Skip to main content
SpringerLink
Log in

Structure-Sensitive Points-To Analysis for C and C++

  • Conference paper
  • First Online:
Static Analysis (SAS 2016)

Part of the book series: Lecture Notes in Computer Science ((LNPSE,volume 9837))

Included in the following conference series:

Abstract

We present a points-to analysis for C/C++ that recovers much of the available high-level structure information of types and objects, by applying two key techniques: (1) It records the type of each abstract object and, in cases when the type is not readily available, the analysis uses an allocation-site plus type abstraction to create multiple abstract objects per allocation site, so that each one is associated with a single type. (2) It creates separate abstract objects that represent (a) the fields of objects of either struct or class type, and (b) the (statically present) constant indices of arrays, resulting in a limited form of array-sensitivity.

We apply our approach to the full LLVM bitcode intermediate language and show that it yields much higher precision than past analyses, allowing accurate distinctions between subobjects, v-table entries, array components, and more. Especially for C++ programs, this precision is invaluable for a realistic analysis. Compared to the state-of-the-art past approach, our techniques exhibit substantially better precision along multiple metrics and realistic benchmarks (e.g., 40+% more variables with a single points-to target).

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    cclyzer is publicly available at https://github.com/plast-lab/cclyzer.

  2. 2.

    Our original selection included the 10 largest coreutils, but dir and vdir turned out to be identical to ls and are maintained mostly for backwards-compatibility reasons.

References

  1. Andersen, L.O.: Program analysis and specialization for the C programming language. Ph.d. thesis, DIKU, University of Copenhagen, May 1994

    Google Scholar 

  2. Avots, D., Dalton, M., Livshits, B., Lam, M.S.: Improving software security with a C pointer analysis. In: Proceedings of the 27th International Conference on Software Engineering, ICSE 2005, pp. 332–341. ACM, New York (2005)

    Google Scholar 

  3. Berndl, M., Lhoták, O., Qian, F., Hendren, L.J., Umanee, N.: Points-to analysis using BDDs. In: Proceedings of the 2003 ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 2003, pp. 103–114. ACM, New York (2003)

    Google Scholar 

  4. Bravenboer, M., Smaragdakis, Y.: Strictly declarative specification of sophisticated points-to analyses. In: Proceedings of the 24th Annual ACM SIGPLAN Conference on Object Oriented Programming, Systems, Languages, and Applications, OOPSLA 2009. ACM, New York (2009)

    Google Scholar 

  5. Das, M.: Unification-based pointer analysis with directional assignments. In: Proceedings of the 2000 ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 2000, pp. 35–46. ACM, New York (2000)

    Google Scholar 

  6. Emami, M., Ghiya, R., Hendren, L.J.: Context-sensitive interprocedural points-to analysis in the presence of function pointers. In: Proceedings of the 1994 ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 1994, pp. 242–256. ACM, New York (1994)

    Google Scholar 

  7. Hardekopf, B., Lin, C.: The ant and the grasshopper: fast and accurate pointer analysis for millions of lines of code. In: Proceedings of the 2007 ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 2007, pp. 290–299. ACM, New York (2007)

    Google Scholar 

  8. Hardekopf, B., Lin, C.: Exploiting pointer and location equivalence to optimize pointer analysis. In: Riis Nielson, H., Filé, G. (eds.) SAS 2007. LNCS, vol. 4634, pp. 265–280. Springer, Heidelberg (2007)

    Chapter  Google Scholar 

  9. Hardekopf, B., Lin, C.: Semi-sparse flow-sensitive pointer analysis. In: Proceedings of the 36th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL 2009, pp. 226–238. ACM, New York (2009)

    Google Scholar 

  10. Hardekopf, B., Lin, C.: Flow-sensitive pointer analysis for millions of lines of code. In: Proceedings of the 9th International Symposium on Code Generation and Optimization, CGO 2011, pp. 289–298. IEEE Computer Society (2011)

    Google Scholar 

  11. Heintze, N., Tardieu, O.: Ultra-fast aliasing analysis using CLA: a million lines of C code in a second. In: Proceedings of the 2001 ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 2001, pp. 254–263. ACM, New York (2001)

    Google Scholar 

  12. Hind, M., Burke, M.G., Carini, P.R., Choi, J.: Interprocedural pointer alias analysis. ACM Trans. Program. Lang. Syst. 21(4), 848–894 (1999)

    Article  Google Scholar 

  13. Lattner, C., Lenharth, A., Adve, V.S.: Making context-sensitive points-to analysis with heap cloning practical for the real world. In: Proceedings of the 2007 ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 2007, pp. 278–289. ACM, New York (2007)

