Abstract: A method for detecting defects in a computer program.

Abstract: A method for performing path-sensitive data-flow analysis for use in error checking functions includes identifying at least a first instruction and a second instruction in a control flow graph of a function. The identified first instruction and second instruction are connected by at least a first control flow path and a second control flow path. The method further includes defining a path condition between the first instruction and the second instruction as a complex disjunction including a first conjunction of predicates for the first control flow path and a second conjunction of predicates for the second control flow path.

Abstract: A method for performing path-sensitive data-flow analysis for use in error checking functions includes identifying at least a first instruction and a second instruction in a control flow graph of a function. The identified first instruction and second instruction are connected by at least a first control flow path and a second control flow path. The method further includes defining a path condition between the first instruction and the second instruction as a complex disjunction including a first conjunction of predicates for the first control flow path and a second conjunction of predicates for the second control flow path.

Abstract: In general, in one aspect, the invention relates to a method for static analysis. The method includes: obtaining source code; constructing a control flow graph (CFG) corresponding to the source code, by identifying control structures within the source code, creating a set of graph nodes of the CFG, and creating a set of directed graph edges of the CFG connecting the set of graph nodes; assigning a first Boolean flow value to a selected node of the set of graph nodes; backward traversing the CFG from the selected node to a target node; computing, by a computer processor and while backward traversing the CFG, disjoint predicate expressions representing flow values at the set of directed graph edges; computing, based on the disjoint predicate expressions, a resulting disjoint predicate expression; and identifying, based on the resulting disjoint predicate expression, a potential program property in the source code.

Abstract: A method for detecting defects in a computer program.

Abstract: A method for detecting defects in a computer program.

Abstract: A method for overflow detection using partial evaluations. The method includes obtaining a section of code from a source code file stored on a storage device, analyzing the section of code to identify a buffer with an index, determining a plurality of statements that are statically-computable and dependent on the index of the buffer, and generating a code segment including the plurality of statements. The method further includes replacing an access statement of the plurality of statements with a conditional statement returning true when bounds of the buffer are exceeded, where the access statement uses the index to access the buffer, adding an unconditional statement returning false to the code segment, and executing the code segment on a computer processor to obtain a determination of whether the bounds of the buffer are exceeded.

Abstract: A method for analyzing a set of potential bug statements in source code. The method including obtaining a set of static program analyses; recursively reducing the set of potential bug statements in the source code by: selecting a static program analysis for each recursion from the set of static program analyses in order from least time consuming to most time consuming; evaluating the set of potential bug statements using the static program analysis of the set of static program analyses to determine a subgroup of bug free statements of the set of potential bug statements in each recursion; and removing the subgroup of the bug free statements from the set of potential bug statements to reduce the set of potential bug statements in each recursion; thereby filtering at least one subgroup of bug free statements out of the set of potential bug statements in the source code.

Abstract: In general, in one aspect, the invention relates to a method for identifying program properties in source code. The method includes: identifying a set of program objects corresponding to a potential program property within the source code; identifying a function associated with the set of program objects in the source code; identifying an input and an output of the function in the source code; creating a value flow graph by: creating a function input node representing the input; creating a function output node representing the output; identifying value flow functions, where each value flow function defines a conditional dependency between a pair of graph nodes, and creating, based on the value flow functions, directed graph edges modeling a potential flow of data through the value flow graph; and identifying a feasible path in the value flow graph depicting an occurrence of the potential program property in the source code.

Abstract: In general, in one aspect, the invention relates to a method for performing points-to analysis by generating a value flow graph for source code. The method steps include: initializing the value flow graph including a set of memory objects and a set of edges based on Base and Assignment instructions, where the set of edges represents inclusion constraints between the set of memory objects and a set of pointer variables; determining a pointed-to-by set including at least one pointer variable of the set of pointer variables; updating the value flow graph by introducing a flow edge based on an indirect reference, where the flow edge is related to a memory object of the set of memory objects that is added to a working list; updating the pointed-to-by set based on the memory object in the working list; and analyzing the source code using the pointed-to-by set.

Abstract: In general, in one aspect, the invention relates to a method for static analysis. The method includes: obtaining source code; constructing a control flow graph (CFG) corresponding to the source code, by identifying control structures within the source code, creating a set of graph nodes of the CFG, and creating a set of directed graph edges of the CFG connecting the set of graph nodes; assigning a first Boolean flow value to a selected node of the set of graph nodes; backward traversing the CFG from the selected node to a target node; computing, by a computer processor and while backward traversing the CFG, disjoint predicate expressions representing flow values at the set of directed graph edges; computing, based on the disjoint predicate expressions, a resulting disjoint predicate expression; and identifying, based on the resulting disjoint predicate expression, a potential program property in the source code.

