Dynamic Typestate Analysis sc = …open() [1] close sc.connect(…) close [1] open connect sc.read(…) 1 2 3 [5] read, write read, write sc.write(…) [4] read, write, connect connect, close err sc != null sc.close(); return
Dynamic Typestate Analysis sc = …open() [1] close sc.connect(…) close [1] open connect sc.read(…) 1 2 3 [5] read, write read, write sc.write(…) [4] read, write, connect connect, close err sc != null sc.close(); return
Dynamic Typestate Analysis sc = …open() [1] close sc.connect(…) close [1] open connect sc.read(…) 1 2 3 [5] read, write read, write sc.write(…) [4] read, write, connect connect, close err sc != null sc.close(); [1] return
Dynamic Typestate Analysis sc = …open() [1] close sc.connect(…) close [1] open connect sc.read(…) 1 2 3 [5] read, write read, write sc.write(…) [4] read, write, connect connect, close err sc != null sc.close(); [1] return
Leveraging Static Typestate Analysis {1} sc = …open() {1} {2} sc.connect(…) {3} {2} sc.read(…) {3} {3} {3} sc.write(…) {3} {3} sc != null {1,2,3} {1,2,3} sc.close(); {1, err} return {1, 2, 3, err}
Leveraging Static Typestate Analysis sc = …open() [1] sc.connect(…) [1] sc.read(…) [5] sc.write(…) [4] sc != null sc.close(); [1] return
Leveraging Static Typestate Analysis sc = …open() [1] sc.connect(…) [1] sc.read(…) sc.write(…) sc != null sc.close(); [1] return
Safe Region A single-entry region, , of a control flow graph such that where
Safe Region A region of a control flow graph for which – all paths have the same cumulative effect on the typestate FSA – no transitions from a non-error state to error state
Safe Region A region of a control flow graph for which – all paths have the same cumulative effect on the typestate FSA – no transitions from a non-error state to error state 1
Safe Region A region of a control flow graph for which – all paths have the same cumulative effect on the typestate FSA – no transitions from a non-error state to error state 1 2
Safe Region A region of a control flow graph for which – all paths have the same cumulative effect on the typestate FSA – no transitions from a non-error state to error state 1 2
Safe Region A region of a control flow graph for which – all paths have the same cumulative effect on the typestate FSA – no transitions from a non-error state to error state 1 2
Example of Safe Region err 1 2 3 r1 1 -> 3 r2 2 -> 1 3 -> 2 r3 err -> err r4
Example of Safe Region err 1 2 3 r1 r2 r3 r4
Reachably Safe Region Not all states of a property reach all program points in a typestate analysis Reachably Safe Region – A region of a control flow graph which is safe relative to the subset of the typestates that may reach its entry
Example of Reachably Safe Region err 1 2 3 public void simplifiedTransformData() { SocketChannel sc; open ByteBuffer buf; sc = SocketChannel.open(); connect sc.connect( new InetSocketAddress(…)); while while (sc.read(buf) != -1){ sc.write(buf); if } if (sc != null ) sc.close(); }
Example of Reachably Safe Region err 1 2 3 public void simplifiedTransformData() { SocketChannel sc; open ByteBuffer buf; sc = SocketChannel.open(); connect sc.connect( new InetSocketAddress(…)); while while (sc.read(buf) != -1){ sc.write(buf); if } if (sc != null ) sc.close(); }
Example of Reachably Safe Region err 1 2 3 public void simplifiedTransformData() { SocketChannel sc; open ByteBuffer buf; sc = SocketChannel.open(); connect sc.connect( new InetSocketAddress(…)); while while (sc.read(buf) != -1){ sc.write(buf); if } if (sc != null ) sc.close(); }
Example of Reachably Safe Region err 1 2 3 public void simplifiedTransformData() { SocketChannel sc; open ByteBuffer buf; sc = SocketChannel.open(); connect sc.connect( new InetSocketAddress(…)); while while (sc.read(buf) != -1){ sc.write(buf); if } if (sc != null ) sc.close(); }
Example of Reachably Safe Region err 1 2 3 public void simplifiedTransformData() { SocketChannel sc; open ByteBuffer buf; sc = SocketChannel.open(); connect sc.connect( new InetSocketAddress(…)); while while (sc.read(buf) != -1){ sc.write(buf); if } if (sc != null ) sc.close(); }
