Incorrectness Separation Logic with Arrays and Pointer Arithmetic

2025-03-02

AI Summary

Existing Incorrect Separation Logic (ISL) cannot handle variable-length array predicates or pointer arithmetic, limiting its applicability to heap-manipulating programs with complex memory operations. Method: We extend ISL within the separation logic framework by integrating a heap model semantics, weakest-postcondition construction, and first-order logical entailment reasoning. We formally define the extended ISL and rigorously prove its relative completeness—i.e., all semantically valid Hoare triples are derivable within the system. Contributions/Results: (1) We present the first ISL variant supporting variable-length array predicates and pointer arithmetic; (2) we establish its theoretical soundness and relative completeness, thereby providing a reliable foundation for automated heap error detection; and (3) we deliver a verification logic that balances expressiveness and provability for programs involving intricate heap manipulations, including dynamic arrays and pointer arithmetic.

Technology Category

• Knowledge Representation and Reasoning: Logic Programming
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Machine Learning: Statistical Relational/Logic Learning

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs

Abstract

Incorrectness Separation Logic (ISL) is a proof system designed to automate verification and detect bugs in programs manipulating heap memories. In this study, we extend ISL to support variable-length array predicates and pointer arithmetic. Additionally, we prove the relative completeness of this extended ISL by constructing the weakest postconditions. Relative completeness means that all valid ISL triples are provable, assuming an oracle capable of checking entailment between formulas; this property ensures the reliability of the proof system.

Problem

• Extend ISL to support variable-length arrays and pointer arithmetic.
• Prove relative completeness of extended ISL using weakest postconditions.
• Ensure reliability of ISL for bug detection in heap memory programs.

Innovation

• Extends ISL for array predicates and pointer arithmetic
• Proves relative completeness using weakest postconditions
• Automates verification and bug detection in heap memory