A system and language for building system-specific, static analyses

Abstract

This paper presents a novel approach to bug-finding analysis and an implementation of that approach. Our goal is to find as many serious bugs as possible. To do so, we designed a flexible, easy-to-use extension language for specifying analyses and an efflcent algorithm for executing these extensions. The language, metal, allows the users of our system to specify a broad class of analyses in terms that resemble the intuitive description of the rules that they check. The system, xgcc, executes these analyses efficiently using a context-sensitive, interprocedural analysis.Our prior work has shown that the approach described in this paper is effective: it has successfully found thousands of bugs in real systems code. This paper describes the underlying system used to achieve these results. We believe that our system is an effective framework for deploying new bug-finding analyses quickly and easily.

Towards Vulnerability Discovery Using Staged Program Analysis

“…The division of labor envisioned by Hallem et al [24] is that checkers only encode the property to check, leaving the mechanics of the actual checking to the compilation system. The compilation system facilitates checking by providing the necessary analysis infrastructure.…”

“…Inter-procedural context-sensitive analysis in Clang SA is based on the graph reachability algorithm proposed by Reps et al [37]. Clang SA is also similar in spirit to Metal/xgcc [24].…”

STANSE: Bug-Finding Framework for C Programs

“…Compared to the implementation described in [2] and [4], our technique differs in several aspects. In particular, we do not use metacompilation, automata are not input-language specific (a pattern matching is used instead), and the interprocedural analysis is done in the context of a single input file.…”

Symbiotic: Synergy of Instrumentation, Slicing, and Symbolic Execution

“…Metacompilation [10,26] is a static analysis technique looking for various kinds of errors specified by state machines. We explain the technique with use of the state machine SM (x) of Figure 1, which describes errors in lock manipulation.…”

“…At this point, we would like to emphasize that metacompilation actually uses a more sophisticated algorithm enriched with many techniques for partial elimination of false positives (see [26] for details). Metacompilation employs a dedicated language for description of state machines called Metal.…”