CPROVER Manual TOC

## Property Instrumentation

### Properties

We have mentioned properties several times so far, but we never explained what kind of properties CBMC and SATABS can verify. We cover this topic in more detail in this section.

Both CBMC and SATABS use assertions to specify program properties. Assertions are properties of the state of the program when the program reaches a particular program location. Assertions are often written by the programmer by means of the `assert` macro.

In addition to the assertions written by the programmer, assertions for specific properties can also be generated automatically by CBMC and SATABS, often relieving the programmer from writing "obvious" assertions.

CBMC and SATABS come with an assertion generator called `goto-instrument`, which performs a conservative static analysis to determine program locations that potentially contain a bug. Due to the imprecision of the static analysis, it is important to emphasize that these generated assertions are only potential bugs, and that the Model Checker first needs to confirm that they are indeed genuine bugs.

The assertion generator can generate assertions for the verification of the following properties:

- Buffer overflows. For each array access, check whether the upper and lower bounds are violated.

- Pointer safety. Search for `NULL`-pointer dereferences or dereferences of other invalid pointers.

- Division by zero. Check whether there is a division by zero in the program.

- Not-a-Number. Check whether floating-point computation may result in NaNs.

- Unitialized local. Check whether the program uses an uninitialized local variable.

- Data race. Check whether a concurrent program accesses a shared variable at the same time in two threads.

We refrain from explaining the properties above in detail. Most of them relate to behaviors that are left undefined by the respective language semantics. For a discussion on why these behaviors are usually very undesirable, read this blog post by John Regehr.

All the properties described above are reachability properties. They are always of the form

"Is there a path through the program such that property ... is violated?"

The counterexamples to such properties are always program paths. Users of the Eclipse plugin can step through these counterexamples in a way that is similar to debugging programs. The installation of this plugin is explained here.

### Using goto-instrument

The goto-instrument static analyzer operates on goto-binaries, which is a binary representation of control-flow graphs. The goto-binary is extracted from program source code using goto-cc, which is explained here. Given a goto-program, goto-instrument operates as follows:

1. A goto-binary is read in.
2. The specified static analyses are performed.
3. Any potential bugs found are transformed into corresponding assertions, and are added into the program.
4. A new goto-binary (with assertions) is written to disc.

As an example, we begin with small C program we call `expr.c` (taken from here):

    int *ptr;

    int main(void) {
      if (ptr)
        *ptr = 0;
      if (!ptr)
        *ptr = 1;
    }

The program contains an obvious NULL-pointer dereference. We first compile the example program with goto-cc and then instrument the resulting goto-binary with pointer checks.

`goto-cc expr.c -o in.gb
goto-instrument in.gb out.gb --pointer-check`

We can now get a list of the assertions that have been generated as follows:

`goto-instrument out.gb --show-properties`

Using either CBMC or SATABS on `out.gb`, we can obtain a counterexample trace for the NULL-pointer dereference:

`cbmc out.gb`

The goto-instrument program supports the following checks:

`--no-assertions` | ignore user assertions
`--bounds-check` | add array bounds checks
`--div-by-zero-check` | add division by zero checks
`--pointer-check` | add pointer checks
`--signed-overflow-check` | add arithmetic over- and underflow checks
`--unsigned-overflow-check` | add arithmetic over- and underflow checks
`--undefined-shift-check` | add range checks for shift distances
`--nan-check` | add floating-point NaN checks
`--uninitialized-check` | add checks for uninitialized locals (experimental)
`--error-label label` | check that given label is unreachable

Further Reading

- Integration into Build Systems with goto-cc