Page History

...

• Presume that all char* parameters are NT(null-terminated). We must check that they are still NT at the end of the function. Additionally, the return value must be NT. We will also check that they are NT before being passed to another function.
• Any exceptions to the NT rule (functions that accept/return open strings) are specified separately. Given that this is C, the best option might be two hardcoded handling routines in the analysis. If the function either accepts an open string (not null-terminated) or can return an open string, we can write some code to specify this. The analysis calls these handling routines to retrieve these specifications. Another option would be to utilize the preprocessor to write in-code specifications. However, this is not in the style of C programmers. Additionally, we can't add these specs to libraries that way. Given the environment, a separate specification, in C, is probably the best option.
• The integer range analysis tracks the lengths of char*s.
• We use a tuple lattice for the analysis. The lattice has 4 elements, bottom, NT (NULL null terminating), O(open) and top(unknown).
• Use the specifications (or the default of NT) to set the initial lattice element for each char*.
• If we index into the string and set a character to '\0', move the string to NT. This only occurs if the index is less than the minimum size of the string. (The integer analysis must be aware of strlen and that it works properly only on NT strings.)
• Check that the parameters to all functions match the specifications. If not, cause an error.
• At the end of the function, Check that the return value and the parameters match the specification for the function. If not, cause an error.

There is a question of what to do about character arrays. One option is to assume that char\[\] is open, and using it as a char\* means that we first must make it NULLnull terminating. This could get annoying for developers very quickly. I think it's better to treat char\[\] as char*, that is, we assume NT and check for it. If the exception case does occur, it will have to be specified.

...