STANSE: Bug-Finding Framework for C Programs

Abstract

Stanse is a free (available under the GPLv2 license) modular framework for finding bugs in C programs using static analysis. Its two main design goals are 1) ability to process large software projects like the Linux kernel and 2) extensibility with new bug-finding techniques with a minimal effort. Currently there are four bug-finding algorithms implemented within Stanse: AutomatonChecker checks properties described in an automata-based formalism, ThreadChecker detects deadlocks among multiple threads, LockChecker finds locking errors based on statistics, and ReachabilityChecker looks for unreachable code. Stanse has been tested on the Linux kernel, where it has found dozens of previously undiscovered bugs.

Symbiotic: Synergy of Instrumentation, Slicing, and Symbolic Execution

“…It implements an interprocedural dataflow algorithm based on [32] for error detection and an abstract simulation pruning algorithm for false positives suppression. Stanse [29], a static analysis tool also uses state machines for description of checked program properties. The description is based on parametrised abstract syntax trees.…”

“…Metacompilation employs a dedicated language for description of state machines called Metal. The idea of error specification using state machines appears in several tools including the original implementation of metacompilation called xgcc [26], Esp [11] or Stanse [29].…”

Checking Properties Described by State Machines: On Synergy of Instrumentation, Slicing, and Symbolic Execution

“…It implements an interprocedural dataflow algorithm based on [29] for error detection and an abstract simulation pruning algorithm for false positives suppression. Stanse [27], a static analysis tool also uses state machines for description of checked program properties. The description is based on parametrised abstract syntax trees.…”

“…This formalism is simple and still flexible enough to describe many often studied program properties including locking policy in concurrent programs, null-pointer dereferences, resource allocations, and resource leaks. FSM specification is therefore used in many static program analysis tools like xgcc [24], SLAM [4], SDV [3], Blast [5], ESP [14], or Stanse [27]. All the mentioned tools produce false positives, i.e.…”