A Library Modeling Language for the Static Analysis of C Programs

Abdelraouf Ouadjaout (1) , Antoine Miné (1)

1 APR - Algorithmes, Programmes et Résolution

We present a specification language aiming at soundly modeling unavailable functions in a static analyzer for C by abstract interpretation. It takes inspiration from Behavioral Interface Specification Languages popular in deductive verification, notably Frama-C's ACSL, as we annotate function prototypes with pre and post-conditions expressed concisely in a first-order logic, but with key differences. Firstly, the specification aims at replacing a function implementation in a safety analysis, not verifying its functional correctness. Secondly, we do not rely on theorem provers; instead, specifications are interpreted at function calls by our abstract interpreter. We implemented the language into Mopsa, a static analyzer designed to easily reuse abstract domains across widely different languages (such as C and Python). We show how its design helped us support a logic-based language with minimal effort. Notably, it was sufficient to add only a handful transfer functions (including very selective support for quantifiers) to achieve a sound and precise analysis. We modeled a large part of the GNU C library and C execution environment in our language, including the manipulation of unbounded strings, file descriptors, and programs with an unbounded number of symbolic command-line parameters, which allows verifying programs in a realistic setting. We report on the analysis of C programs from the Juliet benchmarks and Coreutils.

Domaines: Langage de programmation [cs.PL]

Abdelraouf Ouadjaout, Antoine Miné. A Library Modeling Language for the Static Analysis of C Programs. 27th Static Analysis Symposium, Nov 2020, Chicago, United States. pp.223-247, ⟨10.1007/978-3-030-65474-0_11⟩. ⟨hal-02991999⟩