Automatic bug finding with static analysis requires precise tracking of different memory object values. This paper describes a memory modeling method for static analysis of C programs. It is particularly suitable for precise path-sensitive analyses, e.g., symbolic execution. It can handle almost all kinds of C expressions, including arbitrary levels of pointer dereferences, pointer arithmetic, composite array and struct data types, arbitrary type casts, dynamic memory allocation, etc. It maps aliased lvalue expressions to the identical object without extra alias analysis. The model has been implemented in the Clang static analyzer and enhanced the analyzer a lot by enabling it to have precise value tracking ability.


Memory Model Memory Block Symbolic Execution Pointer Arithmetic Memory Object 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Cadar, C., Twohey, P., Ganesh, V., Engler, D.: EXE: A system for automatically generating inputs of death using symbolic execution. Technical report, Computer System Laboratory, Stanford University (2006)Google Scholar
  2. 2.
    Clang static analyzer,
  3. 3.
    Godefroid, P., Klarlund, N., Sen, K.: DART: Directed automated random testing. In: Proceedings of the 2005 ACM SIGPLAN conference on Programming language design and implementation, pp. 213–223 (2005)Google Scholar
  4. 4.
    Hampapuram, H., Yang, Y., Das, M.: Symbolic path simulation in path-sensitive dataflow analysis. In: Proceedings of the 6th ACM SIGPLAN-SIGSOFT workshop on Program analysis for software tools and engineering, pp. 52–58 (2005)Google Scholar
  5. 5.
    WG14 ISO/IEC 9899:201x, editor. Programming Languages - C. ISO (1999),
  6. 6.
    Kremenek, T.: Finding bugs with the clang static analyzer,
  7. 7.
    The LLVM compiler infrastructure,
  8. 8.
    Nielson, H.R., Nielson, F.: Semantics with applications: a formal introduction. John Wiley & Sons Inc., Chichester (1992)zbMATHGoogle Scholar
  9. 9.
    Xie, Y., Aiken, A.: Saturn: A scalable framework for error detection using Boolean satisfiability. ACM Transactions on Programming Languages and Systems 29(3) (2007)Google Scholar
  10. 10.
    Xu, Z., Zhang, J.: A test data generation tool for unit testing of C programs. In: Proceedings of the International Conference on Quality Software, pp. 107–116 (2006)Google Scholar
  11. 11.
    Zhang, J.: Symbolic execution of program paths involving pointers and structure variables. In: Proceedings of the Fourth International Conference on Quality Software, pp. 87–92 (2004)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2010

Authors and Affiliations

  • Zhongxing Xu
    • 1
  • Ted Kremenek
    • 2
  • Jian Zhang
    • 1
  1. 1.State Key Laboratory of Computer Science Institute of SoftwareChinese Academy of SciencesChina
  2. 2.Apple Inc.USA

Personalised recommendations