Cascade 2.0. C static analysis tool with an SMT backend. Wei Wang, Clark Barrett, Thomas Wies

Size: px

Start display at page:

Download "Cascade 2.0. C static analysis tool with an SMT backend. Wei Wang, Clark Barrett, Thomas Wies"

Lillian Bradford
6 years ago
Views:

1 Cascade 2.0 C static analysis tool with an SMT backend Wei Wang, Clark Barrett, Thomas Wies

2 htt://cascade.cims.nyu.edu Overview Memory models Flat memory model Burstall memory model Partition memory model Exerimental results Related works Conclusion 2

3 htt://cascade.cims.nyu.edu Cascade is designed to find bugs, esecially memory-related ones, in lowlevel C rograms Proerties checked: Built-in roerties: Invalid memory access: memory access at invalid addresses Invalid memory allocation: if the reuested size of malloc exceeds the size of memory Invalid memory free: free memory via a ointer not returned from malloc User secified roerties 3

4 htt://cascade.cims.nyu.edu Control File C code AST Verification Target Symbolic Executor Verification Reort Abstract Memory Model Abstract Theorem Prover CVC4 Z3 4

5 htt://cascade.cims.nyu.edu Control File C code AST Verification Target Symbolic Executor Verification Reort Abstract Memory Model Abstract Theorem Prover CVC4 Z3 5

6 htt://cascade.cims.nyu.edu Control File C code AST Verification Target Symbolic Executor Verification Reort Abstract Memory Model Abstract Theorem Prover Flat Model Partition Model CVC4 Z3 Burstall Model 6

7 htt://cascade.cims.nyu.edu Overview Memory models Flat memory model Burstall memory model Partition memory model Exerimental results Related works Conclusion 7

8 htt://cascade.cims.nyu.edu Flat memory model The entire memory is treated as a single flat array Naturally suorts C features, including tye-unsafe oerations ointer arithmetic ointer casts union tyes Limitation: scalability 8

9 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void bar() { int * = (int *)malloc(sizeof(int)); assume(!= NULL); long * = (long *)malloc(sizeof(long)); assume(!= NULL); * = 2; * = 4; assert(* == 2); // invalid } & & memory 9

10 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void bar() { int * = (int *)malloc(sizeof(int)); assume(!= NULL); long * = (long *)malloc(sizeof(long)); assume(!= NULL); * = 2; * = 4; assert(* == 2); } & & memory 10

11 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void bar() { int * = (int *)malloc(sizeof(int)); assume(!= NULL); long * = (long *)malloc(sizeof(long)); assume(!= NULL); * = 2; * = 4; assert(* == 2); } & & size sizeof(int*) sizeof(long*) sizeof(int) sizeof(long) disjoint(a, b) := a + n size[a] b b + n size[b] a non-overflow(a) := a a + n size[a] & & memory 11

12 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void bar() { int * = (int *)malloc(sizeof(int)); assume(!= NULL); long * = (long *)malloc(sizeof(long)); assume(!= NULL); * = 2; * = 4; assert(* == 2); } & & size sizeof(int*) sizeof(long*) sizeof(int) sizeof(long) disjoint(a, b) := a + n size[a] b b + n size[b] a non-overflow(a) := a a + n size[a] disjoint(&, ) disjoint(&, &) disjoint(&, ) disjoint(, &) disjoint(, ) disjoint(&, ) non-overflow(&) non-overflow() non-overflow(&) non-overflow() & & memory 12

13 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void bar() { int * = (int *)malloc(sizeof(int)); assume(!= NULL); long * = (long *)malloc(sizeof(long)); assume(!= NULL); * = 2; * = 4; assert(* == 2); } & & size sizeof(int*) sizeof(long*) sizeof(int) sizeof(long) disjoint(a, b) := a + n size[a] b b + n size[b] a non-overflow(a) := a a + n size[a] disjoint(&, ) disjoint(&, &) disjoint(&, ) disjoint(, &) disjoint(, ) disjoint(&, ) non-overflow(&) non-overflow() non-overflow(&) non-overflow() & & memory 13

14 htt://cascade.cims.nyu.edu Flat memory model The entire memory is treated as a single flat array Naturally suorts C features, including tye-unsafe oerations ointer arithmetic ointer casts union tyes Limitation: scalability Unordered mode #clauses = O(n 2 ), n is the number of memory blocks 14

15 htt://cascade.cims.nyu.edu Flat memory model The entire memory is treated as a single flat array Naturally suorts C features, including tye-unsafe oerations ointer arithmetic ointer casts union tyes Limitation: scalability Unordered mode #clauses = O(n 2 ), n is the number of memory blocks Ordered mode 15

