Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static...

28
Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan Gaugne To cite this version: Ronan Gaugne. Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures. [Research Report] RR-3232, INRIA. 1997. <inria-00073457> HAL Id: inria-00073457 https://hal.inria.fr/inria-00073457 Submitted on 24 May 2006 HAL is a multi-disciplinary open access archive for the deposit and dissemination of sci- entific research documents, whether they are pub- lished or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L’archive ouverte pluridisciplinaire HAL, est destin´ ee au d´ epˆ ot et ` a la diffusion de documents scientifiques de niveau recherche, publi´ es ou non, ´ emanant des ´ etablissements d’enseignement et de recherche fran¸cais ou ´ etrangers, des laboratoires publics ou priv´ es. CORE Metadata, citation and similar papers at core.ac.uk Provided by HAL-Rennes 1

Transcript of Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static...

Page 1: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

Static Debugging of C Programs: Detection of Pointer

Errors in Recursive Data Structures

Ronan Gaugne

To cite this version:

Ronan Gaugne. Static Debugging of C Programs: Detection of Pointer Errors in RecursiveData Structures. [Research Report] RR-3232, INRIA. 1997. <inria-00073457>

HAL Id: inria-00073457

https://hal.inria.fr/inria-00073457

Submitted on 24 May 2006

HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.

L’archive ouverte pluridisciplinaire HAL, estdestinee au depot et a la diffusion de documentsscientifiques de niveau recherche, publies ou non,emanant des etablissements d’enseignement et derecherche francais ou etrangers, des laboratoirespublics ou prives.

CORE Metadata, citation and similar papers at core.ac.uk

Provided by HAL-Rennes 1

Page 2: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

ISS

N 0

249-

6399

ap por t de r ech er ch e

INSTITUT NATIONAL DE RECHERCHE EN INFORMATIQUE ET EN AUTOMATIQUE

Static debugging of C programs:detection of pointer errors in recursive data

structures

Ronan Gaugne

N ˚ 3232

aout 1997

THEME 2

Page 3: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan
Page 4: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

����������� ��� ����������������� �������������! #" �#�$�%�&�$�'���(���)�*�����+���%�,�%�������� -�'�.���%�%���� $�0/+�1 ���$�2 3�$�4���&�$�����%

57698�:98<;=:9>�?@8$ACB

D#E3FG�HIGKJ�LNM=OG�PRQSG�TSUWVXQSY'QZG�TG'[�Y'\]T^Y_`T3acbdH�e9UWTSQ^fX_`G

g4h U]ijG'[%kl\]PnmoGp \WqRqnU h [%moG h G�Y E G h Y E GrP�sXtXJ]tuJ=Lv\]U3w_o[�x�yXyuz{L|J]}+q`\]VXG�a

~7�����'���R�W�W� D#E G=QZP`Y'U h�h G�Y0[�_`a�G U]��q9UWQSPX[�G h a�Q^a�UWPRG UW�K[ E GCHIUuaj[7Y'UWHIHIUWP�acUX_ h YG�U]��eR_RVua�QSPQSHIqnG h \][�QS�WG{TS\WPRVW_`\WVWG�a'����P�[ E QSa�Y'UWPu[�G'�d[��o\]PdbI�dQZP`m7U]��ac[�\][�Q^Y{Y'UomoG�Y E G�Y��dQZP`V�Y'\Wq`\]e`TZG�U]��mRG[�G�Y0[�QZPRVq9U][�G'Pu[�Q^\]Toe`_RVXa4\][4YUWHIqRQSTSG#[�QSH+G�Q^a$�&G'T^YUWHIGX� D#E Q^a$q`\WqnG h q h G�a�G'Pu[�a$\�ac[�\�[�QSY#moG�eR_RVXVWQSPRV�[�G�Y E PRQSfu_RG��U h [ E G�moG[�G�Y0[�QZUXP�UW��QZPnYU h�h G�Y0[+\WY'Y'G�a�acG�a�[�U�HIG'HIU h b���mRG h G��G h G'PnYG�a�U]�%QSPd��\]TSQSm�qnUXQZPu[�G h a��0� D#E G\WP`\]TSboacG�m*TS\WPRVW_`\WVWGIQ^a�\Ca�_Re`a�G[�UW�{�{� D#E G7[�UdUWT4Q^a�en\Wa�G�m UWP¡\=aj[�\�[�Q^Y�\WP`\]TSboacG h G�d[�G�P`moG�m ��QZ[ E\Xa�a�G h [�QSUWPna¢QSP`a�G h [�G�m7QSP£[ E G�e9Uomob7UW�l[ E G�q h UXV h \]H��$¤�a�acG h [�QZUXP`a�\ h G{UW��[j�&UI�dQZP`m`a'¥

¦ aj[�\�[�QSY�\Xa�a�G h [�QSUWP`a#\W_o[�UXHI\][�Q^Y'\WTZTSb��WG h QZ§`G�m¨edb�[ E G�\]P`\WTZboa�G h �¦ mobdP`\]HIQ^Y�\Wa�acG h [�QZUXP`a¢[ h G�\][�G�m£\Wa�\Xa�a�_RHIqo[�QZUXP`a#edb�[ E G�\WP`\]TSboacG h �

D#E G�[�G�Y E P`QSfu_RGImoG�\WTSaK��QZ[ E mobdP`\WH+Q^Y'\WTZTSbC\]TSTSUdY�\�[�G�m=m`\�[�\£ac[ h _`Y0[�_ h G�aK\]P`m�Q©[�Q^a�\WY�Y_ h \�[�G�G�PRUW_RV E[�U E \]P`mRTZG�Y'Q h Y_RT^\ h ac[ h _`Y0[�_ h G�a��ª «u¬@­�®�¯ ��°��W� aj[�\�[�Q^Y£moG'eR_`VWVWQSPRVn�¢ac[�\�[�QSY�\WP`\]TSboacQ^a'�±q h UXV h \]H²�WG h QZ§nY�\�[�QSUWPl�4mR\]PRVXTZQSPRV q9UWQSPX[�G h a'�\Xa�a�G h [�QSUWP¨e`\Wa�G�m£moG�eR_RVWVXQZP`V`�R³%Uu\ h G{TSUWVXQSY

´^µ+¶·�¸º¹�» ¶·{¼�½S¸¿¾ºÀÁ

Â4ÃÄ�ÅÆÃ0ÇÆÈ�É�ÊÌ˺ÊÌͺÄ�Î ÏSË

Unite de recherche INRIA RennesIRISA, Campus universitaire de Beaulieu, 35042 RENNES Cedex (France)

Telephone : (33) 02 99 84 71 00 – Telecopie : (33) 02 99 84 71 71

Page 5: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

����{����������� l���������7��� �1���������������!�� ,� " ������%�&������ �% ������������ � ���+�'�+�$������ ���� ��'�% - 3�$�4���&�$�����%

�� �+� � ��%�% � ��%�%���� ��/��%

��« �� � �« � k�� _o[�QSTZQ^a�\�[�QSUWP�QSP`Y'U h�h G�Y0[�GCmRGCqnUXQZPu[�G'_ h a�G�aj[7_`PRG�moG�a7a�UW_ h YG�a�m�� G h�h G�_ h a�TZG�a�qRTS_`ah OG�q`\]P`mR_RG�a�m`\]P`a7TZG�a�T^\]PRVu\]VWG�a�QSH+q#OG h \�[�Q©��a����{\WP`a£YG�Y'UWPu[�G'�d[�GW�#[�UW_o[£�±OG h Q©§9Y'\�[�G'_ h ac[�\][�Q^fu_RG�moGY'UomoG�Y'\Wq`\]e`TZG�moG�m¢OG[�G�Y[�G h moG�a�G h�h G�_ h a#q9U][�G'Pu[�QSG'TSTSG�a F\ITS\�Y'UWHIqRQSTS\][�QSUWP G�aj[�e`QZG�Pu�XG'Pd_3�%�¢G[K\ h [�Q^YTSGq h OG�acG�Pu[�G$_RPRG$[�G�Y E PRQ^fu_RG±moG4m&OG'e9UWVu\]VWG$ac[�\�[�QSfu_RG±qnUX_ h T^\�m¢OG[�G�Y[�QSUWP�m�� \WY'Y FG�a9QSP`YU h�h G�Y[�a F\#T^\�H�OG'HIUXQ h G� m&OG h OG'��OG h G'PnYG�a@moG±qnUXQZPu[�G�_ h a3QSPu��\WTZQ^moG�a��0�$k3G±TS\WPRVX\WVWG4YUXP`a�QSm&OG h OG�G�aj[�_RP�a�UW_`a��¿G'P`a�G'H�eRTZG4mRG#�{�Æk�� UW_o[�QZTG�aj[�e`\XaoOG�a�_ h _RP \]Pn\]TSbda�G'_ h ac[�\][�Q^fu_RG�OG[�G'P`mR_¨q`\ h moG�a�\Xa�a�G h [�QSUWPna&fu_RQ�acUXPX[%moG�moG�_o�7[jbdq9G�a�¥

¦ TZG�a%\Wa�a�G h [�QSUWP`a#ac[�\�[�QSfu_RG�a�fu_RQ3acUXPu[#�¢OG h QZ§�OG�G�a&\]_o[�UWH�\�[�QSfu_RG�HIG'Pu[�q`\ h T�� \WP`\]TSboacG�_ h �¦ TZG�a%\Wa�a�G h [�QSUWP`a E bdqnUW[ E OG'[�Q^fu_RG�a#fu_RQla�UWPu[#[ h \]QZ[ROG�G�a#YUXHIH+G�moG�a E buq9U][ E3FG�acG�a¢qn\ h T�� \WP`\]TSboacG�_ h �

k�\�[�G�Y E PRQ^fu_RG�q h G�P`m�G�P¨Y'UWHIqo[�G�TSG�a#aj[ h _nY0[�_ h G�a¢moGKmoUXPRP#OG�G�a&\]TSTZUX_&OG'G�a±mobdP`\WHIQSfu_RG�H+G�Pu[&G'[&G�TZTSG{G�aj[a�_���a�\]HIHIG'Pu[�q h OG�YQ^a�G{q9UW_ h [ h \WQ©[�G h TSG�a�ac[ h _`Y0[�_ h G�a�YQ h Y_RT^\]Q h G�a'�� ¯ ��� ­ ��� �« � m&OG�enUXVX\WVWG�ac[�\�[�QSfu_RGX�4\]P`\WTZboa�G7ac[�\�[�QSfu_RGX���±OG h Q©§9Y'\�[�QZUXP¡moG7q h UXV h \]HIHIG�a���q9UWQSPu[�G'_ h aq9G'PnmR\]Pu[�a��Rm&OG�enUXVX\WVWG�q`\ h \Wa�a�G h [�QSUWP`a��dTZUXVWQ^fX_`GKmRG�³%UX\ h G

Page 6: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

����������� ����� ��� ��������������� � � � ��!#"%$&'���(�)���*��+�,���-�.�+���/���%�#�%�0� �+�)"1���2�3�3�%�4�)"0��56�7 �����8"0���0�.�%�*�4� �0" t

9 : �+�����7C���&�$��+�

D#E G�HIUW[�QS�Æ\][�QSUWP£��U h [ E G��&U h ��moG�a�Y h QZe9G�m¨QSP¨[ E Q^a�q`\]q9G h Y'UWHIG�a&� h UWH [ ERh G'GKUXe`acG h ��\][�QSUWP`a�¥¦<; UXac[K��QSmoG�TZb _nacG�mCq h UWV h \WH+HIQSPRV�T^\]PRVX_`\]VXG�a�\]TSTZU���G'�oqRTZQ^YQZ[KqnUXQZPu[�G h HI\WPRQSqR_RT^\�[�QSUWPna'� D#E GG�oq h G�a�acQS�WG�PRG�a�a�q h U��uQ^moG�m�edb�a�_`Y E ��G�\�[�_ h G�a$QSa�\WqRq h G�Y'QS\][�G�m�edb�H�\]Pdb�q h UWV h \WHIH+G h alenG�Y'\W_`acGQ©[%H�\W�WG�a#q9UXa�a�QZeRTSG�[�U�H�\Wac[�G h TZU�� TZG��WG�T3moG[�\]QSTSa�\WenUX_o[%HIG'HIU h b7\]TSTSUdY�\�[�QZUXP£\WP`m h G'_nacGX�$³�U ��¢G��WG h ��[ E G�G�oqRTSQ^YQZ[4_`acG#UW�9q9UWQSPu[�G h a�Y'\WP�e9G%fu_RQZ[�G%a�_Reo[�TSG%\]Pnm�G h�h U h q h UWPRGX���¿[4Q^a$�&G'TSTR�dPRU���P[ E \][%UWPRGKUW��[ E G�HIUXac[�Y'UWHIHIUWP�acUX_ h YGKU]��eR_RVXa%QZPC��Q^a#[ E G�QZPnYU h�h G�Y0[#_`a�GKU]�$qnUXQZPu[�G h a��

¦ ��bdP`\WHIQSYKmoG�eR_RVWVXQZP`V�[�UuUXTSa#\ h G{�WG h b�\WY�Y_ h \�[�G%[�U+TSUoY'\][�G�G h�h U h a±QZP£q h UWV h \]H�a¢enG�Y'\W_`acG{[ E G'bE \Æ�WG&\WY�YG�a�a [�U%[ E G¢G'�R\WY0[$aj[�\�[�G±U]�`[ E G¢H+G�HIU h bW� D#E G'Q h �&G�\W�uP`G�a�a3Q^a3[ E \�[�[ E G�b�\ h G4G�oG�Y_o[�QZUXPmoG'q9G'PnmoG'Pu[&\WP`mIQZ[±QSa±PRU][¢qnUua�a�QZe`TZG%QSP�VWG�PRG h \]TR[�UK[�G�aj[#\]TSTRG�oQ^aj[�QZP`V�G�oG�Y'_o[�QSUWPna�U]�3\�q h UWV h \WH��= P [ E G�UWq`qnUuacQZ[�GX�9ac[�\][�Q^Y�YUomoG�Y E G�Y��XG h a�qnG h ��U h H-\]P G'� E \]_`ac[�QS�WG��WG h QZ§nY'\][�QSUWP U]��q h UWV h \WH�a\�[�[ E G�YUuaj[�U]�$acUXHIGK\WqRq h UÆ�oQZH�\�[�QZUXP`a��

¦ ��P7moG�eR_RVWVXQZP`V`�d\���QSmRG�a�q h G�\Wm+[�G�Y E PRQ^fu_RG�Q^a±[ E G{_`acG{U]�3\Wa�a�G h [�QSUWP`a±QZP`a�G h [�G�mIQZP�[ E G{enUomob�UW� \q h UWV h \]H [�U�a�qnG�YQZ��b¨QZ[�a�G'�oqnG�Y0[�G�m�enG E \Æ�dQZU h � D#E G�QZHIq9U h [�\WP`YG�UW��\Xa�a�G h [�QSUWPna¢QSPCmoG�eR_RVWVXQZP`VQSa�mRQSa�Y_`a�a�G�m�QSP�>©x�z@?º�BA�G h QZ§nY'\][�QSUWP�UW�n\Wa�a�G h [�QSUWP`a�QSa�VXG'PRG h \WTZTSb�moUWPRG&edb�\�[ E G�U h G'H�q h U��WG h \]PnmY'\WPCenG+\��XG h b�[�QSHIG+Y'UWP`a�_RHIQSPRV�[�\Xac�@��¤�P=QSHIqnU h [�\]Pu[{Y E \WTZTSG'PRVXG�Q^a%[�U�§`P`m�\�YUXH+q h UXH+Q^a�GenG'[j�¢G�G'P [ E G7G'�dq h G�a�a�QZ�XG'PRG�a�aKUW�#[ E G£\]P`\WTZboa�G�m*q h UWq9G h [�QSG�a�\WP`m*[ E G7H+G�Y E \]P`QSa�\�[�QZUXP*UW��[ E G\]P`\WTZboa�QSa��

D#E G=VWUu\]T%UW��[ E G=[�G�Y E PRQ^fX_`G�moG�a�Y h QSenG�m QZP [ E Q^a7qn\]q9G h QSa�[ E G moG[�G�Y[�QSUWP�U]��QSP`Y'U h�h G�Y0[7HIG'HIU h b\XY'Y'G�a�acG�a�[ ERh UW_RV E moG h G��G h G�P`YQSPRV�QSPd�Æ\WTZQ^mIq9UWQSPX[�G h a'��¤�q9UWQSPu[�G h H�\Æb�e9G%QSPd�Æ\WTZQ^m�e9G�Y�\]_`a�G�Q©[ E \Wa±PRU][e9G'G�P QZP`Q©[�QS\WTZQ^acG�m£U h e9G�Y�\]_`a�G�Q©[ h G'��G h a#[�U�\�HIG�H+U h b7TZUoY'\][�QSUWP�� E Q^Y E E \Wa%enG�G'PCmoG�\]TSTZUoY'\][�G�m � D#E GH�\WQZP¨��G�\][�_ h G�a#UW��[ E G�moG'e`_RVWVXQZPRV+[�G�Y E PRQ^fu_RG�moG�a�Y h QSenG�m¨QSP¨[ E Q^a�q`\WqnG h \ h G{[ E GK��UWTSTSU���QZPRVn¥

¦ �¿[%QSa�\]eRTSG�[�U�moG[�G�Y[�QZPnYU h�h G�Y0[#_`a�GKU]�$qnUXQZPu[�G h a#��QZ[ E QZP h G�Y_ h a�QZ�XG�m`\�[�\Iac[ h _`Y0[�_ h G�a��¦ �¿[%QSa���U h HI\WTZTSb�e`\XacG�m¨UXP£\���P`\�[�_ h \WT^�¢UXqnG h \][�QSUWP`\WT3acG�HI\WPu[�Q^Y'a&U]��[ E G�T^\]P`VW_`\WVWGW�¦ �¿[%U�C@G h a�\]P£QZPu[�G h \WY0[�QZ�XG�\Wa�acG h [�QZUXP��ºen\Wa�G�m�QSPu[�G h ��\WY'G�[�U+[ E G�_nacG h a��D#E Q^a%Y'UWPu[ h \Wac[�a¢��U h QSP`ac[�\WP`YGK��QZ[ E2D.E@F4G >Zx�t6?3� E QSY E�h G[�_ h P`a#�#\ h PRQSPRVXa#Y'UWP`Y'G h PRQZP`V�[ E G�_`a�G�UW�

_`PRQZP`Q©[�QS\WTZQ^acG�m*�Æ\ h Q^\]e`TZG�a{e`_o[�moUdG�aKP`U][�Y E G�Y��=moG h G��G h G�P`YG�a�U]�#qnUXQZPu[�G h aKQSP h G�Y_ h a�QZ�XG+mR\][�\ ac[ h _`Y �[�_ h G�a�� D U�UW_ h �uP`U���TZG�moVWGX�]PRU���U h H�\]TRmRG§`PRQZ[�QSUWP�UW�@[ E G D.E�F4G Y E G�Y��WG h�E \Wa�e9G'G�P�qR_ReRTSQSa E G�mIG'QZ[ E G h �

= ��Y'UW_ h a�G�PRUIaj[�\�[�QSY�qnUXQZPu[�G h \]P`\WTZboa�QSa&Y'\WP�enGKYUXHIqRTZG'[�GK\]P`m7�¢GKmoG�YQ^moG�[�U�G h�h UWP�[ E GKYUXP`acG h ���\][�QS�WG�a�QSmoGX¥4�&G�a E U��)[ E \][%[ E G�G�oG�Y'_o[�QSUWP�UW�$\Iq h UWV h \WH [ E \][ E \Xa�q`\Wa�a�G�m¨UW_ h Y E G�Y��dQZP`V+q h UoYG�a�aY�\]PRP`U][�TSG�\Xm*[�U=\WP¡QZPnYU h�h G�Y0[�q9UWQSPu[�G h moG h G'��G h G'P`Y'GW� D#E G h G�fu_RQ h G�m \]q`q h UÆ�oQSH�\�[�QSUWP HIG�\WP`a�[ E \�[UX_ h Y E G�Y��WG h Y'\WP h G'[�_ h P¨�#\ h PRQSPRVXa#Y'UWP`Y'G h PRQZP`V+a�\���GKq h UWV h \WHIa��

