Automatically learning shape specifications

Zhu, He; Petri, Gustavo; Jagannathan, Suresh

doi:10.1145/2980983.2908125

Cited by 7 publications

(1 citation statement)

References 73 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the context of functional languages, [15] allows to write down relations between function inputs and outputs, and relies on a solver to verify constraints hold. Also, [22] computes shape specifiations by learning.…”

Section: Related Workmentioning

confidence: 99%

A Relational Shape Abstract Domain

Illous

Lemerre

Rival

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Static analyses aim at inferring semantic properties of programs. While many analyses compute an over-approximation of reachable states, some analyses compute a description of the input-output relations of programs. In the case of numeric programs, several analyses have been proposed that utilize relational numerical abstract domains to describe relations. On the other hand, designing abstractions for relations over memory states and taking shapes into account is challenging. In this paper, we propose a set of novel logical connectives to describe such relations, which are inspired by separation logic. This logic can express that certain memory areas are unchanged, freshly allocated, or freed, or that only part of the memory was modified. Using these connectives, we build an abstract domain and design a static analysis that over-approximates relations over memory states containing inductive structures. We implement this analysis and report on the analysis of a basic library of list manipulating functions.

show abstract

Section: Related Workmentioning

confidence: 99%

A Relational Shape Abstract Domain

Illous

Lemerre

Rival

2017

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

Generating Inductive Shape Predicates for Runtime Checking and Formal Verification

Boockmann

Lüttgen

Mühlberg

2018

Leveraging Applications of Formal Methods, Verification and Validation. Verification

View full text Add to dashboard Cite

Knowing the shapes of dynamic data structures is key when formally reasoning about pointer programs. While modern shape analysis tools employ symbolic execution and machine learning to infer shapes, they often assume well-structured C code or programs written in an idealised language. In contrast, our Data Structure Investigator (DSI) tool for program comprehension analyses concrete executions and handles even C programs with complex coding styles. Our current research on memory safety develops ways for DSI to synthesise inductive shape predicates in separation logic. In the context of trusted computing, we investigate how the inferred predicates can be employed to generate runtime checks for securely communicating dynamic data structures across trust boundaries. We also explore to what extent these predicates, together with additional information extracted by DSI, can be used within general program verifiers such as VeriFast. This paper accompanies a talk at the ISoLA 2018 track "A Broader View on Verification: From Static to Runtime and Back". It introduces DSI, highlights the above use cases, and sketches our approach for synthesising inductive shape predicates. MotivationFormally reasoning about the memory safety and security of C code executing on processors is a serious challenge, especially when dynamic data structures are involved. The advent of separation logic [18] for modularly specifying heap operations and data structure shapes has sparked a wealth of research in the computer-aided verification of pointer programs. This has led to the development of powerful static verifiers, including shape analysis tools such as Forester [9] and Infer [6, 7] and program verifiers such as VeriFast [17]. While the latter requires significant manual effort in annotating programs with contracts, recent automated shape analysis techniques employ machine learning [4,25] but assume well-structured code and a well-behaved execution environment. However, these

show abstract