16 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void bar() { int * = (int *)malloc(sizeof(int)); assume(!= NULL); long * = (long *)malloc(sizeof(long)); assume(!= NULL); * = 2; * = 4; assert(* == 2); } & & size sizeof(int*) sizeof(long*) sizeof(int) sizeof(long) & & memory 16

17 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void bar() { int * = (int *)malloc(sizeof(int)); assume(!= NULL); long * = (long *)malloc(sizeof(long)); assume(!= NULL); * = 2; * = 4; assert(* == 2); } & & size sizeof(int*) sizeof(long*) sizeof(int) sizeof(long) & & Bottom To Stack à memory ß Hea 17

18 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void bar() { int * = (int *)malloc(sizeof(int)); assume(!= NULL); long * = (long *)malloc(sizeof(long)); assume(!= NULL); * = 2; * = 4; assert(* == 2); } & & size sizeof(int*) sizeof(long*) sizeof(int) sizeof(long) below(a, b) := a + n size[a] b non-overflow(a) := a a + n size[a] below(&, &) below(&, ) below(, ) non-overflow() & & Bottom To Stack à memory ß Hea 18

19 htt://cascade.cims.nyu.edu Flat memory model The entire memory is treated as a single flat array Naturally suorts C features, including tye-unsafe oerations ointer arithmetic ointer casts union tyes Limitation: scalability Unordered mode #clauses = O(n 2 ), n is the number of memory blocks Ordered mode #clauses = O(n), n is the number of memory blocks 19

20 htt://cascade.cims.nyu.edu Flat memory model The entire memory is treated as a single flat array Naturally suorts C features, including tye-unsafe oerations ointer arithmetic ointer casts union tyes Limitation: scalability Unordered mode #clauses = O(n 2 ), n is the number of memory blocks Ordered mode #clauses = O(n), n is the number of memory blocks Unsound! 20

21 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void baz() { int * = (int *)malloc(sizeof(int)); assume(!= NULL); long * = (long *)malloc(sizeof(long)); assume(!= NULL); assert( > ); // valid } & & size sizeof(int*) sizeof(long*) sizeof(int) sizeof(long) & & Bottom To Stack à memory ß Hea 21

22 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void baz() { int * = (int *)malloc(sizeof(int)); assume(!= NULL); long * = (long *)malloc(sizeof(long)); assume(!= NULL); assert( > ); // valid ERROR! } & & size sizeof(int*) sizeof(long*) sizeof(int) sizeof(long) & & Bottom To Stack à memory ß Hea 22

23 htt://cascade.cims.nyu.edu Ordered mode vs. Unordered mode 23 NECLA static analysis benchmarks

24 htt://cascade.cims.nyu.edu Overview Memory models Flat memory model Burstall memory model Partition memory model Exerimental results Related Work Conclusion 24

25 htt://cascade.cims.nyu.edu Burstall memory model The memory is slit into disjoint arrays according to tyes Field-sensitive: each struct field is also a uniue tye Assumtions: Objects with distinct tyes won t overla Different fields within a structure won t overla More scalable Only reason about disjointness among objects with the same tye 25

26 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void bar() { int * = (int *)malloc(sizeof(int)); assume(!= NULL); long * = (long *)malloc(sizeof(long)); assume(!= NULL); * = 2; * = 4; assert(* == 2); } memory int long int * long * 26

27 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void bar() { int * = (int *)malloc(sizeof(int)); assume(!= NULL); long * = (long *)malloc(sizeof(long)); assume(!= NULL); * = 2; * = 4; assert(* == 2); } int memory long int * & long * & 27

28 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void bar() { int * = (int *)malloc(sizeof(int)); assume(!= NULL); long * = (long *)malloc(sizeof(long)); assume(!= NULL); * = 2; * = 4; assert(* == 2); } int memory non-overflow() non-overflow() non-overflow(&) non-overflow(&) long int * & long * & 28

29 htt://cascade.cims.nyu.edu Burstall memory model The memory is slit into disjoint arrays according to tyes Assumtions: Objects with distinct tyes won t overla Different fields within a structure won t overla More scalable Only reason about disjointness among objects with the same tye Limitation: doesn t suort tye-unsafe oerations 29

30 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void ux(long *, int *) { assume(!= NULL!= NULL); è * = 4; = (int *); // ointer cast * = 2; assert(*!= 4); } memory int long 4 int * & long * & 30

31 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void ux(long *, int *) { assume(!= NULL!= NULL); * = 4; è = (int *); // ointer cast * = 2; assert(*!= 4); } memory int long 4 int * & long * & 31

32 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void ux(long *, int *) { assume(!= NULL!= NULL); * = 4; = (int *); // ointer cast è * = 2; assert(*!= 4); } int long 2 4 memory int * & long * & 32

