Modular Static Analysis of String Manipulations in C Programs

Abstract

We present a modular analysis able to tackle out-of-bounds accesses in C strings. This analyzer is modular in the sense that it infers and tabulates (for reuse) input/output relations, automatically partitioned according to the shape of the input state. We show how the inter-procedural iterator discovers and generalizes contracts in order to improve their reusability for further analysis. This analyzer was implemented and was able to successfully analyze and infer relational contracts for functions such as strcpy, strcat.

This work is supported by the European Research Council under Consolidator Grant Agreement 681393 – MOPSA.

Appendices

A Tool functions

1.1 A.1 Definition of the Galois Connection

In the following denotes .

Using functions to_cells and from_cells, and under the hypothesis that $\mathfrak V = \{s_0,\dots , s_{n-1}\}$, we can define the Galois connection between the Cell abstract domain and the String abstract domain:

$$\begin{aligned} \gamma _{S^{\sharp }_m,D^{\sharp }_m}(S^{\sharp })&= \mathbf {to\_cell}(s_0,\dots , (\mathbf {to\_cell}(s_{n-1},S^{\sharp })) \dots )\\ \alpha _{S^{\sharp }_m,D^{\sharp }_m}(S^{\sharp })&= \mathbf {from\_cell}(s_0,\dots ,( \mathbf {from\_cell}(s_{n-1}, S^{\sharp }))\dots ) \end{aligned}$$

1.2 A.2 Definition of the Evaluation of a Dereferencing

$$\begin{aligned} {\mathbf {before}}&(e,s,S^{\sharp })=\\&\{([1;255], \langle C,R^{\sharp } \sqcap \{0 \le e, e< s_l, e< s_a \}, P\rangle \}\\ \mathbf {at}&(e,s,S^{\sharp })=\\&\{(0, \langle C,R^{\sharp } \sqcap \{0 \le e, e = s_l, e< s_a \}, P \rangle \}\\ \mathbf {after}&(e,s,S^{\sharp })=\\&\{([0;255], \langle C,R^{\sharp } \sqcap \{0 \le e, e > s_l, e< s_a \}, P \rangle \}\\ \mathbf {eerror}&(e,s,S^{\sharp })=\\&\mathbf {let\ } R^{\sharp }_1 = R^{\sharp } \sqcap \{e \ge s_a \} \sqcup R^{\sharp } \sqcap \{e < 0 \} \mathbf {\ in\ }\\&{\textit{ test for } \mathbf{out\_of\_bounds } (R_1^{\sharp }\sqsubseteq _{S^{\sharp }_m} \bot )?}\\&\emptyset \end{aligned}$$

1.3 A.3 Definition of the Abstract Postcondition of an Assignment

$$\begin{aligned} \mathbf {set0}&(s,e_1,e_2,\langle C, R^{\sharp }, P\rangle ) =\\&\mathbf {let\ }R^{\sharp }_1 = R^{\sharp } \sqcap \{e_1 \ge 0, e_1 \le s_l, e_1< s_a, e_2 = 0\} \mathbf {\ in}\\&\mathbf {let\ }R^{\sharp }_2 = \mathbb S^{\sharp } \llbracket s_l \leftarrow e_1 \rrbracket (R^{\sharp }_1) \mathbf {\ in}\\&\langle C, R^{\sharp }_2, P \rangle \\ \mathbf {setnon0}&(s,e_1,e_2,\langle C, R^{\sharp }, P\rangle ) =\\&\mathbf {let\ }R^{\sharp }_1 = R^{\sharp } \sqcap \{e_1 \ge 0, e_1 = s_l , e_1< s_a, e_2 \ne 0\} \mathbf {\ in}\\&\mathbf {let\ }R^{\sharp }_2 = \mathbb S^{\sharp } \llbracket s_l \leftarrow [e_1+1; s_a] \rrbracket (R^{\sharp }_1) \mathbf {\ in}\\&\langle C, R^{\sharp }_2, P \rangle \\ \mathbf {unchanged}&(s,e_1,e_2,\langle C, R^{\sharp }, P\rangle ) =\\&\mathbf {let\ }R^{\sharp }_1 = (R^{\sharp } \sqcap \{e_1 \ge 0, e_1< s_l , e_1< s_a, e_2 \ne 0\}) \\&\quad \quad \quad \sqcup (R^{\sharp } \sqcap \{e_1 \ge 0, e_1> s_l , e_1< s_a\}) \mathbf {\ in}\\&\langle C, R^{\sharp }_1, P \rangle \\ \mathbf {l\_unchanged}&(s,e_1,r,\langle C, R^{\sharp }, P\rangle ) =\\&\mathbf {let\ }R^{\sharp }_1 = (R^{\sharp } \sqcap \{e_1 \ge 0, e_1 > s_l , e_1 + r \le s_a\}) \mathbf {\ in}\\&\langle C, R^{\sharp }_1, P \rangle \\ \mathbf {forget}&(s,e_1,r,\langle C, R^{\sharp }, P \rangle ) =\\&\mathbf {let\ }R^{\sharp }_1 = R^{\sharp } \sqcap \{e_1 \ge 0, e_1 \le s_l, e_1 + r \le s_a\} \mathbf {\ in}\\&\mathbf {let\ }R^{\sharp }_2 = \mathbb S^{\sharp } \llbracket s_l\leftarrow [e_1; s_a] \rrbracket (R^{\sharp }_1) \mathbf {in}\\&\langle C, R^{\sharp }_2, P \rangle \\ \mathbf {serror}&(s,e_1,r,\langle C, R^{\sharp }, P \rangle ) =\\&\mathbf {let\ }R^{\sharp }_1 = R^{\sharp } \sqcap \{e_1 \ge s_a\} \mathbf {\ in}\\&\mathbf {let\ }R^{\sharp }_2 = R^{\sharp } \sqcap \{e_1 < 0\} \mathbf {\ in }\\&{ \textit{ test for } \mathbf{ out\_of\_bounds } ((R_2^{\sharp } \sqcup _{S_m^{\sharp }}R_1^{\sharp }) \sqsubseteq _{S^{\sharp }_m} \bot ) ?}\\&\bot \end{aligned}$$

1.4 A.4 String Declaration

B  C Programs