H �WG'P QZ��Q©[IY'\]P`PRU][�e9G7YUXHIqRTZG'[�GX�$a�_`Y E \£[�UdUXT±H�_naj[�e9G7\Xa�\WY�Y_ h \�[�G�\Wa�q9UXa�acQSeRTSGW� D#E G�_`a�G h�&UW_`TSm+U][ E G h ��Q^acG�e9G�a��&\WH+q9G�mI��QZ[ E a�qR_ h QSUW_`a��#\ h PRQSPRVXa�\WP`m+[ E G�[�UdUWTn�¢UX_RT^m�e9G%UW�@TSQZ[c[�TSG E G'TSq3�$��Pqn\ h [�Q^Y_RT^\ h ��[ E G¢[�UdUWTdH�_`aj[�e9G&\WeRTSG±[�U h G[�_ h P�_`a�G��_RTdQSPo��U h H�\�[�QSUWP+\]e9UW_o[ h G�Y_ h a�QZ�XG±mR\][�\�aj[ h _`Y[�_ h G�aQSP£[ E G E G�\]ql� D �¢U�a�QZVXPRQ©§9Y'\]Pu[#��G�\][�_ h G�a#UW��UX_ h Y E G�Y��WG h ��QZ[ E�h G�a�qnG�Y0[�[�U�mR\][�\�ac[ h _`Y0[�_ h G�a�\ h G�[ E G��UXTZTSU���QSPRV`¥

IJI ÇLK@M0N0M0N

Page 7: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

� � �+������� �+� � ���

¦ �¿[¨Q^a¨\WeRTSG [�U�[ h G�\�[ h G�Y_ h acQS�WGCm`\�[�\�aj[ h _`Y[�_ h G�a7QZP \ PRUWP)_RPRQZ��U h H �#\Æb<��QZPnmoQSY�\�[�QZPRVn�#��U hG�R\]HIqRTSGW�u[ E \�[%\�q9UWQSPu[�G h ��\ h Q^\]eRTSG�� h G��G h a±[�U�[ E G�[�\]QST9UW�3[ E G{TSQSac[�� E Q^Y E Q^a&\WTSa�U�q9UWQSPu[�G�m�[�Uedb¨\]P`U][ E G h ��\ h QS\WeRTZG��R�0�

¦ �¿[±Q^a4\]eRTSG#[�U E \]P`mRTZG%Y'Q h Y_RT^\ h TSQ^aj[�a���Q©[ E UW_R[±QZPu[ h Uomo_`Y'QZP`V�acqR_ h QSUW_`a�\WTZQ^\Wa�G�a$e9G[j�&G'G�P�moQ C9G h G�PX[\WmRm h G�a�a�G�a&QSP¨[ E G�TSQSac[��

� _`Y E \WY�Y_ h \WY'b E \Wa&\�q9U][�G�Pu[�Q^\]TSTZb E QSV E YUWHIqR_R[�\�[�QZUXP`\]T@YUuaj[�����P¨U h moG h [�U+moG�a�QZVXP7\ h G�\]TSQSac[�Q^Y#[�UdUXT ��&G E \Æ�XG¢[�U�§`P`mI\�Y'UWHIq h UWHIQ^acG#e9G[j�&G'G'PIG ��Y'QZG�P`YbI\]Pnm+\XY'Y'_ h \XYbX�*G�Y E UdUXa�G�\��`G�oQSeRTZG%a�UWTS_o[�QZUXPedb*U�C@G h QZP`V=\]P QSPu[�G h \WY[�QS�WG�QSPu[�G h ��\XYG�[�U [ E G¨_`a�G h � D#E G7QSPu[�G h \WY[�QSUWP Q^a�e`\XacG�m UWP [j�&U �dQZPnmRa�UW�\Xa�a�G h [�QSUWPna'¥

¦ aj[�\�[�QSY�\Wa�acG h [�QZUXP`a4� E UXa�G�Y'UWP`a�QSac[�G�P`YbI��QZ[ E¨h G�acq9G�Y[¢[�U�[ E G{q h UXqnG h [�QZG�a±QSPo��G h�h G�m�edbI[ E G�\WP`\ �TZboa�G h Q^a%\]_R[�UWH�\][�Q^Y'\]TSTSb��WG h QZ§`G�m �R\WP`m

¦ mobdP`\]HIQ^Y±\Xa�a�G h [�QSUWP`a9[ h G�\�[�G�m�\Wa�\WmRmRQ©[�QZUXP`\]T E bdq9U][ E G�a�G�aleub{[ E G¢\]Pn\]TSbda�G h \WP`m��XG h Q©§`G�mKmo_ h QZPRVq h UWV h \]H G'�oG�Y_R[�QSUWP3�

� _`Y E \�a�UWTS_o[�QZUXP¨q h G�a�G'Pu[�a&a�G'�XG h \]T \WmR�Æ\WPu[�\]VXG�a�¥¦ D#E GI_`a�G h Y'\WP=HIUomoQ©��bC[ E G+[ h \WmRG��¿U�C enG'[j�¢G�G'P=G ��YQSG'P`Y'b=\]P`m�\WY�Y_ h \WY'bW�� RU h G�R\]HIqRTSGW� E GH�\Æb7moG�Y'QSmRGK[�U�ac�dQSq£[ E G�\WP`\]TSboacQ^a&U]��\�qn\ h [#UW�l[ E G�q h UWV h \]H��

¦ ��bdP`\WHIQSY�\Wa�acG h [�QZUXP`a4q9G h HIQ©[&[�U�G'P E \]P`Y'G%[ E G�\XY'Y_ h \XYb+U]� [ E G�\WP`\]TSboacG h edb�\WmRmoQSPRV�q h UXqnG h �[�QSG�a#[ E \�[�Y�\]PRP`U][�enG�QSPo��G h�h G�m¨edb�[ E G�\WP`\]TSboacG h �

¦ � [�\][�Q^Y�\Wa�acG h [�QZUXP`a#\ h GK_`acG'��_RT [�U+TSUoY'\][�GKq h G�YQ^a�G'TSb7\]P£G h�h U h moG[�G�Y0[�G�m£edb�[ E G�\]P`\WTZboa�G h ���P¡a�G�Y[�QSUWP¡Jo���¢G�e h QSG��`b�q h G�acG�Pu[�[ E G7\WP`\]TSboacG h [ E \�[���U h HIa�[ E G�e`\XacQ^aKU]��UX_ h moG'e`_RVWVXG h \]Pnm

h G�Y�\]TSTl[ E GIH�\]QSP h G�a�_RT©[�a'��¤�TZVXU h Q©[ E HIQSY+YUXP`YG h Pna{\ h G+moQSa�Y_na�a�G�m=QZP acG�Y0[�QZUXP=tR� D#E G�G'�u[�G'P`a�QSUWP=UW�[ E G7\WP`\]TSboacG h ��QZ[ E \Xa�a�G h [�QSUWPnaKQSa�mRG�a�Y h QZe9G�m QSP acG�Y0[�QSUWP � �£¤ mobdP`\WHIQSY��XG h Q©§9Y'\�[�QZUXP�UW�#mRbuPn\]HIQSY\Xa�a�G h [�QSUWPna�Q^a�moG§nPRG�m=[�U£TZU��&G h [ E G h Q^ac� UW�¢G h�h U h a�[ E \�[ E \Æ�XG�q`\Xa�a�G�mC[ E G�ac[�\][�Q^Y+Y E G�Y��dQZP`V7q E \XacGmR_RG%[�U�[ E G�QSPX[ h Uomo_nY0[�QSUWP7U]�3� h UWPRV�\Xa�a�G h [�QSUWPna'� � UWHIG�G'�R\]HIqRTSG�a4QSTSTZ_`ac[ h \�[�QZP`V�moQ C9G h G�Pu[&moG�eR_RVWVXQZP`Va�YG�P`\ h QSUXa�\ h G VWQS�WG�P�QZP a�G�Y[�QSUWP��R� � G�Y[�QSUWP } h G'�dQSG'�%a h G'T^\�[�G�m �&U h ��\]P`m)acG�Y0[�QSUWP)z a�_RVXVWG�ac[�a\Æ�XG'Pd_RG�a±��U h ��_ h [ E G h%h G�acG�\ h Y E � D#E G�YUXHIqRTZG'[�G�moG'§`PRQZ[�QSUWP�U]��[ E G�\]P`\WTZboa�G h moG�a�Y h QSenG�m£QZP a�G�Y0[�QZUXP�J\WP`m7[ E G�\We`aj[ h \XY0[�acbdPu[�\]�7\]P`m£mobdP`\WH+Q^Y�a�G'H�\]Pu[�Q^Y'a&UW�l[ E G�ac_RenacG'[#UW�4� YUXP`acQ^moG h G�m�QSP¨[ E Q^a#q`\]q9G h\ h G�VX\][ E G h G�m7QSP£[ E G�\WqRq9G'P`moQZ� �

� �¨�*�%�%���C����������.��� �2 l�����$�'������� ���¨ ��%�

klG[&_`a�§ h ac[ h G�Y'\WTZT`[ E G�aj[�\�[�QSY{\]P`\WTZboa�QSa4mRG�a�Y h QZe9G�m�QSP2> �6?¿�uQZ[�a¢q9UXa�acQSeRQSTZQZ[�QSG�a¢QZP¨aj[�\�[�Q^Y%moG�eR_RVXVWQSPRV�\]Pnm[ E G�H�\WQZPCY'U h�h G�Y0[�P`G�a�a h G�ac_`T©[�a'� D#E G�VWUu\]T3UW��[ E G+\]P`\WTZboa�QSa�Q^a�[ E G�mRG[�G�Y0[�QZUXPCU]��q9UWQSPX[�G h a%G h�h U h a�QSPq h G�acG�P`YG#U]� h G�Y_ h a�QZ�XG�mR\�[�\�aj[ h _`Y[�_ h G�a�� D#E G%G�R\]HIqRTSG�a$QSP� �QZVX_ h G�x%\WP`m� �QZVX_ h G�J�QSTSTZ_`ac[ h \�[�G%acUXHIGUW��[ E G+q9UXa�acQSeRQSTZQZ[�QSG�a�U]��[ E GI\]P`\WTZboa�G h �� `U h QZP`ac[�\WP`YGX�@QZP� �QSVW_ h G¨xW�9[ E G+\]P`\WTZboa�G h QSaK\]e`TZG�[�U£q h U��XG[ E \�[±[ E G�moG h G��G h G�P`YG�UXP�����QZ[ E QSP�[ E G���� E�D! �ºTSUdUWqIQSa¢\]TS�&\Æboa�Y'U h�h G�Y0[±mo_RG%[�U�[ E G{Y'UWP`moQZ[�QSUWP��#"%$ G �

&('BI)&+*

Page 8: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

����������� ����� ��� ��������������� � � � ��!#"%$&'���(�)���*��+�,���-�.�+���/���%�#�%�0� �+�)"1���2�3�3�%�4�)"0��56�7 �����8"0���0�.�%�*�4� �0" �

D#E G%G h�h U h UWPI[ E G{mRUW_ReRTSG{mRG h G��G h G'PnYG%UXP���Q^a¢mRG[�G�Y0[�G�m�e9G�Y�\]_`a�G�[ E G�q h UWq9G h [jb � $ G Q^a±[ h _RG�\�[¢[ E GG�P`m�U]�4[ E GITZUdUWql����P �QSVW_ h G�Jo�@[ E G�a�\WH+G+q h UWV h \WH Q^aK\]qRq`TZQSG�m�UWP*\¨Y'Q h Y_RT^\ h TSQSac[�����P=[ E Q^a�Y'\Wa�GW�[ E G�\]Pn\]TSbda�G h Q^a�\]eRTSG�[�U�q h U��WG{[ E \�[�[ E G�� E UWTSGKq h UXV h \]H Q^a%YU h�h G�Y[

��

G

���� �� �

�!� E D! �� � "%$ G������� $� � � F � G�� � � ¯ �Æ� « �W��° « � «��¿« � «�� � «�

� $� � � � F � G�� � F � G�� ����� � ¯ ��� « �]��° « � «��¿« � «�� � «

�QZVX_ h GIxX¥��¿[�G h \�[�QZUXP¨UXP£\ITSQSac[

��

G

���� �� ���

��� "!# $�!� E D! �� � "%$ G�

������ $� � � F � G�� %�¯ �Æ� « �]�'&�� ¯�( ��� ��

� $� � � � F � G�� � F � G��

�QZVX_ h G�JR¥��¿[�G h \�[�QZUXP¨UXP£\�Y'Q h Y_RT^\ h TSQSac[D#E G¨\]P`\WTZboa�G h Q^a�moG§nPRG�m ��QZ[ E h G�a�qnG�Y0[�[�UC\�P`\�[�_ h \]T4UXqnG h \][�QSUWP`\WT4acG�HI\WPu[�Q^Y'a�UW�#\ a�_Re`a�G[�UW�

�{� D#E GCT^\]PRVX_`\]VXG�QZP`Y'TZ_nmoG�a£aj[�\]P`m`\ h m���G�\�[�_ h G�a�U]��� ��\Xa�a�QSVWPRHIG'Pu[�a'��YUXP`moQZ[�QSUWP`\WT � ��� E D �ºTSUdUWqn�\WP`m \]T^a�U QZP`ac[ h _`Y[�QSUWP`a h G'T^\�[�QZ�XGI[�U [ E G¨mRbuPn\]HIQSY7\]TSTZUoY'\][�QSUWP \]Pnm moG�\WTZTSUoY'\�[�QZUXP U]��HIG'HIU h b�Y'G'TSTSa�*) D�D�+-, \]P`m/.�0 � �0� D#E GIa�bdPu[�\��C\WP`m�a�G'H�\WPX[�QSY�a�U]�4[ E GIq h UXV h \]HIHIQZP`V�TS\WPRVW_n\]VWG+YUXP`acQ^moG h G�mCQSP[ E Q^a�q`\WqnG h \ h G¨q h U��uQ^moG�m QZP �QSVW_ h G=x � \]Pnm �QZVX_ h GCx�}=QZP [ E G�\]qRq9G'P`mRQ©� ���G£_`a�G�[ E G¨G'�oY'G'q��[�QZUXP ��\]TS_RG E D�D! 21 ) D [�U=moG�PRU][�GI[ E G h G�ac_RTZ[�UW��\ Y'UWHIqR_o[�\�[�QZUXP*QSPd�WUXTZ�dQSPRV�[ E G¨moG h G��G h G�P`YG�UW�#\WP

IJI ÇLK@M0N0M0N

Page 9: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

} � �+������� �+� � ���

QSPd��\]TSQSm*q9UWQSPX[�G h � D#E G�T^\]PRVX_`\]VXGIY'UWP`a�Q^moG h G�m E G h G�moUdG�a�P`U][�QSP`YTS_`moG�q h UoYG�mo_ h GIY�\]TSTSa�\WP`m*VWUW[�UXae`_o[�enUW[ E \ h G£[ h G�\�[�G�m QZP [ E G���_RTZT��WG h a�QZUXP¡U]��[ E G \WP`\]TSboacQ^aImoG�a�Y h QZe9G�m QSP >Ìz@?¿� �GC\WTSa�U�QSVWP`U h G\ h QZ[ E H+G'[�Q^Y£UWq9G h \�[�QSUWPna�UXP q9UWQSPu[�G h a�\WP`m��&G \Wa�ac_`H+G£[ E \�[�UXPRTZb�UWPRG£§`G�TSm U]��\ h G�YU h m�Y�\]P enGUW�#[jbuq9G7q9UWQSPu[�G h � �{_RG7[�UC[ E Q^a�a�QZHIqRTSQZ§nY'\][�QSUWP3�$�&G¨Y'\WP UWHIQZ[�[ E G�§`G�TSm Pn\]HIG�a�QZP�\XY'Y'G�a�a�Y E \WQZP`a��QZ[ E UW_o[�\]H�eRQZVX_RQZ[jbC��� h Q©[�QZPRVn�u��U h QZPnaj[�\]P`Y'GW�����I��U h �� � ,�� 0+QZ���IQSa#\���\ h QS\WeRTZG�U]�l[jbuq9G D.E+G ��QZ[ ED.E+G $ +G 0� ,6G , )20 � E@F4G ,�� 0 � D.E+G �0�D#E G±§ h aj[�q`\ h [�UW�o[ E Q^alqn\]q9G h QSa�YUXP`YG h PRG�mK��Q©[ E [ E G¢moG'§`PRQZ[�QSUWP�U]�o[ E G¢\]Pn\]TSbda�G h �3�¿[$QSa�q h G�a�G'Pu[�G�m

\Xa�\�a�qnG�YQ^\]TSQSa�G�m�³%UX\ h G¢TZUXVWQ^Y���U h Y'UWPRP`G�Y0[�QZ�dQZ[jb�\]P`m�\]TSQS\XacQSPRV{q h UXqnG h [�QZG�alUW�`q9UWQSPX[�G h a'� D#E G�acG�fu_RG'Pu[�a\ h G{[ h QSqRTZG'[�a �� ��� �� � � E G h GW¥

¦ � QSa�\Iac[�\�[�G'HIG'Pu[%UW��[ E G�\]P`\WTZboa�G�m¨q h UXV h \]H��¦ � Q^a&\�q h G���YUXP`moQZ[�QSUWP�G�oq h G�a�a�G�m�edb�\�TSUWVXQSY�\]Tn��U h H�_RT^\�UW�lUW_ h T^\]PRVX_`\]VXG%U]��q h UXqnG h [�QZG�a g±h UXq��moG'§`PRG�m�enG�TZU�������¿[�Y E \ h \WY0[�G h QSa�G�a±[ E G�aj[�\�[�G�UW�l[ E G�HIG'HIU h b�e9G��U h G�[ E G�G'�oG�Y_R[�QSUWP�U]� � �

¦ � Q^a�\{qnUuaj[ �¿Y'UWP`moQZ[�QSUWP�QZP�[ E G#a�\]HIG�a�buPu[�\���\Wa � ���¿[4Y E \ h \WY[�G h Q^acG�a [ E G#ac[�\][�G#U]�n[ E G#HIG'HIU h b\�� [�G h [ E G�G�oG�Y'_o[�QSUWP£U]� � �

D#E G�Y'TS\Xa�a#UW��q h UWq9G h [�QSG�a g±h UXq¨Y'UWP`a�QSmRG h G�m¨QZP£[ E QSa#q`\WqnG h Q^a�moG§`P`G�m£QZP �QSVW_ h G�tR�

� ��� � ��������� � ����!���� �#"����$� %&�'�(%#� �)%*�,+-.%#�/� 0 ˺Å�È �21 Ä)3ÌͺÈ% ��� � 4657�)8 4957� B 495:�<;>= ?#@BA� C � ËED<FG %HC�I Ä�Ë

�QZVX_ h GKt`¥ � bdPu[�\��¨U]��q h UXqnG h [�QZG�a

��P7[ E GKacG�fu_RG'Tº�d�¢G{_`acG�[ E G��&U h mKJc��\ h Q^\]eRTSG&L�[�U+moG�PRU][�G�G�Q©[ E G h�MON�POQ#R U h \WP7\WY�YG�a�a±Y E \]QSP=� [ E \�[Q^a�[�U�a�\Æb+\WP�QSmRG'Pu[�QZ§`G h � UW� [ E G{q h UWV h \]H qnUua�a�QSeRTZb+q h G§R�oG�m�edb+\�a�G�fu_RG�P`YG{U]���KU h7S �0� g�h \WPRVWG�aU��XG h�g±h UXq3��� h \WPRVWG�a�U��WG h [ E G£moUWH�\WQZP U]�%��\ h Q^\]eRTSG�a A4\ h \WP`m MON�POQ#R aj[�\]P`m`a���U h [ E G7_RP`moG'§`PRG�mTSUoY'\][�QSUWP3�&¤�a�_`a�_`\WT �T���7moG�PRU][�G�a#[ E G���\]TS_RG�Y'UWPu[�\WQZP`G�m�\�[�[ E G�\Wm`m h G�a�aHU¨� E G h GVU7QSa%[ E G���\WTZ_RG�UW���W S ��Q^a#[ E G�\WmRm h G�a�a&U]�X�n� D#E GKa�_��I�oG�a�UW��\+��\ h QS\WeRTSGV� � \ h G�[ E G���\ h Q^\]eRTSG�a � \]Pnm S � �

