Abstract:Context-free language (CFL) reachability is a standard approach in static analyses, where the analysis question is phrased as a language reachability problem on a graph $G$ wrt a CFL L. While CFLs lack the expressiveness needed for high precision, common formalisms for context-sensitive languages are such that the corresponding reachability problem is undecidable. Are there useful context-sensitive language-reachability models for static analysis? In this paper, we introduce Multiple Context-Free Language (MCFL) reachability as an expressive yet tractable model for static program analysis. MCFLs form an infinite hierarchy of mildly context sensitive languages parameterized by a dimension $d$ and a rank $r$. We show the utility of MCFL reachability by developing a family of MCFLs that approximate interleaved Dyck reachability, a common but undecidable static analysis problem. We show that MCFL reachability be computed in $O(n^{2d+1})$ time on a graph of $n$ nodes when $r=1$, and $O(n^{d(r+1)})$ time when $r>1$. Moreover, we show that when $r=1$, the membership problem has a lower bound of $n^{2d}$ based on the Strong Exponential Time Hypothesis, while reachability for $d=1$ has a lower bound of $n^{3}$ based on the combinatorial Boolean Matrix Multiplication Hypothesis. Thus, for $r=1$, our algorithm is optimal within a factor $n$ for all levels of the hierarchy based on $d$. We implement our MCFL reachability algorithm and evaluate it by underapproximating interleaved Dyck reachability for a standard taint analysis for Android. Used alongside existing overapproximate methods, MCFL reachability discovers all tainted information on 8 out of 11 benchmarks, and confirms $94.3\%$ of the reachable pairs reported by the overapproximation on the remaining 3. To our knowledge, this is the first report of high and provable coverage for this challenging benchmark set.

Verifying correct usage of context-free API protocols

Vetting API Usages in C Programs with IMChecker

A Novel Approach to Verifying Context Free Properties of Programs.

API-misuse detection driven by fine-grained API-constraint knowledge graph

KGAMD: An API-Misuse Detector Driven by Fine-Grained API-Constraint Knowledge Graph

Model Checking a C++ Software Framework, a Case Study

Program Analysis via Multiple Context Free Language Reachability

Formal Verification for C Program

Combining Model Learning and Model Checking to Analyze Java Libraries

Modularity, Code Specialization, and Zero-Cost Abstractions for Program Verification

Towards Context Consistency by Concurrent Checking for Internetware Applications

C Code Verification Based on the Extended Labeled Transition System Model

Context Generation from Formal Specifications for C Analysis Tools

Partial Constraint Checking for Context Consistency in Pervasive Computing

Accelerating Software Model Checking Based on Program Backbone.

Smart Casual Verification of the Confidential Consortium Framework

Scalable Verification Framework for C Program

BPPChecker: An SMT-based Model Checker on Basic Parallel Processes

Overcoming Restraint: Composing Verification of Foreign Functions with Cogent

BPPChecker: An SMT-based Model Checker on Basic Parallel Processes(Full Version)

Practical Tactics For Verifying C Programs In Coq