    Google Scholar 

  14. Lhoták, O., Chung, K.C.A.: Points-to analysis with efficient strong updates. In: Proceedings of the 38th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL 2011, pp. 3–16. ACM, New York (2011)

    Google Scholar 

  15. Li, Y., Tan, T., Sui, Y., Xue, J.: Self-inferencing reflection resolution for Java. In: Jones, R. (ed.) ECOOP 2014. LNCS, vol. 8586, pp. 27–53. Springer, Heidelberg (2014)

    Google Scholar 

  16. Livshits, B., Whaley, J., Lam, M.S.: Reflection analysis for Java. In: Yi, K. (ed.) APLAS 2005. LNCS, vol. 3780, pp. 139–160. Springer, Heidelberg (2005)

    Chapter  Google Scholar 

  17. Milanova, A., Rountev, A., Ryder, B.G.: Parameterized object sensitivity for points-to and side-effect analyses for Java. In: Proceedings of the 2002 International Symposium on Software Testing and Analysis, ISSTA 2002, pp. 1–11. ACM, New York (2002)

    Google Scholar 

  18. Miné, A.: Field-sensitive value analysis of embedded C programs with union types and pointer arithmetics. In: Proceedings of the 2006 ACM SIGPLAN/SIGBED Conference on Languages, Compilers, and Tools for Embedded Systems, LCTES 2006, pp. 54–63. ACM (2006)

    Google Scholar 

  19. Nystrom, E.M., Kim, H., Hwu, W.W.: Importance of heap specialization in pointer analysis. In: Proceedings of the 5th ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools and Engineering, PASTE 2004, pp. 43–48. ACM, New York (2004)

    Google Scholar 

  20. Pearce, D.J., Kelly, P.H.J., Hankin, C.: Efficient field-sensitive pointer analysis for C. In: Proceedings of the 5th ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools and Engineering, PASTE 2004, pp. 37–42. ACM, New York (2004)

    Google Scholar 

  21. Pearce, D.J., Kelly, P.H.J., Hankin, C.: Efficient field-sensitive pointer analysis of C. ACM Trans. Program. Lang. Syst. 30(1) (2007)

    Google Scholar 

  22. Rountev, A., Milanova, A., Ryder, B.G.: Points-to analysis for Java using annotated constraints. In: Proceedings of the 16th Annual ACM SIGPLAN Conference on Object Oriented Programming, Systems, Languages, and Applications, OOPSLA 2001, pp. 43–55. ACM, New York (2001)

    Google Scholar 

  23. Smaragdakis, Y., Balatsouras, G., Kastrinis, G., Bravenboer, M.: More sound static handling of Java reflection. In: Feng, X., et al. (eds.) APLAS 2015. LNCS, vol. 9458, pp. 485–503. Springer, Heidelberg (2015). doi:10.1007/978-3-319-26529-2_26

    Chapter  Google Scholar 

  24. Whaley, J., Rinard, M.C.: Compositional pointer and escape analysis for Java programs. In: Proceedings of the 14th Annual ACM SIGPLAN Conference on Object Oriented Programming, Systems, Languages, and Applications, OOPSLA 1999, pp. 187–206. ACM, New York (1999)

    Google Scholar 

  25. Zheng, X., Rugina, R.: Demand-driven alias analysis for C. In: Proceedings of the 35th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL 2008, pp. 197–208. ACM, New York (2008)

    Google Scholar 

Download references

Acknowledgments

We gratefully acknowledge funding by the European Research Council under grant 307334 (Spade). We thank Kostas Ferles and Eirini Psallida for their early contributions to cclyzer; and also the anonymous reviewers of this paper, for their insightful comments and suggestions.

Author information

Authors and Affiliations

  1. Department of Informatics, University of Athens, 15784, Athens, Greece

    George Balatsouras & Yannis Smaragdakis

Authors
  1. George Balatsouras
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Yannis Smaragdakis
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to George Balatsouras .

Editor information

Editors and Affiliations

  1. Ecole Normale Supérieure , Paris, France

    Xavier Rival

Rights and permissions

Reprints and permissions

Copyright information

© 2016 Springer-Verlag GmbH Germany

About this paper

Cite this paper

Balatsouras, G., Smaragdakis, Y. (2016). Structure-Sensitive Points-To Analysis for C and C++. In: Rival, X. (eds) Static Analysis. SAS 2016. Lecture Notes in Computer Science(), vol 9837. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-662-53413-7_5

Download citation

  • DOI: https://doi.org/10.1007/978-3-662-53413-7_5

  • Published:

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-662-53412-0

  • Online ISBN: 978-3-662-53413-7

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation