques [6,9,10,25,45,46,53,62] have been developed, including the one proposed by Chen et al [11], which uses Cartesian Hoare Logic [51] to prove that timing leaks of a program are bounded. Antonopoulos et al [5] also developed a method for proving the absence of timing channels.…”

Section: Related Workmentioning

confidence: 99%

Abstract interpretation under speculative execution

Wang

2019

Proceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation

View full text Add to dashboard Cite

Analyzing the behavior of a program running on a processor that supports speculative execution is crucial for applications such as execution time estimation and side channel detection. Unfortunately, existing static analysis techniques based on abstract interpretation do not model speculative execution since they focus on functional properties of a program while speculative execution does not change the functionality. To fill the gap, we propose a method to make abstract interpretation sound under speculative execution. There are two contributions. First, we introduce the notion of virtual control flow to augment instructions that may be speculatively executed and thus affect subsequent instructions. Second, to make the analysis efficient, we propose optimizations to handle merges and loops and to safely bound the speculative execution depth. We have implemented and evaluated the proposed method in a static cache analysis for execution time estimation and side channel detection. Our experiments show that the new method, while guaranteed to be sound under speculative execution, outperforms state-of-the-art abstract interpretation techniques that may be unsound.CCS Concepts • Software and its engineering → Formal software verification; Compilers; • Security and privacy → Cryptanalysis and other attacks. SpeculativeAbstract Interpretation Architectural Parameters (cache config., speculation depth) Control Flow Analysis

show abstract

String Abstraction for Model Checking of C Programs

Cortesi

Lauko

Olliaro

et al. 2019

Model Checking Software

View full text Add to dashboard Cite

Automatic abstraction is a powerful software verification technique. In this paper, we elaborate an abstract domain for C strings, that is, null-terminated arrays of characters. We describe the abstract semantics of basic string operations and prove their soundness with regards to previously established concrete semantics of those operations. In addition to a selection of string functions from the standard C library, we provide semantics for character access and update, enabling automatic lifting of arbitrary string-manipulating code into the domain. The domain we present (called M-String) has two other abstract domains as its parameters: an index (bound) domain and a character domain. Picking different constituent domains allows M-String to be tailored for specific verification tasks, balancing precision against complexity. In addition to describing the domain theoretically, we also provide an executable implementation of the abstract operations. Using a tool which automatically lifts existing programs into the M-String domain along with an explicit-state model checker, we have evaluated the proposed domain experimentally on a few simple but realistic test programs.

show abstract

String Analysis for Software Verification and Security

Cited by 26 publications

References 0 publications

Abstracting Strings for Model Checking of C Programs

Abstracting Strings for Model Checking of C Programs

Abstract interpretation under speculative execution

String Abstraction for Model Checking of C Programs

Contact Info

Product

Resources

About