Abstract:Context-free language (CFL) reachability is a standard approach in static analyses, where the analysis question is phrased as a language reachability problem on a graph $G$ wrt a CFL L. While CFLs lack the expressiveness needed for high precision, common formalisms for context-sensitive languages are such that the corresponding reachability problem is undecidable. Are there useful context-sensitive language-reachability models for static analysis? In this paper, we introduce Multiple Context-Free Language (MCFL) reachability as an expressive yet tractable model for static program analysis. MCFLs form an infinite hierarchy of mildly context sensitive languages parameterized by a dimension $d$ and a rank $r$. We show the utility of MCFL reachability by developing a family of MCFLs that approximate interleaved Dyck reachability, a common but undecidable static analysis problem. We show that MCFL reachability be computed in $O(n^{2d+1})$ time on a graph of $n$ nodes when $r=1$, and $O(n^{d(r+1)})$ time when $r>1$. Moreover, we show that when $r=1$, the membership problem has a lower bound of $n^{2d}$ based on the Strong Exponential Time Hypothesis, while reachability for $d=1$ has a lower bound of $n^{3}$ based on the combinatorial Boolean Matrix Multiplication Hypothesis. Thus, for $r=1$, our algorithm is optimal within a factor $n$ for all levels of the hierarchy based on $d$. We implement our MCFL reachability algorithm and evaluate it by underapproximating interleaved Dyck reachability for a standard taint analysis for Android. Used alongside existing overapproximate methods, MCFL reachability discovers all tainted information on 8 out of 11 benchmarks, and confirms $94.3\%$ of the reachable pairs reported by the overapproximation on the remaining 3. To our knowledge, this is the first report of high and provable coverage for this challenging benchmark set.

A Linear-Time Complexity Algorithm for Solving the Dyck-CFL Reachability Problem on Bi-Directed Trees

The Fine-Grained Complexity of CFL Reachability

A Dynamic Algorithm for Reachability Games Played on Trees

On-The-Fly Static Analysis via Dynamic Bidirected Dyck Reachability

Fast Graph Simplification for Interleaved-Dyck Reachability

Program Verification by Reachability Searching over Dynamic Call Tree.

Pearl: A Multi-Derivation Approach to Efficient CFL-Reachability Solving

Program Analysis via Multiple Context Free Language Reachability

Optimization of the Context-Free Language Reachability Matrix-Based Algorithm

An Improved Algorithm for Incremental DFS Tree in Undirected Graphs

Research on Algorithm for Detecting Simple Path in Complex Network and Its Application

Efficiently Answering Reachability Queries on Very Large Directed Graphs.

A New Algorithm for Identifying Loops in Decompilation

IIS-Guided DFS for Efficient Bounded Reachability Analysis of Linear Hybrid Automata

A Constraint-Pattern Based Method for Reachability Determination

An Efficient Algorithm for Finding Modules in Fault Trees

Towards an Efficient Path-Oriented Tool for Bounded Reachability Analysis of Linear Hybrid Systems using Linear Programming

Improving parallel modularization algorithm of large complex fault trees

Fully Dynamic Depth-First Search in Directed Graphs.

A Method of Computing Minimal Diagnoses Based on Pseudo-Failure-Degree to Create New Enumeration Tree

An Efficient Algorithm For Chinese Postman Walk on Bi-directed de Bruijn Graphs