Precise Interprocedural Analysis in the Presence of Pointers to the Stack

Abstract

Abstract. In a language with procedures calls and pointers as parameters, an instruction can modify memory locations anywhere in the call-stack. The presence of such side effects breaks most generic interprocedural analysis methods, which assume that only the top of the stack may be modified. We present a method that addresses this issue, based on the definition of an equivalent local semantics in which writing through pointers has a local effect on the stack. Our second contribution in this context is an adequate representation of summary functions that models the effect of a procedure, not only on the values of its scalar and pointer variables, but also on the values contained in pointed memory locations. Our implementation in the interprocedural analyser PInterproc results in a verification tool that infers relational properties on the value of Boolean, numerical and pointer variables.

Lifting Numeric Relational Domains to Algebraic Data Types

“…Several relational analyses were developed for the inter-procedural analysis of numeric programs [5,23,36,42], and in the context of inter-procedural shape analysis [20,22,43]. They all feature a form of function summary, that helps reduce the analysis cost of large programs, by enabling modular analyses.…”

Disjunctive Relational Abstract Interpretation for Interprocedural Program Analysis

“…Reps et al [46] proposed an algorithm belonging to the family of functional approaches to solve data flow problems with finite semilattices and distributive propagation functions in polynomial time, by recasting these data flow problems into graph reachability problems. Jeannet et al [30,50] proposed a method reminiscent of the call strings approach, for the relational numerical analysis of programs with recursive procedures and pointers to the stack. It is a top-down approach based on an abstraction of the stack.…”

Modular Static Analysis of String Manipulations in C Programs

“…In [11], numerical relations are used to represent the semantic of a set of statements, however this is limited to numerical programs whereas we extend the method to consider both numbers and pointers, including pointer arithmetic. The analyzer proposed by Sotin and Jeannet in [23] is able to infer input/output relations of the form proposed in Section 5. Nevertheless they consider a subset of C that does not contain pointer arithmetic, union types nor pointer casts.…”