Symbolic pointer analysis for detecting memory leaks

Abstract

It is well accepted that pointers are a common source of memory anomalies such as loosing references to dynamic records without deallocating them (also known as memory leaks). This paper presents a novel pointer analysis framework that detects memory leaks by statically analyzing the behavior of programs. Our approach is based on symbolic evaluation of programs. Symbolic evaluation is an advanced static symbolic analysis that is centered around symbolic variable values, assumptions about and constraints between variable values, and control flow information (path conditions). As part of symbolic evaluation we introduce a new symbolic heap algebra for modeling heap operations. Predicates -defined over the program's input -are derived which allow to detect memory leaks. Our approach goes beyond previous work in the field of statically detecting memory leaks by considering also path conditions which increases the accuracy of our results, symbolically modeling heap data structures and heap operations. Examples are used to illustrate the effectiveness of our approach.

Symbolic Analysis of Imperative Programming Languages

“…Supercontexts describe the complete control and data flow analysis information valid at a given program point. This information is invaluable for all kinds of static program analyses, such as memory leak detection [32], program parallelisation [17,22,37,10], detection of superfluous bound checks, variable aliases and task deadlocks [31,13,6,7], and for worst-case execution time analysis [4,8].…”

“…Symbolic analysis is an advanced static program analysis technique. It has been successfully applied to memory leak detection [32], compilation of parallel programs [17,22,37,10], detection of superfluous bound checks, variable aliases and task deadlocks [31,13,6,7], and to worst-case execution time analysis [4,8]. The results gained using symbolic analysis provide invaluable information for optimising compilers, code generators, program verification, testing and debugging.…”

Symbolic marks in Petri nets regarding program analysis

“…В основном это различные модификации графа управления (Control Flow Graph) [1][2][3][4][5][6][7], представление в виде сетей Пет-ри [8][9][10][11][12][13] или представление в виде тотального графа переходов (Total Transition Graph) [14][15]. В данной работе представлена идея подхода к представ-лению программы в виде сети Петри, метки которой содержат символы вме-сто обычного представления со значениями.…”

Using symbolic execution to guide test generation

“…(1) handling loops within the source code [4]; (2) handling forward method calls [3]; (3) array element aliasing [7]; (4) infeasible paths [4]; (5) pointer/reference aliasing [8]; and (6) handling other complex abstract data types. ‡ An implicit assumption in all of this work is that a correct validated specification exists.…”

“…Attempts to apply symbolic execution to languages whose use of pointers has been (appropriately) described as 'promiscuous' § have not been generally successful: for example, Scholz et al proposed a complex and rather impractical system for memory leak detection [8].…”