Modular Pluggable Analyses for Data Structure Consistency

Abstract

Abstract-Hob is a program analysis system that enables the focused application of multiple analyses to different modules in the same program. In our approach, each module encapsulates one or more data structures and uses membership in abstract sets to characterize how objects participate in data structures. Each analysis verifies that the implementation of the module 1) preserves important internal data structure consistency properties and 2) correctly implements a set algebra interface that characterizes the effects of operations on the data structure. Collectively, the analyses use the set algebra to 1) characterize how objects participate in multiple data structures and to 2) enable the inter-analysis communication required to verify properties that depend on multiple modules analyzed by different analyses.We implemented our system and deployed several pluggable analyses, including a flag analysis for modules in which abstract set membership is determined by a flag field in each object, a PALE shape analysis plugin, and a theorem proving plugin for analyzing arbitrarily complicated data structures. Our experience shows that our system can effectively 1) verify the consistency of data structures encapsulated within a single module and 2) combine analysis results from different analysis plugins to verify properties involving objects shared by multiple modules analyzed by different analyses.

Practical API Protocol Checking with Access Permissions

“…These approaches di er signi cantly in the way protocols are speci ed, including typestates [33,15,26,19,17,7], type quali ers [20], size properties [13], direct constraints on ordering [24,10,30], type re nements [29,14], rst-order [27,2] or separation logic [32], and various temporal logics [23]. In these approaches, like in ours, usage rules of the API(s) of interest have to be codi ed by a developer.…”

“…(Interestingly, all of these approaches that we are aware of are modular typestate analyses [17,26,7].) Ours is the only approach (that we are aware of ) that can verify correct usage and implementation of dynamic state test methods.…”

Collections, Cardinalities, and Relations

“…We subsequently generalized this result to quantifier-free constraints on multisets (bags), collections in which an element can occur multiple times [22,23]. The usefulness of collections and cardinality measures on them has been established through a number of examples from software analysis and verification, including not only decision procedures [14,16,29] but also static analyses that operate directly on the set abstraction or the cardinality abstraction [11,13,21].…”

Scalable data structure detection and classification for C/C++ binaries

“…Shape analysis (Ghiya and Hendren 1996;Sagiv et al 1999;Kuncak et al 2006;Bogudlov et al 2007;Zee et al 2008) is a static analysis technique that discovers and verifies properties of linked, dynamically allocated data structures. It is typically used at compile time to find software bugs or to verify high-level correctness properties of programs.…”