D#E G�acG�H�\]Pu[�Q^Y'a±U]�3q h UWq9G h [�QSG�a±QSa&acq9G�Y'Q©§nG�mI[ ERh UX_RV E \�YU h�h G�a�qnUXP`moG'PnYG h G'T^\�[�QSUWPZY�[£��U h H�\WTZQ^acG�mQSP� �QSVW_ h G�xÆz%QZP�[ E G%\]qRq9G'P`mRQ©� � D#E QSa�a�G'H�\WPX[�QSY�a�QSa$q`\ h \WHIG[�G h Q^a�G�m���QZ[ E \KacG'[$UW�n��\ h Q^\]eRTSG�a]\_^ A4\ hY�\]TSTZG�m�[ E G � �������3�����3� "��%� QZP=[ E G+acG�fX_`G'Tº� D#E Q^a{q`\ h \]HIG[�G h Y'\]P=enG+_`a�G�m�[�U�[�_`PRG�[ E G+TZUXVWQ^YK[�U¨VWG[HIU h G4U h TSG�a�al\XY'Y_ h \][�G4\]Pn\]TSbda�G�a��)*G±QSHIqnUuacG¢UWPRTSb{UXPRG±Y'UWP`ac[ h \]QSPu[�¥,\�H�_`ac[�Y'UWPu[�\WQZPK[ E G¢a�_��I�oG�a3UW�\WTZTn[ E G���\ h Q^\]eRTSG�a¢\Wa�acQSVWP`G�m�QSP�[ E G{q h UXV h \]H-��\]Pnm�[ E G�\ h VX_RHIG'Pu[�a¢U]� .�0 � �� D#E G�Y'U h�h G�acq9UWPnmoG'P`Y'Gh G'T^\�[�QZUXP_Y [ � �/`�a$`cb,d � h G'T^\�[�G�a£aj[�\�[�G�a£U]��[ E G HIG'HIU h b [�U [ E G*q h UWq9G h [�QSG�a¨[ E G'b a�\�[�Q^ac��bW� D#E Gac[�\][�G�a#U]��[ E G�HIG'HIU h b7\ h GKq`\WQ h a�� a7`eb,d �&� E G h G a QSa�\WP£G�Pd�uQ h UWPRHIG'Pu[���Qº� GW�4\+��_RP`Y[�QSUWP�H�\]qRq`QZPRVQ^moG�PX[�Q©§nG h a$[�U�\XmRm h G�a�acG�a���W\]Pnm b,d Q^a±\�ac[�U h G���Qº� GW����_RP`Y[�QSUWP�H�\]qRq`QZPRV�\WmRm h G�a�a�G�a�[�U��Æ\WTZ_`G�a��c�0� D#E GQSPu[�_RQZ[�QSUWP�e9G E QSP`m¨[ E G�YU h�h G�a�qnUXP`moG'PnYG h G�TS\][�QSUWP£QSa&[ E GK��UWTSTZU���QSPRVn¥

¦ �Ofhg.��i E UWT^mRa�QZ��[ E G���\]TS_RG�UW�$�OfKQ^a�G�fu_`\]Tl[�U�[ E G���\WTZ_RG�U]�j��iX�%��PCq`\ h [�QSY'_RTS\ h ���Ofkg MON�PlQ>RHIG�\]Pna%[ E \�[{[ E G��Æ\WTZ_`G�U]�$�Of�QSa�\]P QSPd�Æ\WTZQ^m q9UWQSPu[�G h ��� E Q^Y E Q^a%[ E G�Y�\Wa�G�QZ�$�Of E \Xa%PRUW[{e9G'G�PQZP`Q©[�QS\WTZQ^acG�m£U h QZ�]� f q9UWQSPu[�a&[�U�\IY'G'TST3� E Q^Y E¨E \Xa#enG�G'P moG�\]TSTZUoY'\][�G�m7edb .�0 � ��

&('BI)&+*

Page 10: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

����������� ����� ��� ��������������� � � � ��!#"%$&'���(�)���*��+�,���-�.�+���/���%�#�%�0� �+�)"1���2�3�3�%�4�)"0��56�7 �����8"0���0�.�%�*�4� �0" z

¦ �Of��� ��i E UXTSmRa�QZ�±[ E GC��\XmRm h G�a�a�����\]TS_RG�UW�:��iIQ^aK\WY'Y'G�a�acG�m � h UWH-[ E GC��\XmRm h G�a�a�����\]TS_RGIU]�7�Of[ ERh UW_`V E \�[�TZG�\Wac[�UWPRG7TZG��WG'T¢U]��QSP`moQ h G�Y0[�QSUWP¡\WP`m PRU ��\Wm`m h G�a�a�����\]TS_RG7UW�%\ ��\ h QS\WeRTZG�UW��[ E Gh G'��G h G'P`Y'G{a�G[H\ \WqRq9G�\ h a¢QZP7[ E G�q`\�[ E � h UWH �Of�[�U ��i]� D#E G�TS\Xaj[�YUXP`moQZ[�QSUWP�Q^a#Y h _`YQ^\]T`��U h [ E G[ h G�\][�HIG'Pu[%U]��[ E G�\Xa�a�QSVWPRHIG'Pu[%YUXHIHI\WP`m �

klG[�_`a£PRU��-[�_ h P�[�U�[ E G*\]�oQZUXHI\][�Q^a�\][�QSUWP�QZ[�a�G'TZ�j� � q`\WY'G�Y'UWP`a�QSmRG h \�[�QSUWP�q h G��WG'Pu[�a7_`a7� h UWHq h G�acG�PX[�QZP`V�\]TST&[ E G a�boaj[�G'H QSP moG'[�\]QST���a�G'G �QZVX_ h G*x�yu�0� *G+ij_`aj[�Y'UWP`a�QSmRG h [ ERh G'G h _`TZG�a E G h G¨[�UY'UWPd�WG�b�acUXH+G{QZPu[�_RQ©[�QZUXP£\WenUX_o[&[ E GKTSUWVWQ^Y]¥�[ E G�Y'UWP`moQZ[�QSUWPn\]Tº�X[ E G�moG h G��G h G�P`YG�\]P`m�[ E G�\Xa�a�QZVXPRHIG'Pu[��

¦ �¢UWP`mRQ©[�QZUXP`\]Tº¥ D#E G+��\]TSQSmRQ©[jbCUW�4[ E GIa�G�fu_RG�Pu[ �� � E .{����� � f 4Dc � i �� � moG�qnG�P`mRaKUWP=[ E G��\]TSQSmoQZ[jb7UW�l[ ERh G�G�³%Uu\ h G�a�G�fu_RG�PX[�a'¥� �� � � �� � Y E G�Y��oa¢[ E G���\WTZQ^moQZ[jb�U]��[ E G�mRG h G��G'PnYG�a�\WqRq9G�\ h QSPRV�QSP£[ E GK[�G�ac[����`\WP`m� �� ��� f �� f � \WP`m *� ��� i �� i � YU h�h G�a�qnUXP`m+[�U�[ E G�\WP`\]TSboacQ^a4UW�3[ E G{[j�&U�e h \]P`Y E G�a4UW�[ E G�YUXP`moQZ[�QSUWP`\WT �

D#E G h _RTZG���U h YUWPnmoQ©[�QZUXP`\]T Q^a�� h Q©[�[�G�P3¥*� � � *� � *��� � ��� f �� f � *�� � ��� i �� i �*� � E .������ � f 4D� � i �� f�� � i �

�G�Y�\]P£��U h H�_`TS\][�G{[j�¢U h G'H�\ h �oa&\WenUX_o[�[ E QSa h _RTSGW¥

� [ E G=q9UXac[���YUXP`moQZ[�QSUWP U]��[ E G=Y'UWP`moQZ[�QSUWPn\]T�Q^a�[ E G�mRQSa�ij_RP`Y[�QSUWP UW��[ E G=q9UXac[���YUXP`moQZ[�QSUWP`a� f�\]Pnm � i�U]��[ E G�[j�&U7e h \]PnY E G�a�� D#E Q^a{QSa{enG�Y'\W_`acG�[ E GI\]Pn\]TSbda�G h Y'\WPRPRU][KmoG[�G h HIQZPRGac[�\][�Q^Y'\WTZTSb�� E Q^Y E e h \WP`Y E Q^a�VXUWQSPRV�[�UIenG�G'�dG�Y_o[�G�m �

� D#E G{[�G�ac[ �rQ^a&[�\]�XG'P¨QZPu[�U�\XY'YUX_RPu[¢QSP7[ E G�\]P`\WTZboa�QSa&UW�3[ E G�[j�&U�e h \WP`Y E G�a¢[ ERh UX_RV E [ E GUXqnG h \][�QSUWP_J � L�� E Q^Y E [ h \WP`aj��U h H�a%\7enUdUXTZG�\]P*� G'�dq h G�a�a�QZUXP�� QZPu[�U¨\�q h UXqnG h [jb � QSPg±h UXq3�� RU h G�R\WH+q`TZGX�@[ E G��<UWq9G h \�[�U h a���� \]P`m����&\ h G�[ h \]P`ac��U h HIG�m QSPu[�U�[ E G+TZUXVWQ^Y'\]TJ�\]P`m�LC\]P`m JcU h LCY'UWPRPRG�Y0[�QZ�XG�a�� = ��YUX_ h acGX� �,QSa+\]P \]qRq h UÆ�oQZH�\][�QSUWP¡\]Pnm Q©[ h G[�_ h P`aJ Dlh _RG*L�Q©�%PRU=qnUXQZPu[�G h QSPo��U h H�\�[�QZUXP¡Y'\]P e9G7G'�d[ h \WY0[�G�m � D#E G£YUXH+q`TZG'[�G7moG'§`PRQZ[�QSUWP¡UW�[ E GK[ h \]Pnaj��U h H�\�[�QZUXP J � L+QSa�VXQZ�XG'P£QZP �QSVW_ h G�Jox�QZP£[ E G�\]qRq9G'P`mRQ©� �

¦ ��G h G'��G h G'P`Y'GW¥ �� � � � *� � Q©� ����� � ��� g MN�PlQ>R �D U¨Y E G�Y��7[ E G��Æ\WTZQ^moQZ[jb¨UW�4\�moG h G��G h G�P`YG ���n�nQ©[�QSa{ac_ ��Y'QZG�Pu[%[�U�q h U��XGK[ E \][ ���¨QSa�PRU][�G�fu_`\]T[�U+[ E G�_RP`moG'§`PRG�m£��\]TS_RG MN�POQ#R QZP£[ E G�q h G �¿Y'UWP`moQZ[�QSUWPl� D#E G��XG h Q©§9Y'\�[�QZUXP7Q^a�\WY E QSG'�XG�m7�uQ^\�[ E Gq`\ h [�Q^\]T U h mRG h#h G�TS\][�QSUWP � � E Q^Y E Q^a%moG'§`PRG�m¨QSP �QZVX_ h G+x �+QSP£[ E G�\WqRqnG�P`moQZ� �

¦ ¤�a�acQSVWP`H+G�Pu[�¥*� � �Of *� � �� � ��i �� � ��� � > > ��i����Of3? ? [�*� � �Of�$O��i �� �

D#E G h _RTSG{Y'U h�h G�acq9UWPnmoQZP`VK[�U�[ E G�\Wa�acQSVWPRHIG�PX[#Y'\XacG%Q^a&edb���\ h [ E G�HIUuaj[�moG'TSQ^Y'\�[�G%[�U�moG'§`PRGW���¿[PRG'G�mRa&\�PRUW[�QSUWP�U]�la�_Re`ac[�QZ[�_R[�QSUWP�� E Q^Y E H�_`aj[ E \]PnmoTZG�acq9G�Y'Q©§9Y���G�\][�_ h G�a±U]�3UX_ h T^\]PRVX_`\]VXG�TZQS�WG\]TSQS\XacQSPRV=\WP`m YUXPRPRG�Y0[�QS�dQ©[jb e9G[j�&G'G�P qnUXQZPu[�G h ��\ h Q^\]eRTSG�a�� D#E G£YUWHIqRTSG[�G¨moG'§`PRQZ[�QSUWP¡UW��[ E G

IJI ÇLK@M0N0M0N

Page 11: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

� � �+������� �+� � ���

ac_`e`aj[�Q©[�_o[�QSUWP > > ��i ���Of3? ? [� Y'\WP enG���UW_RP`mCQZP �QSVW_ h G�J � QZP [ E G�\WqRqnG�P`moQZ� � p UW_`V E TSb£a�q9G�\]�dQSPRV`�� > > ��i ���Of)? ? [� E UXTSm`a4QZ� � E UWT^mRa4� E G'P�\]TST`UoY�Y_ h�h G�P`YG�a�U]�T�Of���\]Pnm�Q©[�a4QSPRQZ[�Q^\]T@\]TSQS\XacG�a�� E Q^Y E \ h Gh G�YU h moG�m�QSP � �#\ h G h G'q`TS\XYG�m7edb ��i]�

D#E GK��UXTZTSU���QSPRV+[ E G�U h G'H G�aj[�\]eRTSQSa E G�a±[ E G�a�UW_RP`mRPRG�a�a#U]��[ E G�QSPo��G h G�P`YG�a�bdac[�G�H�¥����������� �����

� � � �7� �� � ���.���

� a$` � b,d�� Y [ � �/`�a$`cb,d � ���� a������������H�j`eb,d! #" b�$d&% � Y [ � � `�a$`cb'$d&% �

D#E Q^a¢[ E G�U h G'H G�oq h G�a�a�G�a$[ E \�[&��U h \���\]TSQ^m�acG�fu_RG'Pu[ �� ��� �� � �XQ©� � Q^a±G��Æ\WTZ_n\�[�G�m���QZ[ E QSPRQZ[�Q^\]Tac[�\][�G � a$` b,d ���WG h QZ��buQSPRV [ E G=q h G �¿Y'UWP`moQZ[�QSUWP�q h UXqnG h [jb � [ E G�P�[ E G h G�a�_RTZ[�QSPRV¡HIG'HIU h b � a$` b $d ��XG h Q©§nG�a¢[ E G�q9UXac[���YUXP`moQZ[�QSUWP£q h UWq9G h [jb � �( �)*��+,+.-)./0����

� � � �:� � � ���.���

� a$` � b,d�� Y [ � �/`�a$` b,d � � a1������2�'� �X` b,d3 54" E D D 21 ) D �

�¢U h UXTZT^\ h b+JR� J�QSa#\�mRQ h G�Y[&YUXP`a�G�fu_RG'PnYG%UW� D#E G'U h G�H JR�ZxX�$�¿[&a E U��%a4[ E \�[¢[ E G�TSUWVWQ^Y�Y�\]P�e9G�_`acG�mI[�UmRG[�G�Y0[%QSTZTSG'Vu\]T q9UWQSPu[�G h mRG h G��G h G'PnYG�a�� D#E GKq h UuUW��UW� D#E G�U h G'H JR�ZxKY'\WP�enGK��UX_RP`m£QZP >Ìz�?¿�

6 7 l�����$�'�� ��� �������%� �]��� �*���'�I���%� ����������

D#E G%acboac[�G'H q h G�a�G'Pu[�G�m�QSP+[ E G�q h G��dQZUX_`a�acG�Y0[�QZUXP+Q^a4\�a�qnG�YQZ§nY'\][�QSUWPIU]� \�ac[�\�[�QSY�\WP`\]TSboacG h � D#E G%PRG'�u[ac[�G�q�YUXP`acQ^ac[�a�QSP�[ E G�moG h QS�Æ\][�QSUWP�UW� \WP�\]TSVWU h QZ[ E H � h UXHr[ E G{a�qnG�YQZ§nY'\][�QSUWP3� D#E G�mRG h QZ��\�[�QZUXPI��UWTSTZU��%a[ E G�HIG[ E Uom q h G�a�G'Pu[�G�m QZP >©x � ?±[�UCVWG'[�\CmoG�YQ^mR\]eRTSG7\WP`m¡moG'[�G h HIQZP`QSac[�Q^Y�q h UdU]�%acboac[�G�H£��� E UWQ^YG�aE \Æ�WG{[�UIenG�H�\XmoG�\]HIUWPRVI\]TSVWU h QZ[ E H+Q^Y�\]TZ[�G h P`\][�QS�WG�a&mo_ h QSPRV+[ E Q^a%ac[�G'ql����P¨q`\ h [�QSY'_RT^\ h �u�&G E \Æ�WG{[�UmRG�YQ^moG�[ E GKmRQ h G�Y[�QSUWP£U]�l[ E G�\]Pn\]TSbda�Q^a'¥�Q©[%Y�\]P£enGK[�UWq���moU���P¨\WP`m h G'[�_ h P�[ E G�qnUuaj[ �¿Y'UWP`mRQ©[�QZUXP�� h UWH[ E G�q h G���YUXP`moQZ[�QSUWP7U h enUW[c[�UWH �º_`q�\WP`m£moUI[ E G�UXqRq9UXa�Q©[�GW�

= ��YUX_ h a�GW�R[ E G�moG h QS��\�[�QZUXP¨UW��[ E G�\]TSVWU h QZ[ E H � h UXH [ E G�acq9G�Y'Q©§9Y'\�[�QZUXP�QZPd�WUXTZ�XG�a#a�UWHIG�\]qRq h UÆ�oQ �H�\][�QSUWP`a�� `U h G�R\]HIqRTSGW�u�&G�PRG�G�m�[�U h G�ac[ h QSY[4[ E G h G��G h G�P`YG�a�G[/\¡[�U�e9G�§nPRQ©[�GW�4¤�PRU][ E G h \]qRq h UÆ�oQ �H�\][�QSUWP�Y'UWP`Y'G h P`al[ E G&U h moG h�h G'T^\�[�QSUWP � � E QSY E QSa��XG h b�G'�oqnG�P`acQS�WG¢[�UKY E G�Y���WWQ©[$QSa�\WqRq h UÆ�oQZH�\�[�G�mKedb8 � \]P`m+q h UWq9G h [�QSG�a4\ h G#[�_ h PRG�mIQSPu[�U�\�PRU h H�\WTd��U h H [�U�q h G�acG h �XG&[ E G%HIUuaj[¢Y'UWHIqRTSG[�G%QZPR��U h HI\][�QSUWP3�D#E G�QSPu[�G h G�aj[�G�m h G�\XmoG h Y'\WP7§nP`m7HIU h G�QZPR��U h HI\][�QSUWP¨UWP¨[ E Q^a�ac_`eoijG�Y[#QSP > �6?¿� D#E G�moG'§`PRQZ[�QSUWP£U]� 8 �Q^a�a E U���P¨QSP �QZVX_ h G � �$¤�mRG h QZ��\�[�QZUXP¨UW�$\IY'U h�h G�Y0[&[�UWq �¿moU���P�\]TSVWU h QZ[ E H QSa�q h G�acG�PX[�G�m¨QZP,> �6?¿�

D#E G�\]TSVWU h QZ[ E H q h Uomo_`Y'G�m \Wa�[ E G h G�a�_RTZ[�U]�%[ E Q^a�moG h QS��\�[�QZUXP¡QSa+\ _`a�G��_`T#ac[�\][�Q^Y7\WP`\]TSboacG h ��U hq9UWQSPu[�G h G h�h U h a���*G E \Æ�XG q h U��WG�m�[ E \�[¨q h UXV h \]H�a+� E QSY E qn\Wa�aI[ E G�Y E G�Y�� Y'\]P`PRU][7TSG�\Xm [�U�\WP