33 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void ux(long *, int *) { assume(!= NULL!= NULL); * = 4; = (int *); // ointer cast * = 2; è assert(*!= 4); // invalid ERROR! } int long 2 4 memory int * & long * & 33

34 htt://cascade.cims.nyu.edu Flat Burstall CBMC LLBMC ESBMC LAV KLEE VCC 1.0 Havoc Corral Caduceus 34

35 htt://cascade.cims.nyu.edu Cascade Memory Models Flat memory model Burstall memory model Partition memory model Exerimental results Related works Conclusion 35

36 htt://cascade.cims.nyu.edu Motivation: a new memory model that easily scales u suorts tye-unsafe C oerations 36

37 htt://cascade.cims.nyu.edu Motivation: a new memory model that easily scales u slit suorts tye-unsafe C oerations 37

38 htt://cascade.cims.nyu.edu Motivation: a new memory model that easily scales u slit suorts tye-unsafe C oerations a new way to slit 38

39 htt://cascade.cims.nyu.edu Motivation: a new memory model that easily scales u slit suorts tye-unsafe C oerations a new way to slit Aroach: Slits the memory according to the alias information Each maximal set of locations that may alias is groued into one array Uses ointer analysis to comute the alias information 39

40 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void ux(long *, int *) { assume(!= NULL!= NULL); * = 4; = (int *); // ointer alias * = 2; assert(*!= 4); } & & 40

41 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void ux(long *, int *) { è assume(!= NULL!= NULL); * = 4; = (int *); // ointer alias * = 2; assert(*!= 4); } memory & & & (, ) & 41

42 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void ux(long *, int *) { assume(!= NULL!= NULL); è * = 4; = (int *); // ointer alias * = 2; assert(*!= 4); } memory & & & (, ) 4 & 42

43 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void ux(long *, int *) { assume(!= NULL!= NULL); * = 4; è = (int *); // ointer alias * = 2; assert(*!= 4); } memory & & & & (, ) 4 43

44 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void ux(long *, int *) { assume(!= NULL!= NULL); * = 4; = (int *); // ointer alias è * = 2; assert(*!= 4); } memory & & & & (, ) 2 44

45 htt://cascade.cims.nyu.edu #define NULL (void *) 0 void ux(long *, int *) { assume(!= NULL!= NULL); * = 4; = (int *); // ointer alias * = 2; è assert(*!= 4); // valid } memory & & & & (, ) 2 45

46 htt://cascade.cims.nyu.edu Partition memory model Pre-rocessing Emloys Steensgaards unification-based ointer analysis Finds all the alias grous of ointers The memory is slit into multile arrays according to alias grous #arrays is bounded by #variables in the source code Scoe-sensitive otimization often destroys the arrays that contain variables no longer valid in current scoe Alies to both unordered and ordered modes 46

47 htt://cascade.cims.nyu.edu Overview Memory models Flat memory model Burstall memory model Partition memory model Exerimental results Related works Conclusion 47

48 htt://cascade.cims.nyu.edu Partition model vs. Flat model (unordered) 48 NECLA static analysis benchmarks

49 htt://cascade.cims.nyu.edu Partition model vs. Flat model (ordered) 49 NECLA static analysis benchmarks

50 htt://cascade.cims.nyu.edu Partition model vs. Burstall model 50 NECLA static analysis benchmarks

51 htt://cascade.cims.nyu.edu Overview Memory models Flat memory model Burstall memory model Partition memory model Exerimental results Related works Conclusion 51

52 htt://cascade.cims.nyu.edu SMACK [Rakamarić and Hu, 09] Tye unification strategy Uses Burstall model as initial memory model For tye-unsafe oerations, unifies the tyes involved Frama-C [P. Cuo, et al. 12] Suorts multile memory models: Hoare, store(burstall), and runtime(flat) Otimization: mixed model of Hoare (non-ointers) and Flat (ointers) VCC [Cohen, et al. 09] A tyed memory model for C Maintains a set of valid ointers that oint to disjoint regions Switch between Flat and Burstall models, for tye-unsafe oerations 52

53 htt://cascade.cims.nyu.edu Overview Memory models Flat memory model Burstall memory model Partition memory model Exerimental results Related works Conclusion 53

54 htt://cascade.cims.nyu.edu Cascade 2.0 Suorts multile memory models to balance the tradeoff between efficiency and recision Flat model (unordered and ordered modes) Burstall model Partition model (default) Future work To use more recise ointer analysis algorithms to get more fine-grained artition To suort rocedure contracts that enable local reasoning 54

Partitioned Memory Models for Program Analysis

Partitioned Memory Models for Program Analysis Wei Wang 1 Clark Barrett 2 Thomas Wies 3 1 Google 2 Stanford University 3 New York University January 13, 2017 Wei Wang Partitioned Memory Models January