Abstract: A method for detecting user input dependence in software code. The method including representing the software code with a reachability graph having: a plurality of nodes, where a root node of the plurality of nodes represents an input controlled by a user; a first directed edge connecting a first node of the plurality of nodes and a second node of the plurality of nodes, where the first directed edge represents a data dependency; and a second directed edge connecting a third node of the plurality of nodes and a fourth node of the plurality of nodes, wherein the second directed edge represents a data dependency. The method also includes identifying a fifth node of the plurality of nodes as a reachable node from the root node by traversing the reachability graph from the root node to the reachable node; and marking a portion of the software code represented by the reachable node as user input dependant.

Abstract: In general, in one aspect, the invention relates to a method for identifying program properties in source code. The method includes: identifying a set of program objects corresponding to a potential program property within the source code; identifying a function associated with the set of program objects in the source code; identifying an input and an output of the function in the source code; creating a value flow graph by: creating a function input node representing the input; creating a function output node representing the output; identifying value flow functions, where each value flow function defines a conditional dependency between a pair of graph nodes, and creating, based on the value flow functions, directed graph edges modeling a potential flow of data through the value flow graph; and identifying a feasible path in the value flow graph depicting an occurrence of the potential program property in the source code.

Abstract: In general, in one aspect, the invention relates to a method for performing points-to analysis by generating a value flow graph for source code. The method steps include: initializing the value flow graph including a set of memory objects and a set of edges based on Base and Assignment instructions, where the set of edges represents inclusion constraints between the set of memory objects and a set of pointer variables; determining a pointed-to-by set including at least one pointer variable of the set of pointer variables; updating the value flow graph by introducing a flow edge based on an indirect reference, where the flow edge is related to a memory object of the set of memory objects that is added to a working list; updating the pointed-to-by set based on the memory object in the working list; and analyzing the source code using the pointed-to-by set.

Abstract: A method for demand-driven symbolic analysis involves obtaining a section of code comprising an instruction from a source code file and determining a critical variable in the section of code and data dependencies related to the critical variable. The method further involves iteratively computing a symbolic value representing a range of values of the critical variable according to the data dependencies, determining a set of control predicates relevant to the critical variable at the instruction, refining the range of values according to the set of control predicates to generate a second range of values for the symbolic value, and reporting an error when the second range of values exceeds a predetermined value.

Abstract: A method for detecting defects in a computer program.

Abstract: A method for overflow detection using partial evaluations. The method includes obtaining a section of code from a source code file stored on a storage device, analyzing the section of code to identify a buffer with an index, determining a plurality of statements that are statically-computable and dependent on the index of the buffer, and generating a code segment including the plurality of statements. The method further includes replacing an access statement of the plurality of statements with a conditional statement returning true when bounds of the buffer are exceeded, where the access statement uses the index to access the buffer, adding an unconditional statement returning false to the code segment, and executing the code segment on a computer processor to obtain a determination of whether the bounds of the buffer are exceeded.

Abstract: A method for demand-driven symbolic analysis involves obtaining a section of code comprising an instruction from a source code file and determining a critical variable in the section of code and data dependencies related to the critical variable. The method further involves iteratively computing a symbolic value representing a range of values of the critical variable according to the data dependencies, determining a set of control predicates relevant to the critical variable at the instruction, refining the range of values according to the set of control predicates to generate a second range of values for the symbolic value, and reporting an error when the second range of values exceeds a predetermined value.

Abstract: A method involves building an intermediate form data flow graph (IFgraph) from an intermediate form data flow tree (IFtree) associated with the logic design, partitioning the IFgraph across at least three levels of granularity to obtain a partitioned IFgraph, wherein partitioning the IFgraph involves balancing a set of nodes of the IFgraph into a first subset and a second subset, wherein each of the first subset and second subset are within a predefined constraint of the cycle-based system, and wherein the balancing is performed on at least one of the levels of granularity, and rewriting the IFtree based on the partitioned IFgraph.

Abstract: A method for detecting user input dependence in software code. The method including representing the software code with a reachability graph having: a plurality of nodes, where a root node of the plurality of nodes represents an input controlled by a user; a first directed edge connecting a first node of the plurality of nodes and a second node of the plurality of nodes, where the first directed edge represents a data dependency; and a second directed edge connecting a third node of the plurality of nodes and a fourth node of the plurality of nodes, wherein the second directed edge represents a data dependency. The method also includes identifying a fifth node of the plurality of nodes as a reachable node from the root node by traversing the reachability graph from the root node to the reachable node; and marking a portion of the software code represented by the reachable node as user input dependant.