Field-Sensitive Value Analysis of Embedded C Programs with Union Types and Pointer Arithmetics
<|reference_start|>Field-Sensitive Value Analysis of Embedded C Programs with Union Types and Pointer Arithmetics: We propose a memory abstraction able to lift existing numerical static analyses to C programs containing union types, pointer casts, and arbitrary pointer arithmetics. Our framework is that of a combined points-to and data-value analysis. We abstract the contents of compound variables in a field-sensitive way, whether these fields contain numeric or pointer values, and use stock numerical abstract domains to find an overapproximation of all possible memory states--with the ability to discover relationships between variables. A main novelty of our approach is the dynamic mapping scheme we use to associate a flat collection of abstract cells of scalar type to the set of accessed memory locations, while taking care of byte-level aliases - i.e., C variables with incompatible types allocated in overlapping memory locations. We do not rely on static type information which can be misleading in C programs as it does not account for all the uses a memory zone may be put to. Our work was incorporated within the Astr\'{e}e static analyzer that checks for the absence of run-time-errors in embedded, safety-critical, numerical-intensive software. It replaces the former memory domain limited to well-typed, union-free, pointer-cast free data-structures. Early results demonstrate that this abstraction allows analyzing a larger class of C programs, without much cost overhead.<|reference_end|>
@article{miné2007field-sensitive,
    title={Field-Sensitive Value Analysis of Embedded C Programs with Union Types
  and Pointer Arithmetics},
    author={Antoine Min'e (LIENS)},
    journal={Languages, Compilers, and Tools for Embedded Systems (LCTES)
  (06/2006) 54-63},
    year={2007},
    archivePrefix={arXiv},
    eprint={cs/0703074},
    primaryClass={cs.PL}
}