Value-Flow-Based Demand-Driven Pointer Analysis for C and C++

Abstract

We present SUPA, a value-flow-based demand-driven flow-and context-sensitive pointer analysis with strong updates for C and C++ programs. SUPA enables computing points-to information via value-flow refinement, in environments with small time and memory budgets. We formulate SUPA by solving a graph-reachability problem on an inter-procedural value-flow graph representing a program's def-use chains, which are pre-computed efficiently but over-approximately. To answer a client query (a request for a variable's points-to set), SUPA reasons about the flow of values along the pre-computed def-use chains sparsely (rather than across all program points), by performing only the work necessary for the query (rather than analyzing the whole program). In particular, strong updates are performed to filter out spurious def-use chains through value-flow refinement as long as the total budget is not exhausted. We have implemented SUPA on top of LLVM (4.0.0) together with a comprehensive micro-benchmark suite after a years-long effort (consisting of around 400 test cases, including hand-written ones and the ones extracted from real programs). We have evaluated SUPA by choosing uninitialized pointer detection and C++ virtual table resolution as two major clients, using 24 real-world programs including 18 open-source C programs and 6 large CPU2000/2006 C++ benchmarks. For uninitialized pointer client, SUPA achieves improved precision as the analysis budget increases, with its flow-sensitive (context-insensitive) analysis reaching 97.4% of that achieved by whole-program Sparse Flow-Sensitive analysis (SFS) by consuming about 0.18 seconds and 65KB of memory per query, on average (with a budget of at most 10000 value-flow edges per query). With context-sensitivity also considered, SUPA becomes more precise for some programs but also incurs more analysis times. To further demonstrate the effectiveness of SUPA, we have also evaluated SUPA in resolving C++ virtual tables by querying the function pointers at every virtual callsite. Compared to analysis without strong updates for heap objects, SUPA's demand-driven context-sensitive strong update analysis reduces 7.35% spurious virtual table targets with only 0.4 secs per query, on average.

An Empirical Study of Regression Bug Chains in Linux

“…After performing the RBC search algorithm provided in Section III on the constructed directed bipartite network, we obtained the numbers and the proportions for RBCs shown in Table IV. The number of hybrid nodes (i.e., a commit is both and memory-related bugs (e.g., null pointer dereference: bug ID-14030, memory leak: bug ID-13518), it is useful to apply some static code analysis tools for detecting these types of bugs [27]- [29].…”

Efficient Path-Sensitive Data-Dependence Analysis

“…A recent analysis [96] has leveraged the idea of sparsity to refine the flow-insensitive results into a path-sensitive one on demand. It first constructs the flow-insensitive def-use chains with a pre-analysis, which then enable the primary path-sensitive analysis to be performed sparsely [84,86,96]. For instance, as shown in Fig.…”

“…-In building value-flow graphs, Falcon outperforms Svf [85], Sfs [36], and Dsa [47], achieving on average 17×, 25×, and 4.4× speedups, respectively. -Compared with Supa [84,86], the state-of-the-art demand-driven flow-and context-sensitive pointer analysis for C/C++, Falcon is 54× in answering thin slicing queries, and it improves the precision by 1.6×. -In comparison with Cred [96], a state-of-the-art path-sensitive value flow analysis for bug hunting, Falcon is on average 6× faster, and finds more real bugs (21 vs. 12) with a lower false-positive rate (25% vs. 47.8%).…”

Memory Leak Detection in IoT Program Based on an Abstract Memory Model SeqMM

“…Flow-sensitive analysis [7]- [10] considers the order in which statements are executed. Traditional data flow analysis is flow-sensitive, whereas flow-insensitive analysis appears mainly in points-to analysis [11], [12].…”