Skip to main content
SpringerLink
Log in

Sound Bit-Precise Numerical Domains

  • Conference paper
  • First Online:
Verification, Model Checking, and Abstract Interpretation (VMCAI 2017)

Part of the book series: Lecture Notes in Computer Science ((LNTCS,volume 10145))

Abstract

This paper tackles the challenge of creating a numerical abstract domain that can identify affine-inequality invariants while handling overflow in arithmetic operations over bit-vector data-types. The paper describes the design and implementation of a class of new abstract domains, called the Bit-Vector-Sound, Finite-Disjunctive (\(\textit{BVSFD}\)) domains. We introduce a framework that takes an abstract domain \(\mathcal {A}\) that is sound with respect to mathematical integers and creates an abstract domain \(\textit{BVS}(\mathcal {A})\) whose operations and abstract transformers are sound with respect to machine integers. We also describe how to create abstract transformers for \(\textit{BVS}(\mathcal {A})\) that are sound with respect to machine arithmetic. The abstract transformers make use of an operation \(\textit{WRAP}(\textit{av}, v)\)—where \(\textit{av} \in \mathcal {A}\) and v is a set of program variables—which performs wraparound in av for the variables in v.

To reduce the loss of precision from \(\textit{WRAP}\), we use finite disjunctions of \(\textit{BVS}(\mathcal {A})\) values. The constructor of finite-disjunctive domains, \(\textit{FD}_k(\cdot )\), is parameterized by k, the maximum number of disjunctions allowed.

We instantiate the \(\textit{BVS}(\textit{FD}_k)\) framework using the abstract domain of polyhedra and octagons. Our experiments show that the analysis can prove \(25\%\) of the assertions in the SVCOMP loop benchmarks with \(k=6\), and \(88\%\) of the array-bounds checks in the SVCOMP array benchmarks with \(k=4\).

Supported, in part, by a gift from Rajiv and Ritu Batra; by DARPA under cooperative agreement HR0011-12-2-0012; by NSF under grant CCF-0904371; DARPA MUSE award FA8750-14-2-0270 and DARPA STAC award FA8750-15-C-0082; and by the UW-Madison Office of the Vice Chancellor for Research and Graduate Education with funding from the Wisconsin Alumni Research Foundation. Any opinions, findings, and conclusions or recommendations expressed in this publication are those of the authors, and do not necessarily reflect the views of the sponsoring agencies.

T. Reps has an ownership interest in GrammaTech, Inc., which has licensed elements of the technology discussed in this publication.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Bagnara, R., Hill, P., Zaffanella, E.: Widening operators for powerset domains. STTT 8(4/5), 449–466 (2006)

    Article  MATH  Google Scholar 

  2. Bagnara, R., Hill, P.M., Zaffanella, E.: The parma polyhedra library: toward a complete set of numerical abstractions for the analysis and verification of hardware and software systems. Sci. Comput. Program. 72(1–2), 3–21 (2008)

    Article  MathSciNet  Google Scholar 

  3. Balakrishnan, G., Reps, T.: WYSINWYX: what you see is not what you execute. TOPLAS 32(6), 202–213 (2010)

    Article  Google Scholar 

  4. Beyer, D.: Software verification and verifiable witnesses. In: Baier, C., Tinelli, C. (eds.) TACAS 2015. LNCS, vol. 9035, pp. 401–416. Springer, Heidelberg (2015). doi:10.1007/978-3-662-46681-0_31

    Google Scholar 

  5. Bloch, J.: Extra, extra - read all about it: nearly all binary searches and mergesorts are broken. googleresearch.blogspot.com/2006/06/extra-extra-read-all- about-it-nearly.html

  6. Brauer, J., King, A.: Automatic abstraction for intervals using boolean formulae. In: Cousot, R., Martel, M. (eds.) SAS 2010. LNCS, vol. 6337, pp. 167–183. Springer, Heidelberg (2010). doi:10.1007/978-3-642-15769-1_11

