ESBMC v7.6: Enhanced Model Checking of C++ Programs with Clang AST

2024-06-25

arXiv.org

AI Summary

Existing C++ frontends in ESBMC lack adequate support for modern C++ features (C++11/14/17), particularly exception handling, rvalue references, smart pointer semantics, and memory-safety verification (e.g., dangling pointers, double-free, memory leaks); moreover, STL operation models are outdated. Method: We reconstruct the C++ frontend atop Clang’s AST to enable systematic integration of exception-flow modeling, fine-grained memory lifetime analysis, and updated STL container semantics within an SMT-based model checker. Our approach incorporates context-sensitive function unfolding, abstract memory-state representation, and cooperative verification across multiple SMT solvers (Boolector and Z3). Contribution/Results: The resulting tool effectively verifies industrial-scale C++ code featuring exceptions, move semantics, and smart pointers. Experiments demonstrate substantial improvements in coverage depth and verification precision for modern C++ constructs, enabling rigorous memory-safety analysis previously unsupported in SMT-based model checking.

Technology Category

• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Machine Learning: Calibration & Uncertainty Quantification
• Reasoning under Uncertainty: Stochastic Optimization

Application Category

• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

This paper presents Efficient SMT-Based Context-Bounded Model Checker (ESBMC) v7.6, an extended version based on previous work on ESBMC v7.3 by K. Song et al. The v7.3 introduced a new Clang-based C++ front-end to address the challenges posed by modern C++ programs. Although the new front-end has demonstrated significant potential in previous studies, it remains in the developmental stage and lacks several essential features. ESBMC v7.6 further enhanced this foundation by adding and extending features based on the Clang AST, such as 1) exception handling, 2) extended memory management and memory safety verification, including dangling pointers, duplicate deallocation, memory leaks and rvalue references and 3) new operational models for STL updating the outdated C++ operational models. Our extensive experiments demonstrate that ESBMC v7.6 can handle a significantly broader range of C++ features introduced in recent versions of the C++ standard.

Problem

• Enhancing C++ program verification via Clang AST extensions
• Improving memory safety and exception handling in model checking
• Updating outdated C++ operational models for modern standards

Innovation

• Enhanced Clang AST for C++ model checking
• Extended memory safety verification features
• Updated STL operational models for C++