Detecting memory errors via static pointer analysis

We study the applicability of pointer analysis algorithms (originally aimed at optimizing compilers) to identify potential errors such as dereferencing NULL pointers in C programs, by statically analyzing the behavior of programs on all their input data. The algorithms are conservative, i.e., they never miss an error but may also create \false alarms". Our goal is to identify the \core program analysis techniques" that are needed to develop a realistic tool that does not generate too many false alarms. Our experience indicates that the following techniques are necessary: (i) nding aliases between pointers, (ii) ow sensitive techniques that account for the program control ow constructs, (iii) partial interpretation of conditional statements, (iv) analysis of relationships between pointers, and sometimes (v) analysis of the underlying data structures manipulated by the C program. Our experimental work shows that the combination of these techniques yields better results than those achieved by state of the art tools. ACKNOWLEDGMENTS I would like to thank all those who contributed to the completion of my thesis. Special thanks are dedicated to Dr. Mooly Sagiv, for his profound guidance and tutoring and for his constant support and encouragement. To Prof. Michael Rodeh, who has dedicated considerable time to supervise and review the course of the research. and the whole PAG development team from Saarlandes University for providing me their tool and to Prof. Susan Horowitz for the support with PAG's C-frontend, all of which have enabled the easy and fast implementation of the analysis. I would also like to thank Prof. Tom Reps for all those valuable advice throughout the thesis.