    Chapter  Google Scholar 

  7. Brauer, J., King, A.: Transfer function synthesis without quantifier elimination. LMCS 8(3), 63 (2012)

    MathSciNet  MATH  Google Scholar 

  8. Bygde, S., Lisper, B., Holsti, N.: Fully bounded polyhedral analysis of integers with wrapping. In: International Workshop on Numerical and Symbolic Abstract Domains (2011)

    Google Scholar 

  9. Cousot, P., Cousot, R.: Static determination of dynamic properties of programs. In: Proceedings of 2nd International Symposium on Programming, Paris, April 1976

    Google Scholar 

  10. Cousot, P., Halbwachs, N.: Automatic discovery of linear constraints among variables of a program. In: POPL (1978)

    Google Scholar 

  11. Dietz, W., Li, P., Regehr, J., Adve, V.: Understanding integer overflow in C/C++. In: ICSE (2012)

    Google Scholar 

  12. dSPACE TargetLink. www.dspace.com/en/pub/home/products/sw/pcgs/targetli.cfm

  13. Elder, M., Lim, J., Sharma, T., Andersen, T., Reps, T.: Abstract domains of affine relations. TOPLAS 36(4), 1–13 (2014)

    Article  Google Scholar 

  14. Garner, H.L.: Theory of computer addition and overflow. IEEE Trans. Comput. 27(4), 297–301 (1978)

    Article  MathSciNet  MATH  Google Scholar 

  15. Ghorbal, K., Ivančić, F., Balakrishnan, G., Maeda, N., Gupta, A.: Donut domains: efficient non-convex domains for abstract interpretation. In: VMCAI (2012)

    Google Scholar 

  16. Jones, N., Mycroft, A.: Data flow analysis of applicative programs using minimal function graphs. In: POPL, pp. 296–306 (1986)

    Google Scholar 

  17. Jourdan, J.-H., Laporte, V., Blazy, S., Leroy, X., Pichardie, D.: A formally-verified C static analyzer. In: POPL (2015)

    Google Scholar 

  18. Kidd, N., Lal, A., Reps, T.: WALi: the weighted automaton library (2007). www.cs.wisc.edu/wpis/wpds/download.php

  19. Lal, A., Reps, T., Balakrishnan, G.: Extended weighted pushdown systems. In: Etessami, K., Rajamani, S.K. (eds.) CAV 2005. LNCS, vol. 3576, pp. 434–448. Springer, Heidelberg (2005). doi:10.1007/11513988_44

    Chapter  Google Scholar 

  20. Lattner, C., Adve, V.: LLVM: a compilation framework for lifelong program analysis & transformation. In: International Symposium on Code Generation and Optimization (2004)

    Google Scholar 

  21. Laviron, V., Logozzo, F.: Subpolyhedra: a (more) scalable approach to infer linear inequalities. In: VMCAI (2009)

    Google Scholar 

  22. Lim, J.: Transformer specification language: a system for generating analyzers and its applications. Ph.D. thesis, Computer Science Department, University of Wisconsin, Madison, WI, Technical report 1689, May 2011

    Google Scholar 

  23. LLVM: Low level virtual machine. llvm.org

  24. Malmkjær, K.: Abstract interpretation of partial-evaluation algorithms. Ph.D. thesis, Department of Computer and Information Science, Kansas State University, Manhattan, Kansas (1993)

    Google Scholar 

  25. Miné, A.: The octagon abstract domain. Higher-Order Symbolic Comput. 19(1), 31–100 (1006)

    Article  MathSciNet  MATH  Google Scholar 

  26. Miné, A.: The octagon abstract domain. In: WCRE (2001)

    Google Scholar 

  27. Miné, A.: A few graph-based relational numerical abstract domains. In: Hermenegildo, M.V., Puebla, G. (eds.) SAS 2002. LNCS, vol. 2477, pp. 117–132. Springer, Heidelberg (2002). doi:10.1007/3-540-45789-5_11