Identity Safe Region • Identity Safe Region – A special case of a (reachably) safe region that yields identity summary on the subset of the typestates that may reach its entry
Example of Identity Safe Region err 1 2 3 public void simplifiedTransformData() { SocketChannel sc; open ByteBuffer buf; sc = SocketChannel.open(); connect sc.connect( new InetSocketAddress(…)); while while (sc.read(buf) != -1){ sc.write(buf); if } if (sc != null ) sc.close(); }
Example of Identity Safe Region err 1 2 3 public void simplifiedTransformData() { SocketChannel sc; open ByteBuffer buf; sc = SocketChannel.open(); connect sc.connect( new InetSocketAddress(…)); while while (sc.read(buf) != -1){ sc.write(buf); if } if (sc != null ) sc.close(); }
Example of Identity Safe Region err 1 2 3 public void simplifiedTransformData() { SocketChannel sc; open ByteBuffer buf; sc = SocketChannel.open(); connect sc.connect( new InetSocketAddress(…)); while while (sc.read(buf) != -1){ sc.write(buf); if } if (sc != null ) sc.close(); }
Algorithm Basic Steps 1. Reduces a control flow graph region to a sequence of single entry regions 2. Calls static typestate analysis to calculate functional summaries of reachable program regions 3. Within a region, identify candidate safe regions by marking boundaries that cannot be crossed by any safe region 4. Identify safe regions inside candidate safe regions 5. Drop (and if required, add) FSA transitions for safe regions 6. Repeat the steps for all regions that lie outside safe regions
Algorithm Basic Steps 1. Reduces a control flow graph region to a sequence of single entry regions 2. Calls static typestate analysis to calculate functional summaries of reachable program regions 3. Within a region, identify candidate safe regions by marking boundaries that cannot be crossed by any safe region 4. Identify safe regions inside candidate safe regions 5. Drop (and if required, add) FSA transitions for safe regions 6. Repeat the steps for all regions that lie outside safe regions
Reduce Control Flow Graph public void simplifiedTransformData() sc = …open() { SocketChannel sc; sc.connect(…) ByteBuffer buf; sc = SocketChannel.open(); sc.read(…) sc.connect( new InetSocketAddress(…)); while (sc.read(buf) != -1){ sc.write(…) sc.write(buf); } if (sc != null ) sc != null sc.close(); } sc.close(); return
Reduce Control Flow Graph public void simplifiedTransformData() sc = …open() { SocketChannel sc; sc.connect(…) ByteBuffer buf; sc = SocketChannel.open(); sc.read(…) sc.connect( new InetSocketAddress(…)); while (sc.read(buf) != -1){ sc.write(…) sc.write(buf); } if (sc != null ) sc != null sc.close(); } sc.close(); return
Reduce Control Flow Graph public void simplifiedTransformData() sc = …open() { SocketChannel sc; sc.connect(…) ByteBuffer buf; sc = SocketChannel.open(); while … sc.connect( new InetSocketAddress(…)); while (sc.read(buf) != -1){ sc != null sc.write(buf); } if (sc != null ) sc.close(); sc.close(); } return
Reduce Control Flow Graph public void simplifiedTransformData() sc = …open() { SocketChannel sc; sc.connect(…) ByteBuffer buf; sc = SocketChannel.open(); while… sc.connect( new InetSocketAddress(…)); while (sc.read(buf) != -1){ sc != null sc.write(buf); } if (sc != null ) sc.close(); sc.close(); } return
Reduce Control Flow Graph public void simplifiedTransformData() sc = …open() { SocketChannel sc; sc.connect(…) ByteBuffer buf; sc = SocketChannel.open(); while… sc.connect( new InetSocketAddress(…)); while (sc.read(buf) != -1){ if… sc.write(buf); } if (sc != null ) return sc.close(); }
Algorithm Basic Steps 1. Reduces a control flow graph region to a sequence of single entry and single exit regions 2. Calls static typestate analysis to calculate functional summaries of reachable program regions 3. Within a region, identify candidate safe regions by marking boundaries that cannot be crossed by any safe region 4. Identify safe regions inside candidate safe regions 5. Drop (and if required, add) FSA transitions for safe regions 6. Repeat the steps for all regions that lie outside safe regions
