Predator Hunting Party (Competition Contribution) [chapter]

Petr Muller, Petr Peringer, Tomáš Vojnar
2015 Lecture Notes in Computer Science  
This paper introduces PredatorHP (Predator Hunting Party), a program verifier built on top of the Predator shape analyser, and discusses its participation in the SV-COMP'15 software verification competition. Predator is a sound shape analyser dealing with C programs with lists implemented via low-level pointer operations. PredatorHP uses Predator to prove programs safe while at the same time using several bounded versions of Predator for bug hunting. The Underlying Verification Approach At the
more » ... eart of PredatorHP there is the Predator shape analyser [2] . The main aim of Predator is sound shape analysis of sequential, non-recursive C programs that use lowlevel pointer operations for working efficiently with various kinds of linked lists. Predator supports many advanced uses of pointer arithmetics, address alignment, and block operations common in highly optimized system code, such as operating system kernels, drivers, memory allocators, and the like. Predator is based on abstract interpretation with the abstract domain of symbolic memory graphs (SMGs) [2] . In a nutshell, SMGs consist of two kinds of nodesnamely, individual memory regions and uninterrupted list segments-and two kinds of edges, in particular, the so-called has-value and points-to edges. SMGs were inspired by separation logic with higher-order list predicates but with an added support for lowlevel memory operations. Moreover, all the needed algorithms for dealing with SMGs (symbolic execution of program statements, the join operator, widening in the form of abstraction, entailment checking) were newly designed to be as efficient as possible by leveraging the graph structure of SMGs. The most essential role is played by the join operator: both abstraction and entailment checking are built on top of it. Predator supports inter-procedural analysis by means of function summaries. Recently, a new extension of Predator was implemented [1] . It uses the Predator kernel for transforming programs with list containers implemented by low-level pointer operations into equivalent programs with high-level container operations, which can be useful, e.g., for code understanding, easier verification, parallelisation, optimisation, etc.
doi:10.1007/978-3-662-46681-0_40 fatcat:dbrdzsfcaraajfb4e7dx44zbte