2020
DOI: 10.1109/tse.2018.2869336
|View full text |Cite
|
Sign up to set email alerts
|

Value-Flow-Based Demand-Driven Pointer Analysis for C and C++

Abstract: We present SUPA, a value-flow-based demand-driven flow-and context-sensitive pointer analysis with strong updates for C and C++ programs. SUPA enables computing points-to information via value-flow refinement, in environments with small time and memory budgets. We formulate SUPA by solving a graph-reachability problem on an inter-procedural value-flow graph representing a program's def-use chains, which are pre-computed efficiently but over-approximately. To answer a client query (a request for a variable's po… Show more

Help me understand this report

Search citation statements

Order By: Relevance

Paper Sections

Select...
1
1
1
1

Citation Types

0
15
0

Year Published

2020
2020
2024
2024

Publication Types

Select...
5
2
1

Relationship

2
6

Authors

Journals

citations
Cited by 30 publications
(15 citation statements)
references
References 70 publications
(129 reference statements)
0
15
0
Order By: Relevance
“…After performing the RBC search algorithm provided in Section III on the constructed directed bipartite network, we obtained the numbers and the proportions for RBCs shown in Table IV. The number of hybrid nodes (i.e., a commit is both and memory-related bugs (e.g., null pointer dereference: bug ID-14030, memory leak: bug ID-13518), it is useful to apply some static code analysis tools for detecting these types of bugs [27]- [29].…”
Section: Discussionmentioning
confidence: 99%
“…After performing the RBC search algorithm provided in Section III on the constructed directed bipartite network, we obtained the numbers and the proportions for RBCs shown in Table IV. The number of hybrid nodes (i.e., a commit is both and memory-related bugs (e.g., null pointer dereference: bug ID-14030, memory leak: bug ID-13518), it is useful to apply some static code analysis tools for detecting these types of bugs [27]- [29].…”
Section: Discussionmentioning
confidence: 99%
“…A recent analysis [96] has leveraged the idea of sparsity to refine the flow-insensitive results into a path-sensitive one on demand. It first constructs the flow-insensitive def-use chains with a pre-analysis, which then enable the primary path-sensitive analysis to be performed sparsely [84,86,96]. For instance, as shown in Fig.…”
Section: Overviewmentioning
confidence: 99%
“…-In building value-flow graphs, Falcon outperforms Svf [85], Sfs [36], and Dsa [47], achieving on average 17×, 25×, and 4.4× speedups, respectively. -Compared with Supa [84,86], the state-of-the-art demand-driven flow-and context-sensitive pointer analysis for C/C++, Falcon is 54× in answering thin slicing queries, and it improves the precision by 1.6×. -In comparison with Cred [96], a state-of-the-art path-sensitive value flow analysis for bug hunting, Falcon is on average 6× faster, and finds more real bugs (21 vs. 12) with a lower false-positive rate (25% vs. 47.8%).…”
Section: Introductionmentioning
confidence: 99%
“…Flow-sensitive analysis [7]- [10] considers the order in which statements are executed. Traditional data flow analysis is flow-sensitive, whereas flow-insensitive analysis appears mainly in points-to analysis [11], [12].…”
Section: B Data Flow Analysismentioning
confidence: 99%