Calculate Functional Summary public void simplifiedTransformData() sc = …open() { SocketChannel sc; sc.connect(…) ByteBuffer buf; sc = SocketChannel.open(); while… 3->3 sc.connect( new InetSocketAddress(…)); while (sc.read(buf) != -1){ if… sc.write(buf); } if (sc != null ) return sc.close(); }
Algorithm Basic Steps 1. Reduces a control flow graph region to a sequence of single entry regions 2. Calls static typestate analysis to calculate functional summaries of reachable program regions 3. Within a region, identify candidate safe regions by marking boundaries that cannot be crossed by any safe region 4. Identify safe regions inside candidate safe regions 5. Drop (and if required, add) FSA transitions for safe regions 6. Repeat the steps for all regions that lie outside safe regions
Identify Candidate Safe Regions err 1 2 3 r1 r2 r3 r4 r5 r6
Identify Candidate Safe Regions err 1 2 3 r1 r2 r3 r4 r5 r6
Identify Candidate Safe Regions r1 err 1 2 3 r1 1->{1,2} 3->{3} r1 r2 r3 r4 r5 r6 Region Matrix
Identify Candidate Safe Regions r1 err 1 2 3 r1 1->{1,2} 3->{3} r1 r2 r3 r4 r5 r6 Region Matrix
Identify Candidate Safe Regions r1 r2 err 1 2 3 1->{1,2} 1->{2} r1 3->{3} 3->{3} r1 1->{2} r2 2->{2} r2 3->{3} r3 r4 r5 r6 Region Matrix
Identify Candidate Safe Regions r1 r2 err 1 2 3 1->{1,2} 1->{2} r1 3->{3} 3->{3} r1 1->{2} r2 2->{2} r2 3->{3} r3 r4 r5 r6 Region Matrix
Identify Candidate Safe Regions r1 r2 err 1 2 3 1->{1,2} 1->{2} r1 3->{3} 3->{3} r1 1->{2} r2 2->{2} r2 3->{3} r3 r4 r5 r6 Region Matrix
Identify Candidate Safe Regions r1 r2 r3 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} r2 2->{2} 2->{1,2} r2 3->{3} 3->{3} r3 2->{1,2} r3 3->{3} r4 r5 r6 Region Matrix
Identify Candidate Safe Regions r1 r2 r3 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} r2 2->{2} 2->{1,2} r2 3->{3} 3->{3} r3 2->{1,2} r3 3->{3} r4 r5 r6 Region Matrix
Identify Candidate Safe Regions r1 r2 r3 r4 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} r4 1->{2} 2->{1} r4 r5 3->{3} r6 Region Matrix
Identify Candidate Safe Regions r1 r2 r3 r4 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} r4 1->{2} 2->{1} r4 r5 3->{3} r6 Region Matrix
Identify Candidate Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}
Identify Candidate Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}
Identify Candidate Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}
Algorithm Basic Steps 1. Reduces a control flow graph region to a sequence of single entry regions 2. Calls static typestate analysis to calculate functional summaries of reachable program regions 3. Within a region, identify candidate safe regions by marking boundaries that cannot be crossed by any safe region 4. Identify safe regions inside candidate safe regions 5. Drop (and if required, add) FSA transitions for safe regions 6. Repeat the steps for all regions that lie outside safe regions
Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}
Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}
Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}
Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}
Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}
Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}
Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}
Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}
Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}
Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}
Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}
Identify Safe Regions r1 r2 r3 r4 r5 err 1 2 3 1->{1,2} 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r1 3->{3} 3->{3} 3->{3} 3->{3} 3->{3} r1 1->{2} 1->{1,2} 1->{1,2} 1->{1,2} r2 2->{2} 2->{1,2} 2->{1,2} 2->{1,2} r2 safe 3->{3} 3->{3} 3->{3} 3->{3} r3 2->{1,2} 2->{1,2} 2->{1,2} r3 3->{3} 3->{3} 3->{3} r4 1->{2} 1->{1} 2->{1} 2->{2} r4 identity r5 3->{3} 3->{3} 1->{2} r6 Region Matrix r5 2->{1} 3->{3}
Recommend
More recommend