A system and language for building system-specific, static analyses

Abstract

This paper presents a novel approach to bug-finding analysis and an implementation of that approach. Our goal is to find as many serious bugs as possible. To do so, we designed a flexible, easy-to-use extension language for specifying analyses and an efflcent algorithm for executing these extensions. The language, metal, allows the users of our system to specify a broad class of analyses in terms that resemble the intuitive description of the rules that they check. The system, xgcc, executes these analyses efficiently using a context-sensitive, interprocedural analysis.Our prior work has shown that the approach described in this paper is effective: it has successfully found thousands of bugs in real systems code. This paper describes the underlying system used to achieve these results. We believe that our system is an effective framework for deploying new bug-finding analyses quickly and easily.

The Verifying Compiler: A Grand Challenge for Computing Research

“…Many of the analysis and verification tools essential to this project are already available, and can be applied now to legacy code [22][23][24][25][26][27]. But their use is still too laborious, and their improvement over a lengthy period will be necessary to achieve the goals of the challenge.…”

The Verified Software Challenge: A Call for a Holistic Approach to Reliability

“…The software tools developed and applied over the last eight years have had impact. This list of tools includes Blast [HJMS02], CCured [NMW02], CQual [FTA02], ESC/Java [FLL + 02], ESP [DLS02], Feaver [Hol00], MAGIC [CCG + 04], MC [HCXE02], MOPS [CDW04], Prefast [LBD+04], Prefix [BPS00], SLAM [BR01], Splint [EL02] and Verisoft [God97], to name a few.…”

Incremental Algorithms for Inter-procedural Analysis of Safety Properties

“…Static analysis tools such as MC/Coverity [1] and Uno [2], and model checking tools such as SLAM [3] are based on inter-procedural algorithms for propagating dataflow information [4,5,6,7]. These algorithms perform a reachability analysis that always starts from scratch.…”