CS 6340: Software Analysis and Testing
Introduction to Program AnalysisCS 8803 FPLAug 20, 2013Course
CommunicationAll class materials and annoucements provided via
t-squarehttps://t-square.gatech.edu
To ask questions:Post to forum on PiazzaMeet me after classSend
email to [email protected] email for appointment (KACB
2320)
Course ContentFocus on program analysisConcerns discovering
facts about programs
Both principles and practice
Mix of basic and advanced material
Other trends not covered in this course:Program
synthesisProgramming language designCourse StructureLectures, from
notes and research papersNo required textbook
Evaluation components:Class participation (5%)In-class mid-term
(20%) and final (20%)Programming assignments (30%)Team project and
presentation (25%)Prerequisites and CreditsPre-Reqs: None, but
expect to program in Java
Credits: 3 hours, counts toward:Elective in MS CS program for
specializations of Information Security and DB + SEBreadth
component in PhD CS program for areas of PLC and SE
Auditing allowed in exceptional casesLearning OutcomesPrepare
for research in program analysisThis is where the field is
headed
Be able to apply program analysis to problemsin other areas
(security, systems, etc.)
Become a better software developer or tester
For the war storiesThe Ariane Rocket Disaster (1996)
Post MortemFailed due to unhandled floating-point exception
Cost$100Ms for loss of missionMulti-year setback to the Ariane
program8Mars Polar Lander (1999)
Post MortemA units problemCaller expected values in
inches/feetCallee assumed values in metersEssentially, a type
error
Total loss of $100M mission
10East Coast USA
11East Coast USA: 2003 Blackout
12Post MortemLocal failure rapidly cascaded through grid
Major contributing cause was unnoticed crash of automated alarm
systems
10Ms of people affected13Security VulnerabilitiesOften exploit
bugs in programs
Widespread problem Code RedTitan RainMoonlight MazeOperation
OrchardStuxnet Worm
Getting worse
2011 Mobile Threat Report(Lookout Mobile Security)0.5-1 million
Android users affected by malware in first half of 2011 3 out of 10
Android owners likely to face web-based threat each yearAttackers
using increasingly sophisticated ways to steal data and moneyWhat
is Program Analysis?Body of work to discover facts about
programs
Broadly classified into two kinds:Dynamic (execution-time)Static
(compile-time)
This course will cover both kinds, and more!Data-driven (machine
learning)Crowd-sourcing (leveraging human intelligence)Synergistic
combinations of above approaches
Dynamic Program AnalysisInfer facts of program by monitoring its
runs
Examples:Array bound checkingPurifyMemory leak
detectionValgrindDatarace detectionEraserFinding likely
invariantsDaikonStatic AnalysisInfer facts of the program by
inspecting its source (or binary) codeAn Example Static Analysis
ProblemFind variables with constant value at a given program
location
Example program:
int p(int x) { return x * x; }
void main() { int z; if (getc()) z = p(6) + 8; else z = p(-7) -
5; printf (z);}z = 44Iterative Approximationz =3while (x > 0) if
(x == 1)y =7y = z + 4assert (y == 7)[x=?, y=?, z=?][x=?, y=?,
z=3][x=?, y=?, z=3][x=?, y=?, z=3][x=1, y=?, z=3][x=1, y=7,
z=3][x=?, y=7, z=3][x=?, y=?, z=3]truefalsetruefalseAnother Static
Analysis ProblemLiveness Analysis: find which variables are live at
each program point
These are variables that are used before being set on some path
from current program point
Many applications:Compilers: register allocationSoftware Quality
Tools: find uninitialized variable useLiveness Analysis on Example
Programa = 0L: b = a + 1c = c + ba = b * 2if (c < N) goto
Lfalsereturn ctrue{ c }{ c, a }{ c, b }{ c, b }{ c, a }{ c }{ c
}Other Static Analysis ProblemsReaching definitions
Expressions that are available
Dead code
Pointer variables never point into the same location
Points in the program in which it is safe to free an object
An invocation of virtual method whose address is unique
Statements that can be executed in parallel
Integer intervalsDynamic vs. Static
AnalysisDynamicStaticEffectivenessUnsound(may miss
errors)Incomplete (may report spurious errors)CostProportional
toprograms executionProportional toprograms sizeDynamic vs. Static
AnalysisDynamicStaticEffectivenessUnsound(may miss
errors)Incomplete (may report spurious errors)CostProportional
toprograms executionProportional toprograms sizeUndecidability of
Program PropertiesEven seemingly simple program properties are
undecidablee.g.: is a program point reachable on some input?
=> no program analysis can be sound and complete
Some properties undecidable even if program is simplified (e.g.,
conditionals are ignored)Who Needs Program
Analysis?CompilersAdvanced computer architecturesHigh-level
programming languages (functional, OO, garbage-collected,
concurrent)
Software Quality Tools (Testing, Verification,
Debugging)Generate test casesFind programming errorsGenerate
certification proofsLocalize causes of errors
Program Understanding (e.g., IDEs)Software Quality
ToolsDetecting hazards (lint)e.g.: Using uninitialized variablesa =
malloc() ;b = a; free(a);c = malloc();if (b == c) printf(unexpected
equality);
References outside array bounds
Memory leaks (even in Java!)
Case Study 1: Static Driver VerifierDrivers Source Code in C
API Usage Rules(SLIC)
Defects100% pathcoverage
Windows APIStatic Driver VerifierModel ofWindows KernelOverview
of SLAM ProcessC programSLIC rulesBoolean ProgramC2BPBEBOPAbstract
Error TraceNEWTONConcrete Error TraceProofBill Gates Quote about
SLAM"Things like even software verification, this has been the Holy
Grail of computer science for many decades but now in some very key
areas, for example, driver verification were building tools that
can do actual proof about the software and how it works in order to
guarantee the reliability.
Bill Gates, April 18, 2002.
Keynote address at WinHec 2002Case Study 2: ASTREProve absence
of bugs in safety critical C code
ASTRE automatically proved absence of bugs in the primary flight
control software of Airbus A340s fly-by-wire systemAnalyzed a
program of 132,000 lines of C code