&('BI)&+*

Page 12: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

����������� ����� ��� ��������������� � � � ��!#"%$&'���(�)���*��+�,���-�.�+���/���%�#�%�0� �+�)"1���2�3�3�%�4�)"0��56�7 �����8"0���0�.�%�*�4� �0" y

1 Ä)3ÌÍºÈ � � � � � � � � � �.0 Ë ÅÆÈ

���$� � � ���:� � �����!���� � � �

���$� � ��� ��� � � ������$� � ���

� � � ��� � � � ���� � � ���������

���j� � ���������� � � �

��� � � ����������:� � �

� � � ����K� � ����!����

� � � ����K� � ����! ���

�QZVX_ h G � ¥���G�mo_`Y0[�QZUXP�U h moG h U��WG h q h UXqnG h [�QZG�a

QSP`Y'U h�h G�Y0[�qnUXQZPu[�G h moG h G'��G h G'P`Y'GW� E G�PC\]P�G h�h U h QSa�moG[�G�Y0[�G�m �`[ E G�VX_RQST©[jb£moG h G��G h G�P`YGKQ^a h G'[�_ h PRG�m[�U*[ E G q h UWV h \WHIH+G h � R_ h [ E G h HIU h GX�¢mo_RG£[�U�[ E G q h G�a�G'P`Y'G¨UW�KmRQSa�ij_RP`Y[�QSUWP`aIQSP q h UXqnG h [�QZG�a'�±[ E G\WP`\]TSboacG h Q^a4\WeRTZG¢[�U�mRQSac[�QSPRVW_`QSa E e9G[j�&G'G�P�QSP`Y'U h�h G�Y0[�moG h G��G h G�P`YG�a�\WP`m+_RP`a�\���G#UWP`G�a���¤�moG h G'��G h G'P`Y'GQ^a h G�qnU h [�G�m [�U7e9GIQZP`Y'U h�h G�Y0[�� E G'PC[ E GI\]P`\WTZboa�G h�E \Wa�q h U��WG�m£[ E \�[KQZ[KY'G h [�\]QSPRTSb Y'\]_nacG�a{\WP=G h�h U h �¤�P�QZP`Y'U h�h G�Y0[�moG h G��G h G�P`YGKQ^a�moG[�G�Y[�G�m���QZ[ E [ E G h _`TZG

�� � ����� QSP`Y'U h�h G�Y0[�moG h G��G h G�P`YGX¥*����� � QZ� � 8 � ����� g MON�PlQ>R

¤ moG h G��G h G�P`YG�QSa h G�qnU h [�G�m�[�U7e9G�_RPna�\]��G�� E G�PC[ E G�\]Pn\]TSbda�G h�E \Wa{q h U��WG�m£[ E \�[�Q©[�H�\Æb�Y�\]_`a�G�\WPG h�h U h ��%P`a�\���G�moG h G'��G h G'P`Y'G�a�\ h GKmoG[�G�Y0[�G�m£��QZ[ E [ E G h _RTSG

�� � ���� _`P`a�\]��G�moG h G��G h G�P`YGX¥*����� � QZ� � 48 � ����� 4g MON�POQ#R

��P`a�\]��G�mRG h G��G h G'PnYG h G'q9U h [�a¢\ h G��#\ h PRQSPRVXa�� D#E G'b�Y'\WP�UoY'Y_ h e9G�Y�\]_`a�G�UW�3[ E GK\]q`q h UÆ�oQSH�\�[�QSUWPnaUW� UW_ h \]TSVWU h QZ[ E H�� `U h G�R\]HIqRTSGW�XQZP�VXG'PRG h \WTo[ E G�TSG'PRVW[ E U]�3\�qn\�[ E enG'[j�¢G�G'PI[j�&U��Æ\ h Q^\]e`TZG�a4Y'\WPRPRU][e9G±�dPRU���P�aj[�\�[�Q^Y'\WTZTSbW��k3G'[�_`a�YUXP`acQ^moG h [ E \�[l[ E G&q h UXqnG h [jbV� � �� ��Q^a�QZHIqRTSQZG�m�edb{[ E G&q h G���YUWPnmoQ©[�QZUXPUW�3[ E GK\Xa�a�QSVWPRHIG'Pu[ � $ � � F � G �4¤{a&�¢GKmoU+PRU][#�dPRU���[ E G{TSG'PRVW[ E U]�l[ E G�q`\�[ E e9G[j�&G'G�P � ��\]Pnm�@�d[ E G�qnUuaj[ �¿Y'UWP`mRQ©[�QZUXP£Q^a�a�qRTZQZ[%QSP¨[ E G�moQ^a�ij_`P`Y0[�QZUXP � � �� � � � � g �@� `_ h [ E G h HIU h GW�oQZ� �¨QSa#G�fu_`\]T[�U MN�POQ#R �@��_ h [ E G h moG h G��G h G�P`YG�a�UXP �*��QZTST$enG+_RP`a�\���GX�K¤�PRU][ E G h Y'\XacG�U]�¢\WqRq h UÆ�oQZH�\�[�QZUXP�QSa�� E G�P[ E G�a�UW_ h YGIU]��\�q9UWQSPX[�G h G h�h U h UoY'Y'_ h aKQSP¡\£e h \]P`Y E U]��\ YUXP`moQZ[�QSUWP`\WT �7¤{aK[ E G�\]P`\WTZboa�G h Y'\WPRPRU][mRG[�G h HIQSPRG�aj[�\�[�Q^Y'\WTZTSb � E Q^Y E e h \WP`Y E Q^a�VXUWQSPRV�[�U*enG�G�oG�Y_o[�G�m �¢�¢G E \Æ�WG£acG�G'P QZP [ E G�q h G'�dQSUW_`aa�G�Y[�QSUWP [ E \�[�[ E GCqnUuaj[ �¿Y'UWP`mRQ©[�QZUXP Q^a�\ moQ^a�ij_RP`Y0[�QZUXP3� D#E GCacUX_ h YG�U]��[ E G=eR_RV [ E _`a7QSa E \]P`mRTZG�m��QZ[ E QZP \Iac_`eo[�G h H U]�l[ E G�moQ^a�ij_`P`Y0[�QZUXP3�

¤{a4�&G E \Æ�WG�a E U���P+\WenU��XGW�WmRQSa�ij_RP`Y[�QSUWP`a±q h U��dQ^moG�\K�WG h b E QZV E \XY'Y'_ h \XYbK��U h [ E G{\]P`\WTZboa�QSa�� D#E GY'UW_RPu[�G h q`\ h [±Q^a4[ E \�[&[ E GKa�Q���G�U]�3q h UXqnG h [�QZG�a±Q^a±G'�oqnUXPRG'Pu[�Q^\]T9QSP¨a�q`\WY'G���QZ[ E7h G�a�q9G�Y0[¢[�U�[ E G�Pd_RH�e9G hUW����\ h Q^\]eRTSG�a#UW��[ E G h G��G h G�P`YG�a�G[�� � G'�XG h \]T3a�UWTS_o[�QSUWPna&��U h [ E G�UWqo[�QZHIQ^a�\][�QSUWP�U]��[ E G�\]TSVWU h QZ[ E H \ h GmRQSa�Y_`a�a�G�m�QSP£a�G�Y[�QSUWP zd� D#E G�a�G�UWqo[�QZHIQ^a�\][�QSUWP`a¢TZG�\Wm�[�U+QZHIq9U h [�\]Pu[#VX\WQZP`a��u� E QSY E Q^a&Y h _nYQ^\]Tn��U h [ E GmRG�a�QZVXP U]�4\ h G�\]TSQ^aj[�QSY�[�UuUXT �%³�U��¢G��WG h �o�&G�[ E QZPR�£[ E \�[�Q©[�Q^a%QSHIqnU h [�\]Pu[%[�U�TZG'[�[ E G�_`a�G h moG�Y'QSmoG�[ E G[ h \XmoG��¿U�C e9G[j�&G'G�P�\XY'Y'_ h \XYb�\WP`m7G ��YQSG'P`Y'bW�

IJI ÇLK@M0N0M0N

Page 13: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

x � � �+������� �+� � ���

¤�PRU][ E G h a�QZVXPRQ©§9Y'\]Pu[KQSa�a�_RG�Q^a{[ E G h G'TSG'��\]PnYG+U]�4[ E GIQZPo��U h H�\][�QSUWP h G[�_ h P`G�mCedb�[ E G�moG'eR_`VWVWG h �= _ h \WP`\]TSboacG h Q^a#\]eRTSG�[�U�q h U��dQ^moG�\XY'Y'_ h \][�G h G�qnU h [�a±UXP7G h�h UWPRG�UW_`a¢moG h G��G h G�P`YG�a'���&_o[��oQSP7VXG'PRG h \WT �[ E Q^a�Q^a�PRU][�ac_ ��Y'QZG�Pu[�[�U�qRQSPRq9UWQSPX[�[ E G&a�UW_ h YG¢U]�o[ E G¢e`_RV`� �G#\ h VW_`G�[ E \][�[ E Q^a�qn\ h [�U]�9\�moG�eR_RVWVXQZP`Va�G�a�a�QZUXP P`G'G�m`a¨\ Pn\ h�h U��-YUXTZT^\]e9U h \�[�QZUXP e9G[j�&G'G�P�[ E GC[�UdUXT{\]Pnm [ E G�_`a�G h � �G=��U h H�\]TSQSa�G [ E QSaQSPu[�G h \XY0[�QSUWP ��QZ[ E _`a�G h moG§`P`G�m�\Xa�a�G h [�QSUWPna'� � _`Y E \WP�QSPX[�G h \WY[�QSUWP Q^a�_`a�G��_`T¢��U h [ E G£TZUoY'\][�QSUWP¡UW�G h�h U h a&W Q©[�\WTSa�U h G'q h G�acG�PX[�aK\ h G�\WTZQ^ac[�Q^Y+Y'UWHIq h UWHIQ^acG+enG'[j�¢G�G'P \WY�Y_ h \WY'b�\WP`m*G���YQSG'PnYb@¥�[ E G�_`a�G hE \Wa�[ E G+qnUua�a�QSeRQZTSQZ[jb¨[�U¨G�P E \WP`YG�[ E G+qnU��&G h U]�±[ E GI\]P`\WTZboa�G h eub�� h Q©[�QZP`V¨\Wm`moQ©[�QZUXP`\]T E bdqnUW[ E G�acG�a'�³�G�Y'\WP£\WTSa�U+\Æ�XUWQ^m�[ E G�\]P`\WTZboa�QSa#UW��a�UWHIGKq`\ h [�U]��[ E G�q h UXV h \]H \Wa�a E U���P£enG�TZU����

� � �{� �������������-�����.�� � ��%���$�'����

� U���\ h �]�&G E \Æ�WG¢��UoY_`a�acG�m�UXP�[ E G#QZPo��U h H�\][�QSUWP h G'[�_ h PRG�m�[�U�[ E G&_nacG h edb�[ E G�\]P`\WTZboa�G h �)*G�q h G�acG�Pu[P`U�� [ E GImo_`\WT�QSPo��U h H�\�[�QZUXP �`U���QSPC[ E G+moQ^\]TSUWVX_RG���QZ[ E [ E G+_`a�G h � = _ h a�boaj[�G'H-Q^a{G'�d[�G'PnmoG�m QSP�\Pn\�[�_ h \WT��#\Æb¨��QZ[ E \�PRUW[�QSUWP�U]�4_`a�G h moG§nPRG�m�\Wa�acG h [�QZUXP`a%��QZ[ E UX_o[KQZPu[ h Uomo_`Y'QZPRV£\]Pdb�HIUdmRQ©§nY�\�[�QZUXP[�U+[ E GK��U h H�\]TSQ^acH mRG§`PRG�m£q h G��dQZUX_`acTSbW� *G�moQ^aj[�QZPRVX_RQ^a E enG'[j�¢G�G'P£[j�&U+�dQSP`mRa#UW�$\Xa�a�G h [�QSUWP`a�¥

¦ aj[�\�[�QSY�\Xa�a�G h [�QSUWP`a��u[�UIe9G�Y E G�Y��XG�m¨eub�[ E G�\WP`\]TSboacG h �dQ^\I\+mRG�YQ^mR\WeRTZGKU h moG h�h G�TS\][�QSUWP3�o\WP`m¦ mobdP`\]HIQ^Y�\Wa�a�G h [�QSUWP`a��d� E QSY E \ h G�Y'UWP`a�QSmRG h G�m£edb�[ E G�\]P`\WTZboa�G h \Wa�\WmRmoQZ[�QSUWPn\]T E bdqnUW[ E G�acG�a�QSP[ E G�a�\]HIG±�#\Æb�\Wa�[�G�aj[�a�QZP+YUWPnmoQ©[�QZUXP`\]To\WP`m ��� E D �ºTSUdUWq3� D#E G'b h G'q h G�a�G'Pu[�G�d[ h \�QSPo��U h H�\�[�QZUXP\]e9UW_o[#[ E G{G'�oG�Y_R[�QSUWP¨Y'UWPu[�G'�d[¢[ E \�[%\ h G�q h U��dQ^moG�m7eubI[ E G�_`acG h � D#E Q^a#�dQZPnm�U]��\Wa�acG h [�QZUXP7Y'\WPenG��XG h Q©§nG�m£\�[ h _RP7[�QZHIG�_`a�QSPRV+[ E G�Y'UWP`Y h G'[�Q^a�\][�QSUWP���_`P`Y0[�QZUXP Y�[��

� ��� � � � � � ���� ���� �������� � � � � �>��I���� � ��� � � � � � ���

� ���� ������� � � � � �>�����&0��

� � �"!� �.1 Ä)3ÌÍ È � � � ���� � � �� ���� �$# %� � � � � &]��I���� � ��� � � � � � �'!� �.1 Ä)3ÌÍ È

� ���� )( ��� � � � ��� � &]�����&0��

�QSVW_ h G��o¥�¤��oQSUWH�\�[�QSY�a#U]��\]PRP`U][�\][�QSUWP`aD#E G�acbdPu[�\]�7U]�4\WPC\]PRPRUW[�\][�G�m�ac[�\][�G'HIG�PX[���U h \�ac[�\][�Q^Y�\Wa�acG h [�QZUXP+*rQZP`a�G h [�G�m�enG'��U h G�� h G�a�q3�#\�� [�G h �\I� aj[�\�[�G'HIG'Pu[ � QSa > * � g � ?�� h G�a�q3� > � g * ?��0� D#E G h _`TZG�a4��U h ac[�\][�Q^Y�\Wa�a�G h [�QSUWP`a¢\ h G�q h G�a�G'Pu[�G�mQSP �QZVX_ h G �o� *G E \Æ�XGK[j�¢U�mRQ C@G h G'Pu[ h _RTZG�a'�B> � g±p H ?�\]P`m > � g =�� D ?�YU h�h G�a�qnUXP`moQSPRV+[�U7\Xa�a�G h [�QSUWPnaQSP`a�G h [�G�m¨e9G��U h G�U h \]� [�G h \Iq h UWV h \]H qnUXQZPu[�� D#E G�\]P`\WTZboa�G h Y E G�Y��da�[ E \][,*rY'\WP enG�moG�mo_nYG�m���QZ[ E[ E G h G'T^\�[�QZUXP 8 � � h UXH [ E G%q h G���YUXP`moQZ[�QSUWP � � h G�a�q3��[ E G�qnUuaj[ �¿Y'UWP`moQZ[�QSUWP � �0� D#E G%QSHIqnU h [�\]Pu[±q9UWQSPX[Q^a�[ E \][{[ E G��XG h Q©§9Y'\�[�QZUXP U]�¢ac[�\][�Q^Y�\Xa�a�G h [�QSUWP`a�QSa{��_RTSTSbC\]_o[�UWH�\�[�QSY�enG�Y'\]_nacG�[ E G+U h moG h{h G�TS\][�QSUWP 8 �mRG§`PRG�m£QZP£[ E G�q h G��dQZUX_`a#acG�Y0[�QSUWP£Q^a%moG�Y'QSm`\]eRTSGW�D#E G�a�buPu[�\�� ��U h \]P \]PRPRUW[�\][�G�m�aj[�\�[�G�HIG'Pu[+��QZ[ E mobdP`\]HIQ^Y¨\Xa�a�G h [�QSUWP-* Q^a > */. � ?�� h G�a�q3�

> � � .0* ?���\WP`mCQZ[�aKa�G'H�\]Pu[�QSY�a�Q^aKac_`Y E [ E \][1* Q^a�mRQ h G�Y[�TSb£QSP`Y'TZ_`mRG�m�QZP=[ E G+q h G���YUWPnmoQ©[�QZUXP�� h G'qna'�[ E G�q9UXac[���YUXP`moQZ[�QSUWPn�� D#E G h _RTZG�a���U h mobdP`\WH+Q^Y�\Xa�a�G h [�QSUWP`a1> � g±p H ?�\]Pnm,> � g =�� D ?$\ h G�q h G�a�G'Pu[�G�m

&('BI)&+*

Page 14: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

����������� ����� ��� ��������������� � � � ��!#"%$&'���(�)���*��+�,���-�.�+���/���%�#�%�0� �+�)"1���2�3�3�%�4�)"0��56�7 �����8"0���0�.�%�*�4� �0" xXx

QSP� �QZVX_ h G��o�$¤�a�QSPI[ E G{aj[�\�[�Q^Y%\Xa�a�G h [�QSUWP`a�Y�\Wa�GW�]�&G%Y'\WP�QZPnacG h [±mobdP`\WHIQSY�\Xa�a�G h [�QSUWP`a$e9G��U h G�U h \�� [�G hq h UXV h \]H,q9UWQSPu[�a�� �{bdP`\]HIQ^Y7\Wa�a�G h [�QSUWP`a�\ h G�_`a�G�m [�U�\Wm`m E buq9U][ E G�a�G�a���U h [ E G�\]Pn\]TSbda�G h � D#E G�Q hPn\�[�_ h \WT h UXTZG�Q^a�[�U�q h U��dQSmoG�QSPo��U h H�\�[�QZUXP � E Q^Y E Y'\]P`PRU][�e9G�QSPo��G h�h G�m�edb7[ E G�\WP`\]TSboacG h � D#E G'b�\]T^a�UY�\]PCe9G+_`acG'��_RT�[�U�\Æ�WUWQ^m \]Pn\]TSbda�QSPRV7a�UWHIG�e h \]P`Y E G�a{U]��[ E G�q h UWV h \WH edb�QZHIq9UXa�QZP`V�[�G�aj[K��\]TS_RG�a�\�[Y'UWP`mRQ©[�QZUXP`\]TRq9UWQSPu[�a��$�¿[±QSa±[ E G'P�a�UWHIG[�QZHIG�a±qnUua�a�QSeRTZG%[�U�\Æ�XUWQ^m�\WP`\]TSboacQSPRV���� E�D! TSUdUWq`a��u� E QSY E H�\Æbh G�mR_`YG¢V h G�\�[�TZb�[ E G¢[�QSHIG h G�fu_RQ h G�m���U h [ E G¢\]Pn\]TSbda�Q^a'�3��P�[ E Q^a�Y'\Wa�GW��mobdP`\WHIQSY¢\Wa�acG h [�QZUXP`alY�\]P�e9G¢a�G'G�P\Xa4\K�dQZPnm�UW�@Y'UomoG h G'T^\��R\�[�QZUXP¨��G�TZQSHIQZPn\�[�QSUWP�UW�@a�UWHIG�q`\ h [�a�U]� \Kq h UWV h \WH�[�U�\Æ�XUWQ^m�[ E G'Q h G�oG�Y_o[�QZUXPmR_ h QSPRV \*moG'eR_`VWVWQSPRV a�G�a�acQSUWPn�� D#E G£QSPu[�G h G�aj[�U]�KmobdP`\]HIQ^Y�\Wa�acG h [�QZUXP`a+QSaIQSTZTS_`ac[ h \�[�G�m QZP acG�Y0[�QZUXP�R� D#E G�q`\ h [�Q^Y_`TS\ h QZ[jb�U]�4mobdP`\WHIQSY�\Xa�a�G h [�QSUWPna#QSa%[ E \][%[ E G��WG h QZ§nY'\][�QSUWP�U]�$[ E G'Q h YUXP`acQ^ac[�G'PnYb7��QZ[ Eh G�a�q9G�Y0[{[�U7[ E G+\WY0[�_`\]T$\]enaj[ h \XY0[{ac[�\][�G�UW��[ E G+HIG'HIU h b£QSa{TZQSHIQ©[�G�m � D#E G�q h UdUW�4U]� � � * 48 � n\]T^acG� E QSY E Y E G�Y��oa�[ E QSa�Y'UWP`a�QSac[�G�P`Yb�Q^a$_RP`\WeRTSG¢[�UKG'P`a�_ h G±[ E \�[±\WTZTdG�oG�Y_o[�QZUXP`a$U]�n[ E G�\]Pn\]TSbda�G�m�q h UWV h \]H��QSTST&TSG�\Xm [�U \=Y'UWP`Y h G'[�G¨H+G�HIU h b*ac[�\][�G£� E QSY E �WG h QZ§`G�a�[ E G£q h UWq9G h [jb'*�� D#E Q^a�Q^a�enG�Y'\]_nacG¨[ E G\WP`\]TSboacG h H�\Æb PRUW[�enG�\WeRTZG�[�U�q h U��WG�[ E G+_nacG h mRG§`PRG�m mobdP`\]HIQ^Y�\Xa�a�G h [�QSUWP`a�����P*U h moG h [�U£\Æ�XUWQ^m[ E G h QSa���UW��G h�h U h a�[ E \][ E \Æ�WG�q`\Xa�a�G�m�[ E G=aj[�\�[�QSY Y E G�Y��dQZPRV q E \Wa�GCmo_RG�[�U [ E GCQSPu[ h UdmR_`Y0[�QZUXP UW�� h UWP`V�\Wa�acG h [�QZUXP`a'�W�¢G E \Æ�WG�G�d[�G'P`moG�mI[ E G%UWq9G h \�[�QZUXP`\]T`a�G'H�\WPX[�QSY�a4UW�9[ E G%T^\]PRVX_`\]VXG#[�U�QSPu[�G�V h \�[�G%\mRbuPn\]HIQSY{�WG h QZ§nY�\�[�QSUWPl� D#E G�G'�d[�G'PnacQSUWP¨U]�l[ E G�acG�H�\]Pu[�Q^Y'a&Q^a�a E U���P¨QZP �QZVX_ h G�}`� D#E G��XG h Q©§9Y'\�[�QZUXPQ^a�\WY E QZG��WG�m7[ E`h UX_RV E [ E G�_nacGKU]��[ E GKY'UWP`Y h G'[�Q^a�\][�QSUWP¨��_RP`Y[�QSUWP(Y�[��

� #���������� �� ��������� %�������� � � ������� #���������� � � � � %�!�" � ���� �� %

� # �����#��� $�% � �&��'�� % � � ��� � � ��'�� %%�� # ������� � � � �(� �!�% � ���� �� %

�QZVX_ h G�}`¥ = q9G h \�[�QZUXP`\]T a�G'H�\]Pu[�QSY�a&��U h mobdP`\WH+Q^Y�\Wa�a�G h [�QSUWP`a

� ��*) � �� � � � )��� ��'��������� � � � � � � � + )��� O�X����� ��� � � � �� ���� ,.- � )/���� 0212340 �X����� ��� � � ��! � � �

� ��() � �� � � � ) ��� h����� ��� � �� �K� ���� ���� 5�67,81#0 � )/��V����� ��� � � � + )�

� ���� ��T����� ��� � � � � � � � ��� O�X����� ��� � � �� ��� ��49 O�X����� ��� � � �

� ��� � � � � � ���� ���� V����� ��� � � �

�QZVX_ h G�zo¥4¤��oQZUXH�\�[�Q^Y'a#UW��ac[�\][�Q^YKQZPd��\ h QS\WPu[�a

IJI ÇLK@M0N0M0N

Page 15: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

xÆJ � �+������� �+� � ���

��P�U h moG h [�U7G'�d[�G'Pnm�[ E G+_`a�G h � � h QSG'P`moTSQSPRG�a�a%UW��[ E G+QZPu[�G h \WY0[�QZUXP3�9�¢G�QZPu[ h Uomo_`Y'G�\�[ E Q h m �dQSP`mCUW�\Xa�a�G h [�QSUWPl�$ac[�\][�Q^Y�QSPd�Æ\ h Q^\]Pu[�a'�$� E Q^Y E \ h G7QSP¡��\XY0[I\Cq`\ h [�QSY'_RTS\ h Y�\Wa�G7U]��ac[�\][�Q^Y7\Xa�a�G h [�QSUWP`a�� D#E G'b\WTZTSU�� [ E G�_`a�G h [�U��WG h QZ��b�[ E \�[�\�q h UXqnG h [jb E UWT^mRa#[ ERh UX_RV E UW_o[�\Iq`\ h [%UW�$\Iq h UXV h \]H�� D#E G�a�bdPX[�\����U h \ aj[�\�[�QSYIQSPd�Æ\ h Q^\]Pu[)* QSP¡\�ac_Re`q h UXV h \]H � Q^a8> � g � * ?º� D#E G h _RTSG�a���U h aj[�\�[�Q^YIQSPu��\ h Q^\]Pu[�a\ h G�q h G�a�G'Pu[�G�m QZP �QZVX_ h GIzd� �G E \Æ�WG�PRU][�moG'§`PRG�m=[ E G+Y'UW_RPu[�G h qn\ h [{U]�&aj[�\�[�Q^Y�QZPd��\ h QS\WPu[�a{QZP�[ E GmRbuPn\]HIQSY¨Y'\XacG¨enG�Y'\]_nacG£Q©[�moUdG�a+PRUW[+a�G'G�H²[�U*enG£_`a�G��_RT�\�[+[ E QSaIac[�\]VXGW� �¿�%[ E QSa���\XYQSTZQZ[jb [�_ h PRG�mUX_o[�[�U�e9G�_`a�G��_`T �@QZ[{�&UW_RT^m�PRU][�enG+moQ ��Y'_RTZ[{[�U E \WP`moTSG�mobdP`\WH+Q^Y�QSPd�Æ\ h Q^\]Pu[�a'�9PRG'QZ[ E G h [�U7q h U��dQSmRGY'U h�h G�acq9UWPnmoQZP`V�UWq9G h \�[�QZUXP`\]T3a�G'H�\WPX[�QSY�a h _RTSG�a��

� QSP`Y'GC\Wa�acG h [�QZUXP`a E \Æ�WG£[�U e9G � h QZ[c[�G'P eub¡[ E G q h UWV h \WHIH+G h �±Q©[�Q^aIQZHIq9U h [�\WPX[I[�U*q h U��dQ^moG£\a�_RQZ[�\WeRTZG E QSV E TSG'�WG�ToTS\WPRVW_n\]VWG¢[�U�moG'§`PRG&[ E G'H�� D#E G�q`\ h [�Q^Y_`TS\ h QZ[�QSG�a�U]�n[ E G#[j�&U��uQSP`mRa$UW�@\Xa�a�G h [�QSUWPnaTSG�\Xm�[�UI[ E G���UXTZTSU���QZP`V h G'H�\ h �oa�¥

¦ D#E GITS\WPRVW_n\]VWG�U]�¢mobdP`\WHIQSY+\Wa�acG h [�QZUXP`a{H�_`ac[�e9G�moQ h G�Y0[�TSb�[ h \]PnacT^\�[�\]eRTSG�QSP=[ E G�T^\]P`VW_`\WVWG�UW�g4h UWq�acQSP`Y'G{[ E G�a�G�\Wa�a�G h [�QSUWP`a#\ h G�QZP`Y'TZ_nmoG�m£QSP¨[ E G�q h UWq9G h [jb�QSPo��G h�h G�m7edb�[ E G�\]Pn\]TSbda�G h �

¦ D#E G%T^\]PRVX_`\]VXG�U]�3ac[�\�[�QSY�\Wa�acG h [�QZUXP`a$QSa±TZG�a�a±YUWPnaj[ h \WQZPRG�m � � [�\][�Q^Y%\Wa�acG h [�QZUXP`a�\ h G��WG h QZ§`G�m���QZ[ Eh G�acq9G�Y[I[�U q h UWq9G h [�QSG�a+QZPR��G h�h G�m¡edb [ E G�\WP`\]TSboacG h �dQ^\�[ E G 8 � h G�TS\][�QSUWP eR_o[�[ E G'b�\ h G£PRU][HIQ©�oG�mC��Q©[ E [ E G'H����¿[�QSa�[ E G�PCq9UXa�acQSeRTSG�[�U£moG§nPRG�\�HIU h G�G'�oq h G�a�a�QS�WG�T^\]PRVX_`\]VXG�QZPnYTS_`moQSPRV`���U h G�R\]HIqRTSGW� h G�Y_ h a�QZ�XG'TSb=moG'§`PRG�m¡q h G�moQ^Y'\�[�G�a�� D#E G�QSPX[ h Uomo_nY0[�QSUWP UW� h G�Y_ h acQS�dQ©[jb�qnG h HIQZ[�a[�U acQSH�_`TS\][�G�\ PRUW[�QSUWP)\¡[ h \]P`a�Q©[�QZ�dQZ[jb�UWP�[ E G �� q h G�moQSY�\�[�G=� E Q^Y E �#\Wa¨PRU][£qnUua�a�QSeRTZG*QSPUW_ h TS\WPRVW_`\WVWGIU]�#q h UWq9G h [�QSG�aKQSP [ E G�\WP`\]TSboacG h enG�Y'\W_`acG�UW�#\XY'Y'_ h \XYb=Y'UWP`a�Q^moG h \�[�QZUXP`a'� D#E QSaG�d[�G�P`a�QZUXP¡\]TSTZU��%a�_`a�[�U�moG'§`PRG��XG h b�P`\][�_ h \]T¢q h G�moQ^Y'\][�G�a��XL g \�[ E � �Of ` ��iÆ�eLC\WP`m LWklUdUWql� �d� L� E Q^Y E \ h G7moG'§`PRG�m¡QSP �QZVX_ h G£yR� D#E G¨UXPRTSb Y'UWP`ac[ h \]QSPu[�Q^a�[�U=�WG h QZ��b*[ E \][�[ E G¨��\WTZQ^moQZ[jb*UW�acG�fu_RG'Pu[�a�U]�$[ E G���U h H � � * ��Q©[ E ��� g4h UWq \WP`m * � � g4h UWq h G�H�\]QSP`a%moG�YQ^mR\]eRTSGW� D#E QSah G�ac_`T©[%Q^a#G�ac[�\WeRTZQ^a E G�m¨QZP D#E G�U h G'H � �Zx

k�\]PRVX_`\]VXG�a�U]� aj[�\�[�QSY#\]Pnm�mobdP`\WHIQSY#\Wa�a�G h [�QSUWP`a$\ h G#q h G�a�G'Pu[�G�m�QSP� �QSVW_ h G �R� �QZVX_ h G�yKmoG�a�Y h QSenG�a�[ E G[ h \WP`a�TS\][�QSUWP�U]�d[ E G±QZPu[�G h ��\XYG$T^\]PRVX_`\]VXG�QSPu[�U�[ E G4T^\]PRVX_`\]VXG$U]�dq h UXqnG h [�QZG�a g4h UWq�_`a�G�m�edb�[ E G±\WP`\]TSboacG hQSPC\Wm`moQ©[�QZUXP�U]�$[ E G�moG§`P`Q©[�QZUXP U]�$[ E G�[j�¢U h G�Y_ h a�QZ�XGKq h G�moQ^Y'\�[�G�a L g \�[ E LI\]P`m LWklUdUWq�L`���%UW[�G�[ E \�[[ E G{mRG§`PRQZ[�QSUWP7U]�@[ E G{q h G�moQ^Y'\][�G�L g \�[ E LKQZP`Y'TZ_nmoG�a¢\K� h G�G���\ h Q^\]eRTSG���� D#E Q^a±moG'§`PRQZ[�QSUWP7Y�\]P�e9G{a�G'G�P\Xa±\�³�U h P�YT^\]_`a�G�� E G h G%��\ h Q^\]eRTSG�a¢\ h G�QZHIqRTSQ^YQZ[�TSb+_`PRQZ�XG h a�\WTZTSb�fu_`\WPu[�QZ§`G�m�\][4[ E G�UW_R[�G h HIUXac[4TZG��WG�T �D#E QSa{fX_n\]Pu[�QZ§nY'\][�QSUWP�Q^a%e9UW_RP`mRG�m�e9G�Y'\W_`a�GK[ E G��Æ\WTZ_`G�a�UW��\WTZT���\ h QS\WeRTZG�a�\ h G�\Wa�ac_`H+G�m¨[�U�e9G�QSP [ E Gh G��G h G�P`YGKa�G[��

&]� ËED<F ��� ����� Å�Ä)3 � % � � % � �j� ' ��� Å�Ä)3 � % � �E% � �j� * 3ÌÊ Ä�Í � % � � % � �$� ' * 3ÌÊ Ä�Í � % � �E% � �� & ÊÌ˺È�� � %*�2� %#���j� ' & ÊÌ˺È�� � %*�2� %#���� & FÆËED<FKÄ�Ç � & FÆË D<F � & F�Ë D<FkD0Ë & F�Ë D<F

�&� ËED<F ��� � & FÆË D<F �&� Ä��� � %*� � %#���j��� D&D<F � % �� �&� ËED<FKÄ�Ç � �&� ËED<F � �&� ËED<FkD0Ë �&� ËED<F

% ��%*����%#�$C I Ä�Ë�Î

�QSVW_ h G �R¥�kl\WPRVW_n\]VWG�U]�$\]PRP`U][�\][�QSUWP`a

&('BI)&+*

Page 16: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

����������� ����� ��� ��������������� � � � ��!#"%$&'���(�)���*��+�,���-�.�+���/���%�#�%�0� �+�)"1���2�3�3�%�4�)"0��56�7 �����8"0���0�.�%�*�4� �0" x�t

� � Å�Ä)3 � %*� G %#��� � %*�'�(%#�'���� Å�Ä)3 � %&� G %#��� � " � %*��� %#���* 3ÌÊ Ä�Í � %*� G %#��� � 8X%*�'� 8X%#�'* 3ÌÊ Ä�Í � % �)G % � � � " � 8X% � �(8X% � �& ÊÌË È� � %*� G %#��� � %*�'+- %#�' & ÊÌ˺È�� � %*� G %#��� � " � %*��+-.%#���� Ä��� � %&� G %<��� � & ÊÌ˺È�� � %*� G %#��� D0Ë & ÊÌË È �� � %&� ����� Ä�Ç � � Ä� � � �/� %#���� D>D<F � % � � � Ä��� � % G %��

�QZVX_ h G�y`¥ ; G�\WPRQZP`V+UW��\WPRPRU][�\�[�QZUXP`a

D#E G�\��oQSUWH�\�[�QSa�\�[�QZUXP�UW� [ E G�\]P`\WTZboa�G h G�d[�G'P`moG�m���QZ[ E�h _RTSG�a4UW�) �QSVW_ h G ��aj[�QZTSTn�XG h Q©§nG�a D#E G�U h G'HJR�ZxX��¤%P�QZHIq9U h [�\WPX[�q h UWq9G h [jb�[�U+G�P`a�_ h GKQ^a'¥�������������)���

� � � ���3�+5+� �%��� ��� ��� � 8 � *�� ��� � � �� �3�3�<�+�� * � � �3�3�,� " '�)���'� ��� ���

D#E G=q h UdU]��U]��[ E Q^a¨[ E G�U h G'H QSa£moQ h G�Y0[�¥¡�¢G*YUXP`acQ^moG h \¡§`PRQZ[�G acG'[¨U]���Æ\ h Q^\]e`TZG�a'��[ E _`a7QSHIqRTSQSY'Q©[fu_`\WPu[�QZ§nY'\][�QSUWP`a�\ h GI§nPRQ©[�G'TSb�e9UW_`P`moG�m3� = _ h TSUWVWQ^YIQ^a�[ E G'P¡G�fX_`QZ��\]TSG'Pu[�[�U=\�q h UWq9UXa�Q©[�QZUXP`\]T±TZUXVWQ^Y\WP`m E G'P`Y'G�QSa�mRG�YQ^mR\WeRTZGX��&G�Y'\]_nacG+U]�&[ E G�q h G�acG�P`YG+U]��moQ^a�ij_RPnY0[�QSUWPna�QZP � g±h UXq3�@[ E G��WG h QZ§nY'\][�QSUWP=UW� � 8 � * Y�\]P*enG�fu_RQZ[�GG'�oqnG�P`acQS�WGX� *G*moU�PRU][¨[ h G�\�[¨[ E Q^a¨q h UXeRTSG'H E G h G=eR_R[7[ E G�QSPu[�G h G�ac[�G�m h G�\WmoG h Y�\]P §`P`m)HIU h GQSPo��U h H�\�[�QZUXP¨UXP¨�#\Æboa¢[�UI[�\XY��dTZG{[ E Q^a�q h UWe`TZG�H QZP,>ZxWx0?¿�

� ��� ����� ���

D#E QSa&acG�Y0[�QZUXP�q h G�acG�Pu[�a±a�G'�XG h \]TnG�R\]HIqRTSG�a±QZTSTZ_naj[ h \][�QSPRV�[ E G h UWTSG%U]�l\Xa�a�G h [�QSUWPna�QZP¨aj[�\�[�Q^Y�mRG'eR_RVXVWQSPRV`�*G+§ h aj[�YUXP`a�QSmoG h \£a�YG�P`\ h QSU7U]�#moG'e`_RVWVXQZPRV£_`a�QZP`V�ac[�\][�Q^YI\Wa�acG h [�QZUXP`a'� D#E G��WUuacG�q E _`aK\]TSVWU h QZ[ E HmRG�a�Y h QZe9G�mIQSP2>Zx ��? \]P`mIVXQZ�XG'P�QSP �QZVX_ h G�x � Y'UWP`a�QSac[�a±QZP�[j�¢U�TSUdUWq`a�� D#E G%§ h ac[±UWPRG�eR_RQSTSmRa&\�Y'Q h Y_RT^\ hTSQ^aj[4\]Pnm�[ E G%acG�YUXP`m�UXPRG h G�H+U��XG�a$\�[�G�\WY E QZ[�G h \][�QSUWP+UWPRG#G�TZG�H+G�Pu[�� h UWHr[ E G�YQ h Y_RT^\ h TSQSac[4_RPu[�QSToUWPRTSbUXPRGIQSa�TZG'� [¨��� E Q^Y E qnUXQZPu[�aK[�U QZ[�a�G'TZ�j� � �G E \Æ�XG�acTSQZV E [�TSbCHIUdmRQ©§`G�m*[ E G�Y'UomoG�U]�&[ E G�q h UXV h \]H-[�UQSPu[ h Uomo_`YG¢\%q9UWQSPX[�G h G h�h U h � *G E \Æ�WG4a�_RqRq h G�a�acG�m�[ E G&\Wa�acQSVWP`H+G�Pu[ G � F � G $ � G � F � G� � F � GUW�±[ E G�acG�YUWPnmCTSUuUXq3� D#E G h UWTSG+U]�4[ E QSa�\Xa�a�QSVWPRHIG'Pu[KQSa�[�U h G�H+U��XG�[ E GIG'TSG'HIG'Pu[�Y'\Wqo[�_ h G�m=edb [ E Gq9UWQSPu[�G h �C� h UWH [ E G7YQ h Y_RT^\ h TSQSac[��7³�G'P`Y'GI[ E G���\ h Q^\]eRTSG��=Q^aK�WG�qo[�QZPnacQ^moGI[ E G�YQ h Y'_RTS\ h TZQ^ac[�� D#E Gac[�\][�G�H+G�Pu[ .�0 � � � � e h G�\]�oa{[ E GIY'Q h Y_`TS\ h QZ[jb U]�¢[ E GITSQSac[�\]P`m*\�[K[ E G+P`G�d[�Q©[�G h \�[�QZUXP=U]�¢[ E GITSUdUWq3�[ E GK\]P`\WTZboa�G h mRG[�G�Y0[�a±[ E \�[#[ E G�mRG h G��G h G'PnYG�UXP G QSP�[ E G . + 0+TZUdUWq¨QSa&PRU�HIU h G{a�\���GW� D#E G��#\ h PRQZP`Vq h U��dQ^moG�m=eub�[ E G�\]Pn\]TSbda�G h YUXP`YG h Pna�[ E Q^a�moG h G��G h G�P`YG+UWP G \WaKa E U���P=QSP �QSVW_ h G�xWxX� h UXH [ E Gq h UXV h \]HIHIG h q9UWQSPX[�U]���dQZG����`[ E Q^a��#\ h PRQSPRV�QSa{ac_ h q h Q^acQSPRV7\][%[ E Q^a{qRTS\XYG�e9G�Y�\]_`a�G�[ E G�TSQSac[{q9UWQSPu[�G�m[�U�edb G Q^a�ac_`qRqnUuacG�m�[�U�e9G�\]TS�&\Æboa±Y'Q h Y_`TS\ h QSP7[ E G���� E D! TZUdUWql�$¤ a�UWTS_o[�QSUWP7[�U+TZUoY�\�[�G{[ E GKa�UW_ h Y'GUW�l[ E G�G h�h U h Q^a#[�UI\XmRm7[ E G�ac[�\][�Q^Y{QSPd��\ h QS\WPX[�k3UdUXql� G �&\�[#[ E G��!� E D! TZUdUXq�[�U�Y E G�Y��I[ E \�[ G \WTZ�#\Æboa

IJI ÇLK@M0N0M0N

Page 17: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

x � � �+������� �+� � ���

����� 0��20#- 3 ���������� �20���1 , �����3 ���������� �20��, ����� 0 ���1 , ����� 0�� ���

� ���� , ���! �, ��� ,#" � " � �1 , ����� "$� �3 � � � - �%'& � & � % "$( � ")( � #���*+� 1 , ���, � 1�1 ��,� 3 ,.-20 - � 3 �������/�� �20 � #�� ��01� 0 ��*/2#� � *����- 3�+� , *�45� ,76 *8���)9�9 , �

� ��01� 0�� ��*+� 1 , ���, � 1�1 ��,� 3 ,.-20 - � 3 �������/�� �20 � #���* � ��01� 0�� ���� ��01� 0 ��* , �

�� ��01� 0�� ��* � �5�67,81#0 �:�<;1* � ��01� 0�� �� �- 3�+� , *=2#� ,>6 * �,? 2#�)9�9 , ��* � ��01� 0�� ���

��� , ��� - �%'& � % "@� ��01� 0�� ��01� 0 �� #�� * � ��01� 0�� ���� ��01� 0�� ��* � � � ��01� 0�� �� A01� 0�� ���- � 0�0 � � #�

���� , ��� - �%'& �CB �#% "D� ��01� 0 �� #�

�QZVX_ h G+x � ¥ �XUXa�G'q E _`a#q h UWV h \WH

0005�67,81#0 �:�E;1* � ��01� 0�� �� � - 3�F�0�0�0G

���* � ��01� 0�� ��� H Ä�˺ÇÆÊÌÇ�à � ÅÆÇ�Í¿Ä�ÏZÈ �ÆÈj˺È�ÏSÈjË ÈcÇ �cÈ � ��01� 0�� ��

� * � ��01� 0�� ���- � 0�0 � � #�

�QZVX_ h GIxXxW¥ ��G'[�G�Y0[�QSUWP�UW�$\WP¨_RPna�\]��GKmRG h G��G h G'PnYG

q9UWQSPu[�a¢[�UI\+YQ h Y'_RTS\ h TSQ^aj[�� �QSVW_ h G+x�J�a E U��%a±[ E G h G�a�_RTZ[&UW�3[ E GK\WP`\]TSboacQ^a¢��Q©[ E a�_`Y E \Xa�a�G h [�QSUWPl� D#E G

&('BI)&+*

Page 18: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

����������� ����� ��� ��������������� � � � ��!#"%$&'���(�)���*��+�,���-�.�+���/���%�#�%�0� �+�)"1���2�3�3�%�4�)"0��56�7 �����8"0���0�.�%�*�4� �0" x �

000� 5�67,81#0 �:�E;1* � ��01� 0�� �� � - 3�+�0�0�0G

���* � ��01� 0�� ����

� * � ��01� 0�� ���- � 0�0 � � #� & Ç � D0Ë ËºÈ��$Ä�Í ÍºÈjË� Ê�D0Ç

��� � D&D<F �:�� ��

�QSVW_ h GIx�JR¥ ��G'[�G�Y[�QSUWP�U]��[ E G�� h UXPRV+ac[�\][�Q^YK\Wa�acG h [�QZUXP

G h�h U h Q^a�TZUoY�\]TSQSa�G�m¨UWP¨[ E G .�0 � aj[�\�[�G'HIG'Pu[��klG[±_`a±PRU�� YUWPnacQ^moG h \WP�G�R\]HIqRTSG�U]�3\WPI\WqRqRTSQSY�\�[�QZUXP+UW�@mRbuPn\]HIQSY�\Wa�acG h [�QZUXP`a'� �Q h aj[��W�&G��¢UX_RT^m

TSQS�WG#[�U�aj[ h G�a�a$[ E G���\XY0[4[ E \�[&�¢G�QSHIqRTZQ^YQZ[�TSb+��UoY_`a±UWP�moG'e`_RVWVXQZPRV���QZ[ E \���U h �&\ h mI\]Pn\]TSbda�G h �l��PI[ E \�[Y�\Wa�GW��mobdP`\WH+Q^Y£\Wa�acG h [�QZUXP`a�\ h G7q h UXq`\]Vu\�[�G�m���U h �&\ h m \WP`m �&G¨Y'\WP�UXe`acG h �XGI[ E G�Q h G%C9G�Y0[�a�UWP�[ E Gac[�\][�G+U]�4[ E GIq h UWV h \]H����KG'G�qRQSPRV7[ E Q^a{Q^moG�\7QSP�HIQSP`m �l\¨P`\][�_ h \]T$\]qRq`TZQ^Y'\][�QSUWP=UW�4[ E G�a�GI\Xa�a�G h [�QSUWPnaQ^a+[ E G TZUoY'\WTZQ^a�\�[�QSUWP U]��[ E G G h�h U h QSP �QSVW_ h G x�t`� D#E G G h�h U h Q^a h G�qnU h [�G�m \�� [�G h [ E GCYUWPnmoQ©[�QZUXP`\]T\WP`m£QSa{mo_RG�[�U�[ E G .�0 � ac[�\][�G�H+G�Pu[�UWP£[ E G���\ h QS\WeRTSG��£� E Q^Y E Y'\W_`acG�a � � F � G [�U�e9G�_RP`mRG§`PRG�m � `U h [ E G q h UWV h \]HIHIG h � E Q^Y E E \Wa�P`U][I��UW_RPnm [ E GCa�UW_ h YG£U]��[ E G G h�h U h �¢Q©[��&UW_RT^m enG _nacG'��_RT�[�UmRG[�G�Y0[�QZ�¢[ E G�eR_RV£QSa�Y�\]_`a�G�m���QZ[ E QSP UWPRGIU]�¢[ E G+[j�&U¨e h \WP`Y E G�a�UW�±[ E G�YUWPnmoQ©[�QZUXP`\]Tº�I¤ mRbuPn\]HIQSY

� �8� F�D0ÊÌÇ ºÍ D%Ä73ÌÊÌÇ�0È�k3ÌÊÌÍ � �,.- � � *�* � ��01� 0�� �� � 6 0 �

��3� 01� 0 ��*/2#�- � 0�0 �:�� �

0212340� �3� 01� 0 ��* � ��01� 0 ���- � 0�0 � � �

- * �3� 01� 0�� ��� H Ä�Ë ÇÆÊÌÇÆà � ÅÆÇÆͺÄ�ÏSÈ �ÆÈjË ÈjÏZÈj˺ÈjÇ �jÈ �3� 01� 0�� ���

�QZVX_ h GIx�tR¥ H4h�h U h¢h G'q9U h [�G�m¨\]� [�G h \+Y'UWP`mRQ©[�QZUXP`\]Tº�

\Xa�a�G h [�QSUWP¨QZPnacG h [�G�m¨enG'��U h GK[ E G�Y'UWP`moQZ[�QSUWPn\]T q9G h H+QZ[�a�[�U h G�TS\]�7UWP`G�UW��[ E GK[j�&U+e h \WP`Y E G�a#\WP`m�[ E G'P[�U�moG[�G h H+QSPRG�HIU h G�q h G�YQ^acG�TZb�[ E G�U h QSVWQSP7UW��[ E G�eR_RVn����P �QSVW_ h GIx � �u[ E G�\]P`\WTZboa�G h §`P`m`a#[ E \][�[ E G\WPRPRUW[�\�[�G�m£q h UWV h \WH QSa{YU h�h G�Y[��#³%G'PnYGW�`[ E G�acUX_ h Y'G�U]�$[ E G�eR_RV�Q^a�Y'UWPo§nPRG�m�QSP�[ E G D� e h \WP`Y EUW�3[ E GKY'UWP`mRQ©[�QZUXP`\]Tº�$�¿��[ E G�YUomoG�� h QZ[c[�G'P£QZP¨[ E G 4D� e h \WP`Y E �#\Wa&TSUWPRVXG h �W[ E G�moG[�G�Y0[�QZUXP¨q h UoYG�a�aUW�±[ E GIG�R\WY[KTSUoY'\][�QSUWP=UW�±[ E G�G h�h U h Y'UW_RT^m�_`acG�ac[�\][�Q^Y+\Xa�a�G h [�QSUWPna � � F � G g MN�POQ#R [�U Y E G�Y�� [ E G��\WTZQ^moQZ[jb�U]��[ E G�mRG h G��G h G'PnYGW�

IJI ÇLK@M0N0M0N

Page 19: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

x�} � �+������� �+� � ���

� ��� Å�Ä)3 � ��" � ��01� 0�� � # ,.- � � *�* � ��01� 0�� �� � 6 0 �

��3� 01� 0 ��*/2#�- � 0�0 �:�� �

0212340� �3� 01� 0 ��* � ��01� 0 ���- � 0�0 � � � �

- * �3� 01� 0�� ��� � D0ËºË È�'FÆËED0Ã0Ë¿Ä��

�QSVW_ h GIx � ¥$klUoY'\]TSQ^a�\][�QSUWP7UW��[ E G�G h�h U h �

H \WY E �dQZPnm�U]�l\Xa�a�G h [�QSUWP E \Wa¢Q©[�a¢a�qnG�YQZ§nY{_`acGX� � [�\][�Q^Y�\Wa�a�G h [�QSUWP`a¢\ h G%_`a�G�m�edb+[ E G�q h UWV h \WH+HIG h[�U �WG h QZ��bC[ E \�[�\�q h UXqnG h [jb E UWT^mRa�\][�acUXH+G�q h UXV h \]H q9UWQSPu[�� ��bdP`\WH+Q^Y�\Xa�a�G h [�QSUWP`aK\ h G�_`a�G��_`T4[�UUXe`a�G h �WG�[ E G�QZP �n_RG'P`Y'G�U]�{\�q h UWq9G h [jb�� h UWH�\�q`\ h [�QSY'_RTS\ h q h UXV h \]H²qnUXQZPu[�� R_ h [ E G h H+U h GX��[ E G'bG�aj[�\]eRTSQ^a E \+TZQSPR�£enG'[j�¢G�G'P ac[�\�[�QSY�mRG'eR_RVXVWQSPRV�\]P`m�mobdP`\WHIQSY�moG�eR_RVXVWQSPRV`� �{bdP`\]HIQ^Y�\Wa�acG h [�QZUXP`a#Y'\WPe9G±_nacG�m�[�U�Y E G�Y��{QZ�`a�UWHIG4q h UWq9G h [�QSG�a E UWT^mKU h QZ�`a�UWHIG4qRQSG�Y'G�a3UW�RYUomoG¢\ h G4\XY'Y'G�a�acG�m�\][ h _RPK[�QSHIGW� �Ge9G'TSQSG'�WG�[ E \][#[ E Q^a&QZPu[�QSH�\�[�G{QSPu[�G'V h \][�QSUWP�UW��aj[�\�[�QSY�\]P`\WTZboa�QSa&\]Pnm�mobdP`\]HIQ^Y{\WP`\]TSboacQ^a4Q^a#\�a�QSVWPRQZ§nY'\WPu[\Xmo��\]Pu[�\WVWG�U]��UW_ h � h \]HIG'�&U h �@�

� � � ����$�% � �����

��P > � ?¿� ��_nY'\Wa�aoOG�q h UWq9UXa�G�aK\�YT^\Wa�a�Q©§nY�\�[�QZUXPCU]�#moG'eR_`VWVWQSPRV£[�UdUXTSa�� = _ h �&U h � Y'\WP�e9G�YT^\Wa�acQZ§`G�m�QSPE G h � h \WHIG'�&U h �*\Xa+\ Jc�XG h Q©§9Y'\�[�QZUXP¡��QZ[ E h G�acq9G�Y[�[�U a�q9G�YQZ§nY�\�[�QSUWPna2L�aj[ h \][�G'VXbW� ��P UW_ h a�G[�[�QSPRV`�a�q9G�YQZ§nY�\�[�QSUWPna�VX\][ E G h [ E G�\]�oQZUXHI\][�Q^a�\][�QSUWP£U]��q9UWQSPX[�G h \WP`\]TSboacQ^a%\WP`m¨[ E G�mRbuPn\]HIQSY�\Wa�acG h [�QZUXP`a�\Wm �mRG�m edb�[ E G¨q h UXV h \]HIHIG h ����P [ E Q^a�q`\ h [�Q^Y_RT^\ h moG'eR_`VWVWQSPRV=ac[ h \�[�G'VXbW� ��_`Y�\Wa�aoOG�QSmoG�Pu[�QZ§`G�a+acG��WG h \WT[�G�Y E P`QSfu_RG�a'��¤%HIUXPRVI[ E G�H��RUW_ h a�boaj[�G'H E \]P`moTSG�a&[ E GK��UWTSTSU���QZPRVn¥

¦ � bdH�e9UWTSQSY�moG h QZ��\][�QSUWP U]�4\Xa�a�G h [�QSUWP`a��o� E Q^Y E YU h�h G�a�qnUXP`mRa#[�UI[ E G�QZPR��G h G'P`Y'G�U]��q h UWq9G h [�QSG�a�UW�[ E G�\WP`\]TSboacG h YUWHIqRTSG'HIG�PX[�G�m£��QZ[ E mobdP`\]HIQ^YK\Wa�acG h [�QZUXP`a'�

¦ �¢UWP`a�Q^aj[�G'P`Y'b�Y E G�Y��dQSPRV���QZ[ E£h G�acq9G�Y[¢[�U�\Wa�acG h [�QZUXP`a'�X� E Q^Y E Y'U h�h G�acq9UWP`m`a�[�U+[ E G{�XG h Q©§9Y'\�[�QZUXPU]��aj[�\�[�QSYK\Wa�a�G h [�QSUWP`a��

¦ �¢UWP`Y h G'[�G¨G'��\]TS_`\�[�QZUXP¡U]��\Wa�acG h [�QZUXP`a'�$� E Q^Y E Y'U h�h G�acq9UWPnmRa�[�U=[ E G£mRbuPn\]HIQSY¨�WG h QZ§nY�\�[�QSUWP UW�mobdP`\]HIQ^Y�\Wa�acG h [�QZUXP`a��

; UXac[ h G'T^\�[�G�mI[�UdUXTSa¢q h U��uQ^moG{QZPo��U h H�\][�QSUWP7\WenUX_o[¢_RP`QZPRQZ[�Q^\]TSQ^acG�m���\ h QS\WeRTSG�a4e`_o[%\ h G%_RP`\WeRTZG{[�U�[ h \WY��QSTSTZG�VX\]T3\XY'Y'G�a�acG�a¢QSP h G�Y_ h acQS�WGKmR\][�\Iaj[ h _nY0[�_ h G�a'�

k$�&k3QSPX[#> }6?l\WP`m�¤�a�qnG�Y0[�a1>Zx�J6?�\ h G�\WTSa�U�[�UdUWT^a#_`a�QZPRV+��U h H�\]T a�qnG�YQZ§nY'\][�QSUWP`a&[�U�Y E G�Y���q h UWV h \WH�ae`_o[4[ E G'b+enUW[ E ��UoY_`a4UWPI[ E G�acq9G�Y'Q©§9Y'\�[�QZUXPIU]�9[ E G%e9G E \Æ�uQSUW_ h U]�@q h UdY'G�mo_ h G�a'� D#E G'b+moU�PRUW[ E \]PnmoTZGh G�Y'_ h acQS�WGKmR\�[�\Iaj[ h _`Y[�_ h G�a��

&('BI)&+*

Page 20: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

����������� ����� ��� ��������������� � � � ��!#"%$&'���(�)���*��+�,���-�.�+���/���%�#�%�0� �+�)"1���2�3�3�%�4�)"0��56�7 �����8"0���0�.�%�*�4� �0" x�z

D bdqnG�aj[�\�[�G�a1>©x�}+?lq h G�acG�PX[%\Ia�qnG�YQ^\]T ��U h H UW��[jbdq9G�Y E G�Y��dQSPRV+qnG h ��U h HIG�m£edb�[ E G �%�jk Y'UWHIqRQSTZG h �D#E G'b�G'�dq h G�a�a¢[ E GKmRG'V h G'G�U]�$moG§nPRQ©[�QZUXP�U]��q9UWQSPu[�G h ��\ h Q^\]eRTSG�aK��_RPRQSPRQ©[�QS\WTZQ^a�G�m �RQSPRQZ[�Q^\]TSQSa�G�m3�RmoG§`P`G�m`�e`_o[%PRU][%QSP h G�Y_ h acQS�WGKmR\][�\Iaj[ h _nY0[�_ h G�a'�

g _ h QZ��b > y�?%\]P`m [ E G£�¢U h �*U]�{¤�_`ac[�QSP3�� h G�\WY E \WP`m � U E Q >©x%?�\ h G7TZG�a�a+moQ h G�Y0[�TSb¡YUXPRPRG�Y0[�G�m [�UUX_ h �¢U h � e`_o[�[ E G�b=QSTZTS_`ac[ h \�[�GI\�Y'UWHIqRTSG'HIG'Pu[�\ h bC\Xacq9G�Y[�U]�&[ E G�moG�eR_RVWVXQZP`V�\XY0[�QZ�dQZ[jbW� D#E G'b�\ h GmRbuPn\]HIQSY�[�UdUWT^a{qnG h ��U h HIQSPRV7\]P=QZP`ac[ h _RHIG'Pu[�\�[�QSUWP=U]�4[ E G�q h UXV h \]H Y'UomoG¨��UWeoijG�Y0[�Y'UomoG���U h{g _ h QZ��b\WP`m=a�UW_ h Y'G�YUomoG+QZP >Zx0? ��[�U7q h U][�G�Y0[KHIG'HIU h b \WY�YG�a�a�G�a+��\]HIUXPRV7UW[ E G h a��%a�U7[ E \�[ h _RPu[�QSH+G+G h�h U h a\ h G�moG[�G�Y[�G�m£\Wa&a�UuUXP¨\Xa±q9UXa�acQSeRTSG�mR_ h QSPRV�[ E GKG'�dG�Y_o[�QZUXP3��k3QS�WG�\]TSTn[�G�ac[�QSPRV+[�UdUWT^a�� h G'q9U h [�G�m�G h�h U h a\ h G&UWP`TZbK[ E UXa�G#UdY�Y_ h QSPRV���QZ[ E [ E G¢[�G�ac[�G�m�QSPRqR_o[�a'� = _ h ac[�\][�Q^Y¢moG�eR_RVXVWG h ��U h H�\]TSTSb�QZPu[�G�V h \�[�G�a$acUXHIG��G�\�[�_ h G�a#U]�$mobdP`\]HIQ^Y�moG'eR_`VWVWQSPRV+�dQS\ImobdP`\WH+Q^Y�\Wa�a�G h [�QSUWP`a&�WG h QZ§`G�m¨\][ h _RP¨[�QSHIGW�

¤�PRU][ E G h QSPX[�G h G�ac[�QSPRV�mRG'eR_RVXVWQSPRVC[�UdUWT#QSa � bdPu[�UÆ� > t6?¿�±\�ac[�\][�Q^Y7moG�eR_RVXVWQSPRVC[�UuUXT&��U h [ h \WY��dQZP`VUX_o[��¿U]� �¿e9UW_RP`m`a�\ h�h \ÆbIQSP`moQ^YG�a%QZP g \Wa�Y'\WTnTSQS�WG�T^\]PRVX_`\]VXG�a����¿[%Q^a#��U h H�\]TSTZb�en\Wa�G�m£UWP�\]e`ac[ h \WY[�QZPu[�G h �q h G'[�\�[�QZUXP+\WP`m�_`acG�a4\Wa�a�G h [�QSUWP`a�\WmRmRG�m+edb�[ E G�q h UXV h \]HIHIG h �l¤�a�acG h [�QZUXP`a$QSP � buPu[�UÆ��\ h G¢G�fu_RQZ��\WTZG�PX[[�UIUW_ h mobdP`\WHIQSYK\Wa�a�G h [�QSUWP`a&eR_o[%P`U�acUXTZ_o[�QZUXP¨Q^a#q h UWq9UXa�G�m7[�U�moG�\]T3��QZ[ E QSP`YU h�h G�Y[#\Xa�a�G h [�QSUWP`a��

��P=[ E G�\ h G�\�U]�¢ac[�\][�Q^Y�moG�eR_RVXVWQSPRV`�n[ E GI�&U h �¨� E UXa�G�a�qRQ h QZ[�Q^a{[ E GIYTSUXa�G�ac[�[�U¨UX_ h \WqRq h UX\XY E QSa[ E G{mRG'eR_RVXVWQSPRVK� h \]HIG'�&U h � H � �<� H �d[�G'P`moG�m � [�\][�Q^Y�� E G�Y��dQZPRVd�$q h G�a�G'Pu[�G�m+QZP2> �6?¿� D#E G'bIY E UdUXa�G#[�UmRG[�G�Y0[%\+TS\ h VXG{��\ h QSG[jb�UW��a�QZHIqRTSGKG h�h U h a¢TZQS�WGKPRQST3moG h G'��G h G'P`Y'G�a&U h UW_R[��¿U]� �¿enUX_RP`mRa�\ h�h \ÆbIQZP`mRQSY'G�a#QSP; UdmR_RTS\ �¿t`� D#E G%_`a�G h \WPRPRUW[�\�[�G�a4[ E G{q h UXV h \]Hre9G'QSPRV+Y E G�Y��XG�m+��Q©[ E a�qnG�YQZ§nY'\][�QSUWP`a¢YU h�h G�a�qnUXP`moQSPRV[�U7UX_ h mRbuPn\]HIQSY�\Wa�acG h [�QZUXP`a���¤ 5+�%�0� �-�)�+�*��+� �)����+���*��+�2���%���%� �+�(�+� [ h \WP`ac��U h HIa%[ E G+q h UWV h \WH \]Pnm[ E G¨a�q9G�YQZ§nY�\�[�QSUWPna�QZPu[�U�\ TSUWVXQSY�\]T���U h H�_RTS\�� E QSY E Q^a�qn\Wa�acG�m*[�U=\WP¡\]_o[�UWH�\�[�QSYI[ E G'U h G�H q h U��XG h �D#E G�q h UWeRTSG'H U]�#QZP`Y'U h�h G�Y0[�a�qnG�YQZ§nY'\][�QSUWP`a�QSa�PRU][�[ h G�\�[�G�m \]P`m�[ E G�q9U��¢G h U]�#[ E G�[�UdUWT±� E G'P PRUa�q9G�YQZ§nY�\�[�QSUWP+Q^a$VWQS�WG'P+Q^a$PRU][4moQ^a�Y'_`a�acG�m ��¤{a$QZPIUW[ E G h [�UdUWT^a$q h G�a�G'Pu[�G�m E G h GX�]�¢G&§`Pnm�P`U�G�fu_RQZ��\WTZG�PX[��U h UW_ h ac[�\][�Q^YK\Wa�acG h [�QZUXP`a'�

¤�PRU][ E G h¨h G�TS\][�G�m \ h G�\*Q^a�q h UWV h \WH �WG h QZ§nY'\][�QSUWP3� ; UXac[7acboac[�G�HIa�TZQS�WG > J�?�\WP`m [ E G=�¢U h �¡UW�kl_`Y�� E \]H²\]Pnm � _ ��_R�dQ >Zx � ?¢��UoY_na�UXP¡VWG�PRG h \]TSQ©[jb \]Pnm¡YUXH+q`TZG'[�G'P`G�a�a�Q^a�a�_RG�a�� D#E G¨T^\]PRVX_`\]VXG�a�UW�q h UXqnG h [�QZG�a [ E G'bK_`a�G±G'PnYUWHIq`\Xa�alUW_ h a3e`_o[�[ E G'b�\ h G4[�UdU h QSY E [�U{a�_RqRq9U h [l��_RTSTSb�\]_o[�UWH�\�[�QSY4\WP`\]TSboacG�a'�A�G h QZ§nY�\�[�QSUWP UW��q h UWq9G h [�QSG�aIQ^a�\XY E QZG��WG�m edb \*[ E G�U h G'H�q h U��WG h \]P`m moG�qnG�P`mRa E G�\Æ�dQZTSb�UXP _`acG h �a�_RqRq`TZQSG�m£q h UWq9G h [�QSG�a#a�_`Y E \Wa#TSUuUXq¨QSPd��\ h QS\WPX[�a'�

� � �+��� �'�� $����

*G E \Æ�WG%q h G�a�G'Pu[�G�m�\�ac[�\][�Q^Y�moG�eR_RVXVWG h ��U h [ E G�moG[�G�Y[�QSUWP7UW�3qnUXQZPu[�G h G h�h U h a�� D#E G�[�UdUWT h G�TZQSG�a¢UWP�\ac[�\][�Q^Y¢\WP`\]TSboacG h G'�d[�G'PnmoG�m���Q©[ E ��\XYQSTZQZ[�QSG�a���U h QZPu[�G h \XY0[�QZPRV���QZ[ E [ E G#_`a�G h � D#E G#QSPu[�G h \WY[�QSUWP�QSa�e`\XacG�mUXP�\¨TS\WPRVW_n\]VWG�U]�#aj[�\�[�Q^Y+\]P`m*mobdP`\]HIQ^Y�\Xa�a�G h [�QSUWPna'�@� E Q^Y E U C9G h a�\£��QSmRG�q`\WPRUWq`TZb UW�&moG�eR_RVWVXQZP`Vac[ h \�[�G'VXQZG�a'� �G�e9G'TSQSG'�WGK[ E \�[#[ E G�H�\]QSP�Y'UWPu[ h QSeR_o[�QSUWPna#U]��UX_ h �&U h ��\ h G{[ E GK��UWTSTSU���QZPRVn¥

¦ D#E G&H+G'[ E UomoUXTZUXVWb E \Wa�\�§ h H�a�G'H�\]Pu[�Q^Y'a�e`\XacQ^a'¥3\WP�UWq9G h \�[�QZUXP`\]TuacG�H�\]Pu[�Q^Y'a�QSa�_`a�G�m�[�U{mRG h QZ�XG\ YU h�h G�Y[K\WP`\]TSboacQ^a�\]TSVWU h QZ[ E H � h UXH [ E G¨acq9G�Y'Q©§nY�\�[�QZUXP3� D �¢UCmRQ C@G h G'Pu[��dQZPnm�UW�#\Xa�a�G h [�QSUWPna\ h G���U h HI\WTZTSb7moG'§`PRG�m£\WP`m¨QZPu[�G�V h \�[�G�m¨��Q©[ E QZP£[ E QSa���U h HI\WTZQ^a�H£�

¦ D#E G�[�G�Y E PRQSfu_RG�QSa¨q9U��¢G h ��_RT{G'PRUX_RV E [�U¡[ h \XY�� UW��qnUXQZPu[�G h G h�h U h a���QZ[ E QZP h G�Y_ h acQS�WGCm`\�[�\aj[ h _nY0[�_ h G�a'�

IJI ÇLK@M0N0M0N

Page 21: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

x � � �+������� �+� � ���

¦ D#E G�_nacG{U]�l\�en\Wa�QSa¢aj[�\�[�Q^Y�\WP`\]TSboacG h H�\]�XG�a4QZ[¢q9UXa�a�QZeRTSG%[�U�\Æ�XUWQ^m+Y'UWHIqRTSG��QSPX[�G h \WY[�QSUWP`a���QZ[ EVWG�PRG h \]T qR_ h q9UXa�G�[ E G�U h G'H q h U��WG h a��

¦ � [�\][�Q^Y�\]P`m�mobdP`\WHIQSYK\Wa�q9G�Y0[�a#U]��moG'e`_RVWVXQZPRVI\ h GKQZPu[�QZH�\�[�G'TSb7QSPu[�G'V h \][�G�m�QSP£UX_ h � h \]HIG'�&U h �@�*G�\ h G+Y'UWP`a�Q^moG h QZP`V¨a�G'�WG h \WT�QSHIq h U��WG'HIG�PX[�a{��U h UW_ h e`\XacQ^aK\]P`\WTZboa�G h TSQZ�XG�[ E GIQZPu[�G�V h \�[�QZUXP=U]�¢[ E Gh G�a�_RTZ[�alU]�oG�d[ h \%\WP`\]TSboacG�a TZQS�WG±TZQS�WG�PRG�a�al\WP`\]TSboacG�a3\]P`m�mRG'q9G'P`moG�P`YG&\]P`\WTZboa�G�a��l¤%P�QZHIq9U h [�\]Pu[�a�UW_ h Y'GUW��QZPRG ��YQSG'P`Y'b£QSPCUX_ h \WP`\]TSboacQ^a�Q^a%[ E G�_`a�G�UW�±moQSa�ij_RP`Y[�QSUWP`a��@� E Q^Y E Y'\]_nacG�a�[ E G�a�Q���G�U]�4q h UWq9G h [�QSG�a[�U�e9G�G�oqnUXPRG'Pu[�QS\WTnQSP¨a�q`\WY'G{��QZ[ E¨h G�acq9G�Y[¢[�U�[ E GKPu_`H�e9G h U]�l��\ h Q^\]eRTSG�a¢U]�3[ E G�q h UXV h \]H��l��P¨U h moG h[�UC\]TSTZG��dQS\][�G+[ E Q^a�q h UXeRTZG�H��l�&G E \Æ�WG�moG�a�QSVWPRG�m*\�P`G'� TS\WPRVW_`\WVWGIU]�#q h UWq9G h [�QSG�a g±h UXq �@[ E \][�moUdG�aP`U][�QSP`YTS_`moG7mRQSa�ij_RP`Y[�QSUWP`a�� E QZTSG�q h G�a�G h �dQZP`V�\ E QZV E TZG��WG'T±U]��\WY'Y'_ h \WYb=eub�_`a�QZPRV=H+U h GIQSPd�WUWTS�WG�mq h G�moQSY�\�[�G�a�� D#E G£��U h HI\WT&Y'U h�h G�acq9UWPnmoG'P`Y'G7e9G[j�&G'G�P g4h UWq ��\WP`m g±h UXq E \Wa+e9G'G�P G�aj[�\]eRTSQSa E G�m)��\q h UXqnG h [jb�UW� g±h UXq�Q^a4\WqRq h UÆ�dQSH�\�[�G�m�edb+\Kq h UXqnG h [jb�U]� g4h UWq �Ì��\]P`mI\]PIQSHIqRTZG�HIG'Pu[�\][�QSUWP�U]�9[ E G#[�UdUWTen\Wa�G�m�UXP�[ E Q^a h G�aj[ h Q^Y0[�G�m�a�G[&U]�lq h UWq9G h [�QSG�a±QSa¢_RP`mRG h �&\Æb�� [ E Q^a h G�ac[ h Q^Y0[�QSUWP E \Wa¢PRU�QSHIq`\WY[¢UWP7[ E GQSPu[�G h ��\XYGKTS\WPRVW_n\]VWG�_`a�G�m7��U h [ E G�QZPu[�G h \WY0[�QZUXP¨��QZ[ E [ E G�_`a�G h �0�

� ���]�%���������%

� � ��0 Î * Å�Í� ÊÌÇG � Î��@˺ÈcÄ � ��Ä�Ç ���¢Î � D �ÆÊ G����� 4 ·��½ 5 ·�½ · � ½ 4 � ��������� À �<4 �½ ·�� � 5�� ��� ����� ��� ·c¸¿¸#·���� � ��¸ GXÊÌÇ � ËED���jÈjÈ�ÆÊÌÇÆÃ0Í�D�Ï ��ÆÈ * ��� � & � � ��* '! "�# � D0Ç�Ï ÎTD0Ç � ËED0Ã0Ë¿Ä�� ��ÊÌÇÆà � Ä�ÇÆÃ0ÅÆÄ�Ã0È & ÈjÍ ÊÌÃ0Ç�Ä�Ç � & �HF*3ÌÈ ��ÈjÇ ¿Ä� Ê�D0Ç� �%& &� "�# G%$0ÅÆÇXÎ ��"�"�# G�F�FuÎ+N "�& � M &'� Î

� N � I Î � Î%� D�(ÈjË�Ä�Ç �)$ÆÎ � D>D0˺È<G+*-, � »�À]¹�½ � ½ 4 � ���/.��10#4 �2G * �cÄ �ÆÈ ��Ê � � Ë ÈcÍ Í2G ' È�243�D0Ë �lG ' 3:G ��"�5�" Î� M ��1 Î�� D0ÅÆË �*D0Ç �e3ÌÈ#G6*!7 ¸¿½8� � � ½ 5 · 7 ¹ 090#4 0��1�;:&4 0�: ·���< � � 5 ·�� 4 »�À�·�� � ½ 4 ¾�· � � 0 ¹ ��0 ·c¸ GdÊÌÇ � ËED �jÈjÈ�ÆÊÌÇÆÃkD�Ï� �ÆÈ * ���� & � ����* '; " M � D0Ç�Ï�Î�D0Ç � Ë D0Ã0˺Ä�� ��ÊÌÇÆà � Ä�ÇÆÃ0Å�Ä�Ã0È & ÈjͺÊÌÃ0Ç{Ä�Ç � & �HF*3ÌÈ ��ÈjÇ ¿Ä� Ê�D0Ç � �%& &� " M*G%$0ÅÆÇXÎ " M�Î

� # � � Î & Å �cÄ�ͺÍ>=È<G?* À%� �90 » � ½ 4 � ¸¿¹'��¾�· �@���;� ¹�½ � » � ½ · 5 5 · 7 ¹ 0�0#4 0 Î � Î 1 ËºÊ �AcÍED0ÇG�È�ÆÊ ED0Ë2G � Ë D��jÈcÈ�ÆÊÌÇ�Ã0Í]D�Ï ��ÆÈCB�ËºÍ & Ç ÈcË Ç�Ä� Ê�D0Ç�Ä)3 H D0Ë ��Í���D<FhD0Ç * Å D �%Ä� È��Ä�Ç � * 3ÌÃ<D0Ë Ê � ��Ê � & ÈEDÆÅÆÃ0Ã0ÊÌÇÆÃÆÎ � ÄE( ��"�" M�Î � ' � �)59#�" G � FÆË ÊÌÇÆÃ0ÈjË��I ÈjË 3 Ä�ÃÆÎ

� F � & Î � Î & ÈE3ÌÈ�ÏSÍ G%* HG ¾�·���¾ 4 ·�I ��� ½ : · �KJ ½ ·� 5 · 5@L ½ � ½ 4 �M, : · ��N 4 0OL?� ¸¿½ ·c» G6 �����QP � � 5�5�5 0 � 0 340 � ��� 6 0 ��,�R�, � � 1 0 �� � ��S�TVU � 0 3 � ��W 3 �50 6 � � 1 Î

� X � & Î �KY Ä�ÇÆÍ2G[Z ¸ 4 0 ¸^À�· � 4 \ � � ½ 4 � �¸�½ � � : · �EN ¸ � ¹'� � · � �25 · GlÊÌÇ 0 È� �ÆÇÆÊ �cÄ)3 I È F�D0Ë 2G � &�0 � Ä�D7Ï6D0Ë �eD �HFÆÅ ÈjËÍ��jÊÌÈcÇ �cÈ<G?$0ÅÆÇuÎ ��"�"�# Î

� 5 ��� Î 1 Ë¿Ä �ÆÈ� G I Î+�$Ä�Å�Ã0ÇÆÈ�Ä�Ç � & Î � È � =È�ºÄ�(ÈjË2G]* 4 � ·�� ·� � · ��� 0V� � 4 ½ : » ��� ��½ : ·±¸¿½ � ½ 4 � ¾�·�� 4 \ � � ½ 4^� ��� À �<4 �½ ·��» � 4 À]¹ � � ½ 4^� G &('BI)&+*�I ÈjͺÈcÄ�Ë�� � I ÈeFlD0Ë JN�_ "�F G%$0ÅÆÇuÎ ��"�"�X Î

� _ ��� Î 1 Ë¿Ä �ÆÈ� G I Î+�$Ä�ÅÆÃ0Ç�È�Ä�Ç � & Î � È � =È�¿ÄE(ÈjË2G L ½ � ½ 4 � 5 ·�½ · � ½ 4 � �1� À �<4 �½ ·��4·���� � ��¸j¼ � � J 4 � » � ½ 4 ¸ � ½ 4^� � 5@�� : · �EN 4 0M��� 0V� � 4 ½ : » G�FÆËED �0Î � ÅÆË D<F]ÈcÄ�Ç � ( �HF�D0ͺÊÌÅ � D0Ç � Ë D0Ã0˺Ä�� ��ÊÌÇÆÃ�G ��� �]�` "�X G � ' � �)��&�F _*G * F�Ë�Î ��"�"�X Î

� " � I ÎVa�Ä�Í ºÊÌÇ�Ã0Í Ä�Ç �b��ÎV$<D�( �cÈ<G]c ¹>� 4 ��� ¼�d � ¸¿½6e4·�½ · � ½ 4 � ���gf ·�» � � �;. · � N ¸ � 5 *h��� ·c¸¿¸ � ��� � ��¸ GÆÊÌÇ � Ë D��Î#D�Ï ��ÈH ÊÌÇ ºÈjËhi�ͺÈjÇÆÊ j � D0Ç�ÏZÈj˺ÈjÇ �jÈ<G%$Ä�ÇuÎ " N�Î

