FLOC 2018: FEDERATED LOGIC CONFERENCE 2018
Checking Array Bounds by Abstract Interpretation and Symbolic Expressions

Authors: Etienne Payet and Fausto Spoto

Paper Information

Title:Checking Array Bounds by Abstract Interpretation and Symbolic Expressions
Authors:Etienne Payet and Fausto Spoto
Proceedings:IJCAR Proceedings 9th IJCAR, 2018
Editors: Stephan Schulz, Didier Galmiche and Roberto Sebastiani
Keywords:Abstract Interpretation, Static Analysis, Software Verification, Linear Constraints, Arrays
Abstract:

ABSTRACT. Array access out of bounds is a typical programming error. From the '70s, static analysis has been used to identify where such error actually occurs at runtime, through abstract interpretation into linear constraints. However, feasibility and scalability to modern object-oriented code has not been established yet. This article builds on previous work on linear constraints and shows that the result does not scale, when polyhedra implement the linear constraints, while the more abstract zones scale to the analysis of medium-size applications. Moreover, this article formalises the inclusion of symbolic expressions in the constraints and shows that this improves its precision. Expressions are automatically selected on-demand. The resulting analysis applies to code with dynamic memory allocation and arrays held in expressions. It is sound, also in the presence of arbitrary side-effects. It is fully defined in the abstract interpretation framework and does not use any code instrumentation. Its proof of correctness, its implementation inside the commercial Julia analyzer and experiments on third-party code complete the work.

Pages:16
Talk:Jul 15 16:00 (Session 107E: Verification)
Paper: