Result graphs for an abstract interpretation-based static analyzer - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2017

Result graphs for an abstract interpretation-based static analyzer

Pascal Cuoq
  • Fonction : Auteur
  • PersonId : 1005708
Raphaël Rieu-Helft

Résumé

TIS-Analyzer is a static analysis platform based on Frama-C. It integrates C analyzers in a plugin architecture and can be used to soundly detect undened behaviors in C programs. The plugins communicate with each other to increase their precision. The Value analysis plugin uses dataow analysis to produce a sound representation of the memory state at each control point of the program. Its abstract domain allows to represent disjunctions of non-relational value states. Further plugins then use this information to conduct derived analyses (operational inputs, dependencies...) However, the disjunctions alone are not sucient: they do not allow the derived analyses to know which disjuncts of the representation of an abstract state can be reached from each disjunct of the state at the previous statement. We present a representation of the end result of the Value analysis as a graph that renes the program's control ow graph. In this result graph, each separate non-relational abstract state occurring at a particular statement is represented as a distinct node. We argue that this representation is what derived analyses should work on by default. It is also a way to formalize the Value analysis in terms of abstract interpretation. Finally, result graphs are suited for human review and allow users to nd the root cause of alarms raised by the analysis. When implemented naively, the propagation of the disjunctions of abstract states requires a quadratic number of potentially costly inclusion tests between abstract states. We present an ecient algorithm that takes advantage of the hash-consed representation of abstract states as Patricia trees to reduce the cost of testing the inclusion of a state in a set of states to amortized constant time. We also justify the correctness of this algorithm in a more general setting.
Fichier principal
Vignette du fichier
main.pdf (304.85 Ko) Télécharger le fichier
Origine : Fichiers éditeurs autorisés sur une archive ouverte
Loading...

Dates et versions

hal-01503064 , version 1 (06-04-2017)

Identifiants

  • HAL Id : hal-01503064 , version 1

Citer

Pascal Cuoq, Raphaël Rieu-Helft. Result graphs for an abstract interpretation-based static analyzer. 28èmes Journées Francophones des Langages Applicatifs, Jan 2017, Gourette, France. ⟨hal-01503064⟩
244 Consultations
110 Téléchargements

Partager

Gmail Facebook X LinkedIn More