Experiments with property driven monitoring of C programs

Monitoring is a dynamic technique that observes executions of programs and detects errors at runtime. The key issue in monitoring is performance overhead: if the overhead is too high, then monitoring takes too long to terminate or runs out of system resources. This thesis investigates aspects of monitoring for bug detection, seeking implementations that identify errors precisely and that have overheads acceptable for use with testing. These concerns are addressed by instantiating monitoring analyses for the problems of memory leaks and disclosure of confidential information, and using experimentation to investigate incurred overheads. A generalisation is then provided over primitives identified during the instantiations. This enables monitoring via abstract specifications aimed at reducing the cost of developing monitoring analysis from scratch. First, this thesis presents an approach to memory leak detection. The key issue addressed by the author’s technique is detection of locations where the leaked memory was lost. Leak detection is enabled by tracking each allocated memory block and computing the dereference of the block’s address space. This represents reachability of the memory block with respect to program variables. Unreachable blocks that have not been de-allocated by the program are reported as memory leaks at the end of execution. The locations of leakage are given by the locations where blocks were last reachable. The results of experimentation with the prototype implementation for C programs indicate that, for monitoring test suites of UNIX utilities and programs selected from the Standard Performance Evaluation Corporation (SPEC) CPU datasets, the overheads of the present approach compare favourably to the results produced by the Valgrind memory debugger. This thesis also describes an approach to preventing leakage of sensitive information used by a program. The technique analyses values and has the ability to identify whether a disclosed value represents an information leak with respect to the values considered secret at runtime. This is enabled by tracking secret values and checking whether assignments transfer secret values to publicly observable locations. A prototype implementation for C programs was used to analyse security-oriented UNIX utilities and programs chosen from the SPEC CPU datasets. The results of the experiments indicate that the overhead required to detect password disclosure in real