Abstract
An important concern addressed by runtime verification tools for C code is related to detecting memory errors. It requires to monitor some properties of memory locations (e.g., their validity and initialization) along the whole program execution. Static analysis based optimizations have been shown to significantly improve the performances of such tools by reducing the monitoring of irrelevant locations. However, soundness of the verdict of the whole tool strongly depends on the soundness of the underlying static analysis technique. This paper tackles this issue for the dataflow analysis used to optimize the E-ACSL runtime assertion checking tool.We formally define the core dataflow analysis used by E-ACSL and prove its soundness.
- Todd M. Austin, Scott E. Breach, and Gurindar S. Sohi. Efficient detection of all pointer and array access errors. In Programming Languages Design and Implementation (PLDI). ACM, 1994.Google Scholar
- Yves Bertot, Benjamin Grégoire, and Xavier Leroy. A structured approach to proving compiler optimizations based on dataflow analysis. In Types for Proofs and Programs (TYPES). Springer, 2006.Google Scholar
- Sandrine Blazy and Xavier Leroy. Mechanized semantics for the Clight subset of the C language. Journal of Automated Reasoning, 43, 2009.Google Scholar
- David Cachera, Thomas P. Jensen, David Pichardie, and Vlad Rusu. Extracting a data flow analyser in constructive logic. Theoretical Computer Science, 342, 2005.Google Scholar
- Steve Christey. 2011 CWE/SANS top 25 most dangerous software errors. Technical Report 1.0.3, The MITRE Corporation, http://www.mitre.org, 2011.Google Scholar
- Lori A. Clarke and David S. Rosenblum. A historical perspective on runtime assertion checking in software development. Software Engineering Notes, 31, 2006.Google Scholar
- Loïc Correnson and Julien Signoles. Combining analyses for C program verification. In Formal Methods for Industrial Case Studies (FMICS). Springer, 2012.Google Scholar
- M. Delahaye, N. Kosmatov, and J. Signoles. Common specification language for static and dynamic analysis of C programs. In Applied Computing (SAC). ACM, 2013.Google Scholar
- Martin Hofmann, Aleksandr Karbyshev, and Helmut Seidl. Verifying a local generic solver in Coq. In Static Analysis (SAS). Springer, 2010.Google Scholar
Cross Ref
- Programming languages -- C. ISO/IEC 9899:1999, 1999.Google Scholar
- Arvid Jakobsson, Nikolai Kosmatov, and Julien Signoles. Fast as a shadow, expressive as a tree: optimized memory monitoring for C. Science of Computer Programming, 132, 2016.Google Scholar
- Jacques-Henri Jourdan, Vincent Laporte, Sandrine Blazy, Xavier Leroy, and David Pichardie. A formally-verified C static analyzer. In Principles of Programming Languages (POPL). ACM, 2015.Google Scholar
- Gary A. Kildall. A unified approach to global program optimization. In Principles of Programming Languages (POPL). ACM, 1973.Google Scholar
- F. Kirchner, N. Kosmatov, V. Prevosto, J. Signoles, and B. Yakobowski. Frama-C: A software analysis perspective. Formal Aspects of Computing, 27, 2015.Google Scholar
- N. Kosmatov, G. Petiot, and J. Signoles. An optimized memory monitoring for runtime assertion checking of C programs. In Runtime Verification (RV). Springer, 2013.Google Scholar
- Xavier Leroy, Andrew W. Appel, Sandrine Blazy, and Gordon Stewart. The CompCert memory model. In Andrew W. Appel, editor, Program Logics for Certified Compilers. Cambridge University Press, 2014.Google Scholar
- Michael Mehlich. CheckPointer - a C memory access validator. In Source Code Analysis and Manipulation (SCAM). IEEE, 2011.Google Scholar
