Extended Weighted Pushdown Systems

  • Akash Lal
  • Thomas Reps
  • Gogul Balakrishnan
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3576)


Recent work on weighted-pushdown systems shows how to generalize interprocedural-dataflow analysis to answer “stack-qualified queries”, which answer the question “what dataflow values hold at a program node for a particular set of calling contexts?” The generalization, however, does not account for precise handling of local variables. Extended-weighted-pushdown systems address this issue, and provide answers to stack-qualified queries in the presence of local variables as well.


Abstract Domain Rule Sequence Reachability Problem Conditional Branch Call Site 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


  1. 1.
    Aho, A.V., Sethi, R., Ullman, J.D.: Compilers: Principles, Techniques and Tools. Addison-Wesley, Reading (1985)Google Scholar
  2. 2.
    Balakrishnan, G., Reps, T.: Analyzing memory accesses in x86 executables. In: Int. Conf. on Comp. Construct. (2004)Google Scholar
  3. 3.
    Bouajjani, A., Esparza, J., Maler, O.: Reachability analysis of pushdown automata: Application to model checking. In: CONCUR, pp. 135–150. Springer, Heidelberg (1997)Google Scholar
  4. 4.
    Bouajjani, A., Esparza, J., Touili, T.: A generic approach to the static analysis of concurrent programs with procedures. In: Symp. on Princ. of Prog. Lang., pp. 62–73 (2003)Google Scholar
  5. 5.
    Chen, H., Wagner, D.: MOPS: An infrastructure for examining security properties of software. In: Conf. on Comp. and Commun. Sec. (November 2002)Google Scholar
  6. 6.
    Esparza, J., Kučera, A., Schwoon, S.: Model-checking LTL with regular valuations for pushdown systems. In: TACAS, pp. 306–339 (2001)Google Scholar
  7. 7.
    Esparza, J., Schwoon, S.: A BDD-based model checker for recursive programs. In: Berry, G., Comon, H., Finkel, A. (eds.) CAV 2001. LNCS, vol. 2102, pp. 324–336. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  8. 8.
    Finkel, A., Willems, B., Wolper, P.: A direct symbolic approach to model checking pushdown systems, 9th edn. Electronic Notes in Theoretical Computer Science, vol. 9 (1997)Google Scholar
  9. 9.
    Jensen, T., Le Métayer, D., Thorn, T.: Verification of control flow based security properties. In: IEEE Symposium on Security and Privacy, pp. 89–103 (1999)Google Scholar
  10. 10.
    Kam, J.B., Ullman, J.D.: Monotone data flow analysis frameworks. Acta Inf. 7(3), 305–318 (1977)zbMATHCrossRefMathSciNetGoogle Scholar
  11. 11.
    Kidd, N., Reps, T., Melski, D., Lal, A.: WPDS++: A C++ library for weighted pushdown systems (2004)Google Scholar
  12. 12.
    Knoop, J., Steffen, B.: The interprocedural coincidence theorem. In: Int. Conf. on Comp. Construct., pp. 125–140 (1992)Google Scholar
  13. 13.
    Landi, W., Ryder, B.: Pointer-induced aliasing: A problem classification. In: Symp. on Princ. of Prog. Lang., pp. 93–103 (1991)Google Scholar
  14. 14.
    Landi, W., Ryder, B.: A safe approximate algorithm for interprocedural pointer aliasing. In: Conf. on Prog. Lang. Design and Impl., pp. 235–248 (1992)Google Scholar
  15. 15.
    Müller-Olm, M., Seidl, H.: Precise interprocedural analysis through linear algebra. In: Symp. on Princ. of Prog. Lang. (2004)Google Scholar
  16. 16.
    Müller-Olm, M., Seidl, H.: Analysis of modular arithmetic. In: European Symp. on Programming (2005)Google Scholar
  17. 17.
    Reps, T., Horwitz, S., Sagiv, M.: Precise interprocedural dataflow analysis via graph reachability. In: Symp. on Princ. of Prog. Lang., pp. 49–61 (1995)Google Scholar
  18. 18.
    Reps, T., Schwoon, S., Jha, S.: Weighted pushdown systems and their application to interprocedural dataflow analysis. In: Static Analysis Symp., pp. 189–213 (2003)Google Scholar
  19. 19.
    Sagiv, M., Reps, T., Horwitz, S.: Precise interprocedural dataflow analysis with applications to constant propagation. Theor. Comp. Sci. 167, 131–170 (1996)zbMATHCrossRefMathSciNetGoogle Scholar
  20. 20.
    Schwoon, S.: Model-Checking Pushdown Systems. PhD thesis, Technical Univ. of Munich, Munich, Germany (July 2002)Google Scholar
  21. 21.
  22. 22.
    Schwoon, S., Jha, S., Reps, T., Stubblebine, S.: On generalized authorization problems. In: Comp. Sec. Found. Workshop, Wash., DC, IEEE Comp. Soc., Los Alamitos (2003)Google Scholar
  23. 23.
    Sharir, M., Pnueli, A.: Two approaches to interprocedural data flow analysis. In: Program Flow Analysis: Theory and Applications. Prentice-Hall, Englewood Cliffs (1981)Google Scholar
  24. 24.
    Whaley, J., Lam, M.: Cloning-based context-sensitive pointer alias analysis using binary decision diagrams. In: Conf. on Prog. Lang. Design and Impl., pp. 131–144 (2004)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2005

Authors and Affiliations

  • Akash Lal
    • 1
  • Thomas Reps
    • 1
  • Gogul Balakrishnan
    • 1
  1. 1.University of WisconsinMadison

Personalised recommendations