Verifying pointer safety for programs with unknown calls

• Published in: Journal of symbolic computation Vol. 45; no. 11; pp. 1163 - 1183
• Main Authors: Luo, Chenguang, Craciun, Florin, Qin, Shengchao, He, Guanhua, Chin, Wei-Ngan
• Format: Journal Article
• Language: English
• Published: Elsevier Ltd 01-11-2010
• Subjects: Abduction; Inference; Separation logic; Verification; Inference; Separation logic; Verification; Abduction
• ISSN: 0747-7171; 1095-855X
• DOI: 10.1016/j.jsc.2010.06.003

We study the automated verification of pointer safety for heap-manipulating imperative programs with unknown procedure calls. Given a Hoare-style partial correctness specification
S
=
{
Pre
}
C
{
Post
}
in separation logic, where the program
C
contains calls to some unknown procedure
U
, we infer a specification
S
U
for the unknown procedure
U
from the calling contexts. We show that the problem of verifying the program
C
against the specification
S
can be safely reduced to the problem of proving that the procedure
U
(once its code is available) meets the derived specification
S
U
. The expected specification
S
U
for the unknown procedure
U
is automatically calculated using an abduction-based shape analysis. We have also implemented a prototype system to validate the viability of our approach. Preliminary results show that the specifications derived by our tool fully capture the behaviors of the unknown code in many cases.