    Chapter  Google Scholar 

  28. Miné, A.: Abstract domains for bit-level machine integer and floating-point operations. In: IJCAR, pp. 55–70 (2012)

    Google Scholar 

  29. Monniaux, D.: Automatic modular abstractions for template numerical constraints. LMCS 6(3), 4 (2010)

    MathSciNet  MATH  Google Scholar 

  30. Müller-Olm, M., Seidl, H.: Analysis of modular arithmetic. TOPLAS 29(5), 29:1–29:27 (2007)

    Article  MATH  Google Scholar 

  31. Mycroft, A., Jones, N.: A relational framework for abstract interpretation. In: Programs as Data Objects (1985)

    Google Scholar 

  32. Nielson, F.: Two-level semantics and abstract interpretation. Theor. Comp. Sci. 69, 117–242 (1989)

    Article  MathSciNet  MATH  Google Scholar 

  33. PPL: The Parma polyhedra library. www.cs.unipr.it/ppl/

  34. Reps, T., Balakrishnan, G., Lim, J.: Intermediate-representation recovery from low-level code. In: PEPM (2006)

    Google Scholar 

  35. Reps, T., Schwoon, S., Jha, S., Melski, D.: Weighted pushdown systems and their application to interprocedural dataflow analysis. SCP 58(1–2), 206–263 (2005)

    MathSciNet  MATH  Google Scholar 

  36. Sankaranarayanan, S., Ivančić, F., Shlyakhter, I., Gupta, A.: Static analysis in disjunctive numerical domains. In: Yi, K. (ed.) SAS 2006. LNCS, vol. 4134, pp. 3–17. Springer, Berlin (2006). doi:10.1007/11823230_2

    Chapter  Google Scholar 

  37. Sankaranarayanan, S., Sipma, H.B., Manna, Z.: Scalable analysis of linear systems using mathematical programming. In: Cousot, R. (ed.) VMCAI 2005. LNCS, vol. 3385, pp. 25–41. Springer, Berlin (2005). doi:10.1007/978-3-540-30579-8_2

    Chapter  Google Scholar 

  38. Sen, R., Srikant, Y.: Executable analysis using abstract interpretation with circular linear progressions. In: MEMOCODE (2007)

    Google Scholar 

  39. Sharir, M., Pnueli, A.: Two approaches to interprocedural data flow analysis. In: Program Flow Analysis: Theory and Applications. Prentice-Hall (1981)

    Google Scholar 

  40. Sharma, T., Thakur, A., Reps, T.: An abstract domain for bit-vector inequalities. TR-1789, Computer Science Department, University of Wisconsin, Madison, WI (2013)

    Google Scholar 

  41. Simon, A., King, A.: Taming the wrapping of integer arithmetic. In: Nielson, H.R., Filé, G. (eds.) SAS 2007. LNCS, vol. 4634, pp. 121–136. Springer, Heidelberg (2007). doi:10.1007/978-3-540-74061-2_8

    Chapter  Google Scholar 

  42. Simon, A., King, A., Howe, J.: Two variables per linear inequality as an abstract domain. In: International Workshop on Logic Based Program Development and Transformation, pp. 71–89 (2002)

    Google Scholar 

  43. Warren Jr., H.: Hacker’s Delight. Addison-Wesley, Boston (2003)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. University of Wisconsin, Madison, WI, USA

    Tushar Sharma & Thomas Reps

  2. GrammaTech, Inc., Ithaca, NY, USA

    Thomas Reps

Authors
  1. Tushar Sharma
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Thomas Reps
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Tushar Sharma .

Editor information

Editors and Affiliations

  1. IRIF, Université Paris Diderot, Paris, France

    Ahmed Bouajjani

  2. VERIMAG, CNRS & Université Grenoble Alpes, Grenoble, France

    David Monniaux

Rights and permissions

Reprints and permissions

Copyright information

© 2017 Springer International Publishing AG

About this paper

Cite this paper

Sharma, T., Reps, T. (2017). Sound Bit-Precise Numerical Domains. In: Bouajjani, A., Monniaux, D. (eds) Verification, Model Checking, and Abstract Interpretation. VMCAI 2017. Lecture Notes in Computer Science(), vol 10145. Springer, Cham. https://doi.org/10.1007/978-3-319-52234-0_27

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-52234-0_27

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-52233-3

  • Online ISBN: 978-3-319-52234-0

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation