Pentagons: A weakly relational abstract domain for the efficient validation of array accesses

摘要

We introduce Pentagons (Pntg), a weakly relational numerical abstract domain useful for the validation of array accesses in byte-code and intermediate languages (IL). This abstract domain captures properties of the form of x∈ |a, b| ∧ x < y. It is more precise than the well known Interval domain, but it is less precise than the Octagon domain.rnThe goal of Pntg is to be a lightweight numerical domain useful for adaptive static analysis, where Pntg is used to quickly prove the safety of most array accesses, restricting the use of more precise (but also more expensive) domains to only a small fraction of the code.rnWe implemented the Pntg abstract domain in Clousot, a generic abstract interpreter for.NET assemblies. Using it, we were able to validate 83% of array accesses in the core runtime library mscorlib.dll in a little bit more than 3 minutes.