- G. C. Necula, J. Condit, M. Harren, S. McPeak, andW.Weimer. CCured: Type-safe retrofitting of legacy software. Programming Languages and Systems (TOPLAS), 27, 2005.Google Scholar
- Flemming Nielson, Hanne R. Nielson, and Chris Hankin. Principles of Program Analysis. Springer-Verlag New York, 1999.Google Scholar
Digital Library
- Yutaka Oiwa. Implementation of the memory-safe full ANSI-C compiler. In Programming Language Design and Implementation (PLDI). ACM, 2009.Google Scholar
- Guillaume Petiot, Nikolai Kosmatov, Bernard Botella, Alain Giorgetti, and Jacques Julliand. Your proof fails? Testing helps to find the reason. In Tests and Proofs (TAP). Springer, 2016.Google Scholar
- K. Serebryany, D. Bruening, A. Potapenko, and D. Vyukov. AddressSanitizer: a fast address sanity checker. In USENIX Annual Technical Conference (USENIX). USENIX Association, 2012.Google Scholar
- Julien Signoles, Nikolai Kosmatov, and Kostyantyn Vorobyov. E-ACSL, a runtime verification tool for safety and security of C programs. tool paper. In Competitions, Usability, Benchmarks, Evaluation, and Standardisation for Runtime Verification Tools (RV-CuBES). EasyChair, 2017.Google Scholar
- Matthew S. Simpson and Rajeev Barua. MemSafe: ensuring the spatial and temporal memory safety of C at runtime. Software: Practice and Experience, 43, 2013.Google Scholar
- Dokyung Song, Julian Lettner, Prabhu Rajasekaran, Yeoul Na, Stijn Volckaert, Per Larsen, and Michael Franz. SoK: sanitizing for security. In Security and Privacy (S&P). IEEE, 2019. to appear.Google Scholar
- Mark Sullivan and Ram Chillarege. Software defects and their impact on system availability: a study of field failures in operating systems. In Fault Tolerant Computing (FTCS). IEEE, 1991.Google Scholar
- Victor van der Veen, Nitish dutt Sharma, Lorenzo Cavallaro, and Herbert Bos. Memory errors: the past, the present, and the future. In Research in Attacks, Intrusions, and Defenses (RAID). Springer, 2012.Google Scholar
- Kostyantyn Vorobyov, Julien Signoles, and Nikolai Kosmatov. Shadow state encoding for efficient monitoring of block-level properties. In Memory Management (ISMM). ACM, 2017.Google Scholar
- Kostyantyn Vorobyov, Nikolai Kosmatov, and Julien Signoles. Detection of security vulnerabilities in C code using runtime verification: an experience report. In Tests and Proofs (TAP). Springer, 2018.Google Scholar
- Jun Yuan and Rob Johnson. CAWDOR: compiler assisted worm defense. In Source Code Analysis and Manipulation (SCAM). IEEE, 2012.Google Scholar
Index Terms
(auto-classified)Soundness of a Dataflow Analysis for Memory Monitoring
Recommendations
Speeding Up Dataflow Analysis Using Flow-Insensitive Pointer Analysis
SAS '02: Proceedings of the 9th International Symposium on Static AnalysisIn recent years, static analysis has increasingly been applied to the problem of program verification. Systems for program verification typically use precise and expensive interprocedural dataflow algorithms that are difficult to scale to large ...
Proxy-Monitor: An Integration of Runtime Verification with Passive Conformance Testing
This paper proposes a conformance testing method combining two well-known testing approaches, runtime verification and passive testing. Runtime verification addresses the monitoring of a system under test to check whether formal properties hold, while ...
MTJ variation monitor-assisted adaptive MRAM write
DAC '16: Proceedings of the 53rd Annual Design Automation ConferenceSpin-transfer torque random access memory (STT-RAM) and magnetoelectric random access memory (MeRAM) are promising non-volatile memory technologies. But STT-RAM and Me RAM both suffer from high write error rate due to thermal fluctuation of ...






Comments