Detecting Out-of-Bounds Accesses with Conditional Range Constraint

Out-of-bounds accesses can lead to nondeterministic behaviors. Proposed in this paper is a novel detection method based on conditional range constraint. It divides the detection process into two phrases: the constraint generation phase and the constraint resolution phase. In the phase of constraint generation, a flow-sensitive, inter-procedure algorithm is proposed to propagate range constraints and value constraints respectively. In the constraint resolution phase, a linear programming solver is used to determine the bounds of abstract memory locations and the offset. The experiment results show that the method proposed is effective, and its precision is higher than 80%.