� ��& � � Î � Î>a�Ä�Ç�'ÊÌÇG & Î � È � =È�ºÄ�(ÈjË2G e±·�� 4 ¾ 4 0O��� 0V� � 4 ½ : »&¸ � � � » ½ � À�· 4 � ·���·� � ·4¸ � ¸¿½^·�»&¸�¼ * ÀÀ � 4 � � ½ 4 � �½ � ¸¿½8� 4 � ½8<]·c¸¿¸ � ��� � ¸ 4 ¸ GcF�Ë D��Î * ��� � ( �HF�D0ͺÊÌÅ � D0Ç � Ë ÊÌÇ �jÊ�F�3ÌÈjÍXD�Ï � ËED0Ã0Ë¿Ä�� ��ÊÌÇÆà � Ä�Ç�Ã0Å�Ä�Ã0ÈjÍ2G ��"�"�# G�F�FXÎ N & N9� N � N*G$Ä�ÇuÎ ��"�"�# Î

� ��� � & Î � >=ÈeF ��Ä�ÇGhk � ¹�¾�· � � ·�¸ �E� 5�� ½ 4 � �¸¢À � ¹>� � � À%� ��0 � � »¢» � ½ 4 � �·� � ��0<4^l ¹Æ· 5<4 ¸nm � � ½ 4 ¾�· G ���oÈjÍºÈ �ÆÈ �*D ��ED0Ë¿Ä� GilÇÆÊ Y ÈjËºÍ Ê >=È �ÆÈ I ÈjÇÆÇÆÈjÍ � G �p=È�jÈ �qDÆËºÈ ��"�"�F Î

� � N � & Î�$Ä � �'Í D0ÇOGr* ¸^À�· � ½�¼ � I· � � � » 4 � ��� 7 ¹ 0 < 5 ·�½ · � ½ � � GWÊÌÇ � ËED �jÈjÈ�ÆÊÌÇÆÃ0ÍjD�Ï � M �8s & Ç ÈcË Ç�Ä� Ê�D0Ç�Ä)3 � D0Ç�ÏZÈj˺ÈjÇ �jÈ D0Ç� D�Ï t23Ä�Ë È � ÇÆÃ0ÊÌÇÆÈjÈj˺ÊÌÇ�Ã�G � Ä�( ��"�" N*G�F*FuÎ � M9� N0N�Î

� � M � � Î'$<D �ÆÇ�Í D0ÇG .�4 �½�u � , À%� ��0 � � » � : · �EN ·�� G � D �HFÆÅ ÈjË � �jÊÌÈjÇ �jÈ È � �ÆÇÆÊ �cÄ)3XË ÈeFlD0Ë 2G'�@Èe3�3 � Ä�D�D0Ë¿Ä�ED0˺ÊÌÈjÍ2G � ÅÆË Ë¿ÄE(alÊ�3�3 G ' a7G]$Å*3 ( ��"�5 _�Î

&('BI)&+*

Page 22: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

����������� ����� ��� ��������������� � � � ��!#"%$&'���(�)���*��+�,���-�.�+���/���%�#�%�0� �+�)"1���2�3�3�%�4�)"0��56�7 �����8"0���0�.�%�*�4� �0" x�y

� �E# � & Î � Å � ����Ä�� Ä�Ç � ' Î � Å]AjÅ�'Ê G�� ·�� 4 \ � � ½ 4 � ���q� ��� ��� u`� · � � � 5 u � 5 À �#4 �½ ·�� � À�·�� � ½ 4^� �¸ 4 c � ¸ � ��� GuÊÌÇ * ���0 ˺Ä�ÇÆÍ¿Ä �� Ê�D0ÇÆÍ]D0Ç � ËED0Ã0Ë¿Ä�� ��ÊÌÇÆà � Ä�ÇÆÃ0ÅÆÄ�Ã0ÈcÍ�Ä�Ç � � (�Í ºÈ ��Í2G I D<3^Î � G ' DÆÎ N*G � ���Î ��"�5�" G�F�FuÎ�N0N X � N #�# Î� ��F � I Î � È ��Ã0ÈE2lÊ � ��G�* � 0�� � 4 ½ : »&¸ G * � ��ÊÌÍ D0Ç'� H ÈjÍ 3ÌÈ�(�FÆÅ]D�3ÌÊÌÍ��ÆÊÌÇÆÃ�� D �HFÆÄ�ÇV(#G ��" _�_�Î� ��X � I Î � Ë D �rÄ�Ç � & Îr39Èe3�3ÌÊÌÇG � J ½ ·� 5<4 0 ½ � À�·�¸¿½ � ½^· � : · �EN 4 0 ¹�¸ 4 0 � � 5<4 ½ 4 � ���h� 4 ¾�·�]·�¸º¸ � ��� � ¸ 4 ¸ GnÊÌÇ & ��� �0 ˺Ä�ÇÆÍ¿Ä �� Ê�D0ÇÆÍ]D0Ç � D�Ï t23Ä�ËºÈ � ÇÆÃ0ÊÌÇÆÈjÈj˺ÊÌÇÆÃ�G I D<3^Î ��" G ' D F G � Ä�(Î " M*G�F*FuÎ #V5 _9� # _ F Î� ��5 � $ÆÎ I DÄ�Í@Ä�Ç ���&Î � Ê�3�3ÌÈjË2G�c ¹�½^½ 4 0 * ¸º¸�·���½ 4 � �¸ 4 �� : · 4 � c � � � · GÊÌÇ � ËED �0Î<D�Ï ��ÆÈ & Ç� 3^Î � ( �HF�D0ͺÊÌÅ � D0Ç � D�Ï t23Ä�Ë È

I Èe3ÌÊ Ä�DÆÊ�3ÌÊ t( � Ç�Ã0ÊÌÇÆÈjÈcË ÊÌÇÆÃ�G ' D Y È ��D]ÈjË X��>" G ��"�"�# G � D0Ç� Èj˺È�(#G � * Î

IJI ÇLK@M0N0M0N

Page 23: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

J � � �+������� �+� � ���

7 � �*����C� �

FÆà � ��� � Í � Í� �� ��� � ,.- � È�j*F � Í� �� 0212340 Í � & Ï � Èe3ÌÍ È

� 5�67,81#0 � È�j*F � Í� �� H �ÆÊ�3ÌÈ]3�D&D<F� Í � 9 Í� �� � È � ÅÆÈjÇ �jÈ� 3ÌÈ�j&F � È�j&F * ÍºÍ ÊÌÃ0Ç ��ÈjÇ�� - � 0�0 � 3ÌÈ�j*F � I ÅÆÇ Ê ��È �ÆÈcÄ)3�3�D �cÄ� Ê�D0Ç� � & F�Ë D<F # Í � � & (�ÇÆÄ���Ê �XFÆ˺È���Ä�Í ÍºÈjË� Ê�D0Ç� � Í � ()& F�Ë D<F � & (�ÇÆÄ���Ê �XF�D0Í� ��Ä�ÍºÍ ÈcË ºÊ�D0Ç� � � F�Ë D<F��`Í� �� � � ¿Ä� Ê �$FÆ˺È���Ä�Í ÍºÈjË� Ê�D0Ç� � Í � �� � FÆËED<F � � ¿Ä� Ê �$F�D0Í� ��Ä�ÍºÍ ÈcË ºÊ�D0Ç� � Í � � � FÆËED<F � � ¿Ä� Ê �4ÊÌÇ Y Ä�ËºÊ Ä�Ç

È�j*F ��� � 495 I Ä�Ë Ê Ä�D�3ÌÈ � 465/C & � �� B 495 � D0ÊÌÇ ÈcË �ÆÈj˺È�ÏZÈj˺ÈjÇ �jÈ� 8 495 * � �ÆË ÈjͺÍ,D<F]Èc˺Ä� D0Ë� � 1�1 �� � t(*F]È � I ÅÆÇ Ê ��È�Ä)3�3�D �cÄ� Ê�D0Ç

3ÌÈ�j*F ��� � 495� B 495

�QZVX_ h GIx �o¥�¤%e`ac[ h \WY[%acbdPu[�\]�7U]��[ E G�q h UWV h \WHIH+QSPRV+TS\WPRVW_n\]VWG

&('BI)&+*

Page 24: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

����������� ����� ��� ��������������� � � � ��!#"%$&'���(�)���*��+�,���-�.�+���/���%�#�%�0� �+�)"1���2�3�3�%�4�)"0��56�7 �����8"0���0�.�%�*�4� �0" JRx

� � ���������� ������������������ �"!#�%$&��('�() �*����+�,�-.,/�10324��('�() �5!6�(' '�() ) $�78:9��� +�,;-., �=<?>%@;�=A 0 2�BDC�EFB 0�GF�� � �"!6�(' '� ) )

� � ���;��H4I J�� ������������������ �"!#�%$&�� '�() �*����+�,�-.,/�10 G �� '�() �5!6� ' '�() ) $ 8:9��� +�,;-., �=<?>%@;�=A 0 2�BDC�EFB 0�GF�� � �"!6�(' '� ) )

� KMLN� I ������N�. �O� ����� �1���P� � �5!#��$&�P� '�() �Q��� +�,;-., ��0SRTDU�< CDB @;�=AM0 �� '�() �5!6� ' '�/) ) $=78V9����+�,;-.,(�MTWU�< CWB @;�=AM0X������5!6� ' '� ) )

� KMLN� I ���;��H4I J�� �Y� ����� �1���P� � �Z!#�%$4�� '�() � $ 8V9�Y��+�,�-.,X��TDU�< CDB @;�=A 0X�P���1�5![�('� )

� J�]\F ��� +�,;-., ��0 2 �� � �O!^� '�() ��� +�,�-�, �10�G_�� '�() �5!6� ' '�() )����+�,�-�,(�10324R.0 G ����M�5!6�/' '� ) )

� H&JJ� `FaW �Y�cb �������1d_2&����M�5!#�%e�2?�� '�() �*���������f�%d G �� '�() �5!g� h H&I G �� ' '�() ) ��Z��+�,;-.,X�%dF2 8 d G �P���1�5![�(' '� ) ) � h H4I G?i eN2

� �;����� �Z�����.�j�%d�����1�Z!g�%ek����M�����+�,;-.,(�M>Wl BDB @;d_Am�P���n�Z!o��� ) e�prqs�kq ' 8 qutwv&e�x

� � I I �]`DH&I �Z��+�,;-.,X�%0X����1�O!y< CDCDBFz�{WC}| �L��]�KM� J� @ H&~]~]��JJn� | e�7p�q�A� ���NaN� �� | a | � �������� h H4�P �Z�������f�����c������5!#�M���n@��S@;�;�WAA]�P���M�*�S@;���DASprq

� � a����P �������������;�k����M�5!#��ec�� '�() ����������f�w�����c���� �"!#�M� '�() @;eDA]�� '�() � e�prq '

� H&������]JJP ���cb ���������;�k�P��� �5!#��ec�� '�() ��Y� ����� �1�%�;�c�� � �5!g��ek�� '�/) �

� H&I I | ~� �Y�������f� {DCDCW��� @���A]���� �"!#��ek�P� '� ) ��e�7p�qs��q ' 8 q:��v4eNxD�3� '�() 8 ���O�wv&ej���=x

� �akH4��D ������������������ �5!g��h H4I �� '�() ���� ����� ���������P� � �Z!#�%�r@;�.�cA]@�h H4I A]�� '�() �

� ��� acH&��F �������������n2?�P���1�Z!#��h H&I 2?�� '�() ���Y���������1� G �P� '�() �"!#�Mh H&I G �� ' '�() ) ��������������%2.����� G ������5!#���r@;���NA]@�h H4I 2?�h H&I G A]�� ' '�() ) �

� � I I �]`DH&I ������������������1�O!#�=�j�?< CWCDBFz�{DC � | �L��]�K � J� @ H4~]~]�]JJ�� | e�7prq�A� ���Na�� �� | a | � � b ������ h H4�P �Y�cb �������n�;�c���� �"!#�M�S@;���DA]���� �

� � a����P �O�������f�n�;�c���� �"!#��ek�� '�/) ��O� b ����� ���S�;�c�� � �5!g��ek��/'�/) �

���V��@ q���� H4I A��wvD< CDCWB_z�{WC xW���5��  � �¢¡ ��� �q¤£M¡ ��� �s� H&I 8¦¥ H&J� ��¡ ��� � ¥ H&J� 8u¥ |D| I �1  aD� �j§]§?§¨�© p"  � ��ejp"¡ ��� �sh H&I p"� H4I

�QSVW_ h GIx�}`¥ ��bdP`\WH+Q^YKacG�H�\]Pu[�Q^Y'a&��U h aj[�\�[�G�HIG'Pu[�a�\WP`m£G�oq h G�a�acQSUWP`aIJI ÇLK@M0N0M0N

Page 25: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

JXJ � �+������� �+� � ���

� � � � � � ��,81�1#0�R � 1 � � ����� ¸�·� � � %*��� %#� � � �� � � � � ��� � %*�2� � �� � ��� � ��� � %<� � � �� � �� � � % � +-.% � � � �� � � � ��� ������� ������� � � � ��� � % � � � �� � ������� � � ��� � % � � � �� � � �

� � � � ���7�� � � ��� ��������� �� � � � ���7� � %HC���������!� � ��� � %7� � �� � �

��� � ��������� � � �� � � � ����� ����� � �� � � Ä�Ç � ��� � ��� � � ���� �� � � ����!���� � � �� � � � � � � ����� � �� � � D0Ë � � � ��� � � �7 � �

� � � "�� � � �� � � � Ç*D � � � � � � � �� � �%�� � � 0 ˺Å�È � � �� � � � ½^��¹Æ·� � � 1 Ä)3ÌÍ È � � �� � � � ����� ¸�·

� ��� � ;#=)?#@BA�� � �� � � � �� ��� � 8 495 � � �� � � � � � 4954�� ��� � 495 � � �� � � � � � � � 465#�%�� ��� � B 495 � � �� � � � � � � ��� � 4652� � �� � ���

�QSVW_ h GIxÆzo¥±�¢U h�h G�acq9UWP`mRG'P`Y'G h G'T^\�[�QZUXP

� %*���(%#���O��� � � � %#��� %*� � 8 B %:� % B 8X% �(% %*��� %#� � B %&��� B %#�% � % % � �(% � ��% � � % � �.% � �(% � % � � % � �.% � �(% �

% +- B % %*��+-.%#�� � %#�j� B %*�8�O! � B %*��+- %#����� � ;#= ?#@eA � B � � ;#= ?>@BA%*��+- � � � +-.%<� �.%*�'+-.%#� 2lÊ �� �"!C��

1 Ä)3ÌÍºÈ � � � � � � �.0 Ë ÅÆÈ��� � � ��� � �

� � ! � � � ���� � ��� ���� ���

� � � � �� � ��� � � ���

� � � � ��� ����������� ��� ���������� ��� ��� � ����! ��� ��� � ����! ���

�QSVW_ h GIx �`¥ g \ h [�QS\WT@U h moG h \]Pnm7G�fX_`QZ��\]TSG'PnYG�a#UXP¨q h UXqnG h [�QZG�a������ h � [�\&�

&('BI)&+*

Page 26: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

����������� ����� ��� ��������������� � � � ��!#"%$&'���(�)���*��+�,���-�.�+���/���%�#�%�0� �+�)"1���2�3�3�%�4�)"0��56�7 �����8"0���0�.�%�*�4� �0" JWt

� ��*) � �� � � � )���� � � � � � � � + )��O� � � � �� ��/,.- � )/��c� 0212340 � � � ��! � � �

� ��*) � �� � � � )�� � ��� ���5�67,81#0 � )/�� � � � + )�

� ��� � � � � � � � � �� � � � �� ����� � O� � � �

� �� B 495 � �� Ê Ï � � " � B 465]� ;#= ?>@BA!�

� �� - * � 1�1 �� ��� � � � ������ I Ä�Ë

" ��� �(% � ��" � B � �(% � � � B � +- ;#= ?#@eA!� �

� ��(- � 0�0 � % � � � � Ê Ï � � � � � ;>= ?#@BA � B % � � � � ��'%&� � �� � ��,%#� � �� � � � � � %#��� %&� � � �

� ���%*� * %#� � � �

� ��*) � �� 2�Ê �� )7�:495 G 8 495

� � � � � � � �� � � � � � � � �� ��� � � � 2@È�Ä��0ÈjÇÆÊÌÇ�Ã

�QSVW_ h GIx�yR¥�¤%�dQSUWH�\][�Q^Y'a#U]��ac[�\�[�G'HIG'Pu[�a�\]P`m¨G�oq h G�a�acQSUWPna

IJI ÇLK@M0N0M0N

Page 27: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

J � � �+������� �+� � ���

� � ��� � ��� � � %#��� %&� � � � � � � � � � %<��� %*� � � � �O� � � � � � %#� � %*� � � � �� � ��! � ��� � � %#��� %&� � � � � � � � � � %<��� %*� � � � �O! � � � � � %#� � %*� � � � �

� " � � � � %#��� %&� � � � � " � � � � %#��� %&� � � � �� % � % � � � � % � � % � � � � � % � � % � � % � � � � � % � � � % � � % � � � � � % +-.%2�"� � � %#��� %&� � � � � � �%���%/+- �%2����k" ���%/�(8X%&�8�%�

! �����% +- � +- �% � ��k" ���%/�(8X%&�8��k" � � � 8X%*�8��� ���� ��C���� � " ���% +- ����! ������ �%2�!�! " �����+- �%2���%� �2�Ê �� ��H� �%� � % � � % � � � � � �% � % � � % � � % � � � � Ä�Ç � �% � � % � � � % � � % � � � �

0 Ë ÅÆÈ � � %#��� %&� � � � � 0 ˺ÅÆÈ1 Ä)3ÌÍ È � � %#��� %&� � � � � 1 Ä)3ÌͺÈ8 �� � � %#��� %&� � � � � 8 ���� � � % � � % � � � � � % �¢Ê Ï � � � 8 �� �(8X% � �

� �� Ê Ï � � " � 8 �� � 8X%*�8�B 495 � � %#��� %&� � � � � %#� Ê Ï � � � 465 � � %#� � %*� � � � � 8X%&� �

� B � 495 � � %#� � %*� � � � � Ê Ï � � " � 465 � � %<��� %*� � � � �(8X%&�8�;#= ?>@BA � � % � � % � � � � � ;>= ?#@BA

�QZVX_ h G�J � ¥ �{G§`PRQZ[�QSUWP UW��a�_Re`ac[�QZ[�_o[�QZUXP���Q©[ E \]TSQS\XacQSPRV

)j�'(�( )�� � )$��� )]� )$� � � )�� � )$��! )]� + � %*� ;1* %#��� � %*��� %#�; � )j�.(�( )��#� � ; )j��! ; )�� ; � )j� � � )]�#� � ; )$��� ; )]� + � %*� *�* %#��� � " � %*���(%#���

%&� *�* %#� � %*��� %#� %*� ;1* %#� � " � %*���(%#���) � 0 ˺ÅÆÈ D ��ÆÈjË�2lÊÌͺÈ

�QZVX_ h G�JRxW¥ ��G'§`PRQZ[�QSUWP UW� �

&('BI)&+*

Page 28: Static Debugging of C Programs: Detection of Pointer Errors in … · 2016. 12. 27. · Static Debugging of C Programs: Detection of Pointer Errors in Recursive Data Structures Ronan

Unit e de recherche INRIA Lorraine, Technopole de Nancy-Brabois, Campus scientifique,615 rue du Jardin Botanique, BP 101, 54600 VILLERS LES NANCY

Unit e de recherche INRIA Rennes, Irisa, Campus universitaire de Beaulieu, 35042 RENNES CedexUnit e de recherche INRIA Rhone-Alpes, 655, avenue de l’Europe, 38330 MONTBONNOT ST MARTIN

Unit e de recherche INRIA Rocquencourt, Domaine de Voluceau, Rocquencourt, BP 105, 78153 LE CHESNAY CedexUnit e de recherche INRIA Sophia-Antipolis, 2004 route des Lucioles, BP 93, 06902 SOPHIA-ANTIPOLIS Cedex

EditeurINRIA, Domaine de Voluceau, Rocquencourt, BP 105, 78153 LE CHESNAY Cedex (France)��������� ���� ���� N�� � ��� R��

ISSN 0249-6399