NobleBlocks

Research indexThesis

Efficient and Precise Pointer Analysis for Rust

Li

UNSWorks (University of New South Wales, Sydney, Australia)1 Jan 2025Open access

NobleIDark:/48914/w1/20260525/B9E74F49DOI10.26190/unsworks/31274

Abstract

Rust, a rapidly growing system-level language, has gained popularity for its strong memory safety guarantees. However, its support for unsafe code, which bypasses built-in safety checks, introduces risks similar to those in C and C++, underscoring the ongoing need for program analysis to address safety concerns in Rust programs. Although various program analysis tools have been developed, many fall short in effectively detecting safety issues in Rust due to imprecise call graph and alias/points-to information. Therefore, pointer analysis, a technique for identifying the possible memory locations pointed to by pointers and aiding in the construction of accurate call graph, is urgently needed for improving the effectiveness of safety analysis in Rust programs. This thesis studies pointer analysis for Rust, focusing on the development of an effective analysis framework and advancements in its precision and efficiency. - This thesis presents RUPTA, the first context-sensitive pointer analysis framework functioning on Rust MIR. RUPTA tackles various challenges in achieving precise points-to information and accurate call graphs, including supporting various function calls, correctly modelling type semantics associated with pointer casts and nested structs, and handling a complex memory model. - This thesis presents stack filtering, a novel technique that leverages the liveness information of stack objects to eliminate spurious points-to relations involving inactive stack objects. This technique notably enhances both the efficiency and precision of pointer analysis. We extensively evaluate RUPTA and stack filtering on real-world Rust applications. The experimental results demonstrate that RUPTA is both efficient and capable of generating precise points-to information and accurate call graphs. Stack filtering further enhances RUPTA's effectiveness by improving analysis precision while significantly reducing time and memory usage. RUPTA, integrated with stack filtering, is expected to enhance existing security analysis tools, enabling them to identify a greater number of security vulnerabilities in Rust programs.

Discussion

Topics

More

Suggest a correction or report