A dependent nominal physical type system for the static analysis of memory in low level code - Laboratoire Méthodes Formelles Accéder directement au contenu
Pré-Publication, Document De Travail Année : 2023

A dependent nominal physical type system for the static analysis of memory in low level code

Résumé

We tackle the problem of checking non-proof-carrying code, i.e. automatically proving type-safety (implying in our type system spatial memory safety) of low-level C code or of machine code resulting from its compilation without modification. This requires a precise static analysis that we obtain by having a type system which (i) is expressive enough to encode common low-level idioms, like pointer arithmetic, discriminating variants by bit-stealing on aligned pointers, storing the size and the base address of a buffer in distinct parts of the memory, or records with flexible array members, among others; and (ii) can be embedded in an abstract interpreter. We propose a new type system that meets these criteria. The distinguishing feature of this type system is a nominal organization of memory regions, which (i) allows nesting, concatenation, union, and sharing parameters between regions; (ii) induces a lattice over sets of addresses from the type definitions; and (iii) permits updates to memory cells that change their type without requiring one to control aliasing. We provide a semantic model for our type system, which enables us to derive sound type checking rules by abstract interpretation, then to integrate these rules as an abstract domain in a standard flow-sensitive static analysis. Our experiments on various challenging benchmark show that semantic type-checking using this expressive type system generally succeeds in proving type safety and spatial memory safety of C and machine code programs without modification, using only user-provided function prototypes.
Fichier principal
Vignette du fichier
main.pdf (1.02 Mo) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)
licence

Dates et versions

hal-04649674 , version 1 (16-07-2024)

Licence

Identifiants

  • HAL Id : hal-04649674 , version 1

Citer

Julien Simonnet, Matthieu Lemerre, Mihaela Sighireanu. A dependent nominal physical type system for the static analysis of memory in low level code. 2023. ⟨hal-04649674⟩
0 Consultations
0 Téléchargements

Partager

Gmail Mastodon Facebook X LinkedIn More