Template-Based Verification of Heap-Manipulating Programs

conference paper

English

We propose a  shape analysis suitable for analysis engines that perform automatic invariant inference using an SMT solver. The proposed solution includes an abstract template domain that encodes the shape of the program heap based on logical formulae over bit-vectors. It is based on computing a  points-to relation between pointers and symbolic addresses of abstract memory objects. Our abstract heap domain can be combined with value domains in a straightforward manner, which particularly allows us to reason about shapes and contents of heap structures at the same time. The information obtained from the analysis can be used to prove memory safety and reachability properties, expressed by user assertions, of programs manipulating dynamic data structures, mainly linked lists. The solution has been implemented in the 2LS framework and compared against state-of-the-art tools that perform the best in heap-related categories of the well-known Software Verification Competition (SV-COMP). Results show that 2LS outperforms these tools on benchmarks requiring combined reasoning about unbounded data structures and their numerical contents.

software analysis, software verification, shape analysis, template based verification, 2LS, love, domain combination

HRUŠKA, M.; MALÍK, V.; SCHRAMMEL, P.; VOJNAR, T.

30. 10. 2018

FMCAD Inc.

Austin

978-0-9835678-8-2

Proceedings of the 18th Conference on Formal Methods in Computer-Aided Design

103

111

9

https://www.cs.utexas.edu/users/hunt/FMCAD/FMCAD18/fmcad2018_proceedings.pdf

MHSV18.pdf