Abstract:Context-free language (CFL) reachability is a standard approach in static analyses, where the analysis question is phrased as a language reachability problem on a graph $G$ wrt a CFL L. While CFLs lack the expressiveness needed for high precision, common formalisms for context-sensitive languages are such that the corresponding reachability problem is undecidable. Are there useful context-sensitive language-reachability models for static analysis? In this paper, we introduce Multiple Context-Free Language (MCFL) reachability as an expressive yet tractable model for static program analysis. MCFLs form an infinite hierarchy of mildly context sensitive languages parameterized by a dimension $d$ and a rank $r$. We show the utility of MCFL reachability by developing a family of MCFLs that approximate interleaved Dyck reachability, a common but undecidable static analysis problem. We show that MCFL reachability be computed in $O(n^{2d+1})$ time on a graph of $n$ nodes when $r=1$, and $O(n^{d(r+1)})$ time when $r>1$. Moreover, we show that when $r=1$, the membership problem has a lower bound of $n^{2d}$ based on the Strong Exponential Time Hypothesis, while reachability for $d=1$ has a lower bound of $n^{3}$ based on the combinatorial Boolean Matrix Multiplication Hypothesis. Thus, for $r=1$, our algorithm is optimal within a factor $n$ for all levels of the hierarchy based on $d$. We implement our MCFL reachability algorithm and evaluate it by underapproximating interleaved Dyck reachability for a standard taint analysis for Android. Used alongside existing overapproximate methods, MCFL reachability discovers all tainted information on 8 out of 11 benchmarks, and confirms $94.3\%$ of the reachable pairs reported by the overapproximation on the remaining 3. To our knowledge, this is the first report of high and provable coverage for this challenging benchmark set.

BRICK: Path Enumeration Based Bounded Reachability Checking of C Program (Competition Contribution)

Bipartite Graph-Based Control Flow Checking for COTS-based Small Satellites

Brick: A Binary Tool For Run-Time Detecting And Locating Integer-Based Vulnerability

BACH 2 : Bounded Reachability Checker for Compositional Linear Hybrid Systems

A Constraint-Pattern Based Method for Reachability Determination

Path-oriented Bounded Reachability Analysis of Composed Linear Hybrid Systems

Towards an Efficient Path-Oriented Tool for Bounded Reachability Analysis of Linear Hybrid Systems using Linear Programming

Deriving Unbounded Reachability Proof of Linear Hybrid Automata during Bounded Checking Procedure.

Bach : Bounded Reachability Checker For Linear Hybrid Automata

SAT–LP–IIS Joint-Directed Path-Oriented Bounded Reachability Analysis of Linear Hybrid Automata

A Static Analysis Tool with Optimizations for Reachability Determination

CBMC: The C Bounded Model Checker

Composed IIS path locating based optimization for bounded reachability analysis of compositional linear hybrid systems

BACH: B ounded reach A bility CH ecker for linear hybrid automata

Program Analysis via Multiple Context Free Language Reachability

Abstraction-driven Concolic Testing

Mixed Semantics Guided Layered Bounded Reachability Analysis of Compositional Linear Hybrid Automata

Scalable reachability analysis via automated dynamic netlist-based hint generation

From Bounded Reachability Analysis of Linear Hybrid Automata to Verification of Industrial CPS and IoT

Stepwise CTL model checking

Automatic abstraction for C program