Gillian, Part II: Real-World Verification for JavaScript and C

Abstract

We introduce verification based on separation logic to Gillian, a multi-language platform for the development of symbolic analysis tools which is parametric on the memory model of the target language. Our work develops a methodology for constructing compositional memory models for Gillian, leading to a unified presentation of the JavaScript and C memory models. We verify the JavaScript and C implementations of the AWS Encryption SDK message header deserialisation module, specifically designing common abstractions used for both verification tasks, and find two bugs in the JavaScript and three bugs in the C implementation.

A Formal CHERI-C Semantics for Verification

“…We also note that the current heap design keeps track of negative resources [28], which may potentially be useful for incorrectness logic based verification [33].…”

“…Gillian is a high-level analysis framework, theoretically capable of analysing a wide range of languages. The framework allows concrete and symbolic execution, verification based on Separation Logic, and bi-abduction [28]. The crux of the framework lies in its parametricity, where the tool can be instantiated by simply providing a compiler front end and OCaml-based memory models of the language.…”

“…assumptions, and generation of symbolic variables. For separation logic based verification, the GIL grammar is further extended to support core predicates and user-defined predicates [28] that can be utilised to form separation logic based assertions. Furthermore, function specifications in the Hoare-triple form {P }f (x){Q} can be provided, where P and Q are separation logic based assertions.…”

“…The executional memory model states properties a memory model must have for whole-program execution, and the compositional memory model states properties a memory model must have for separation logic based symbolic verification. Each paper in the Gillian literature states slightly different definitions for the memory models [20,28,29,37]-in Definitions 1 and 2 below, we present unified, consistent definitions for each of the memory model properties. We ignore contexts, as there exists only one context in concrete memories, which is the GIL boolean value true.…”

Low-Level Bi-Abduction

“…Finally, we mention the Gillian project, a language-independent framework based on separation logic for the development of compositional symbolic analysis tools, including tools for whole-program symbolic execution, verification of annotated code, as well as bi-abduction [35,34,29,28]. The works on Gillian concentrate on the generic framework it develops, and the published description of the supported bi-abductive analysis, perhaps most discussed in [34], is unfortunately not very detailed.…”