{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,14]],"date-time":"2026-05-14T13:27:24Z","timestamp":1778765244189,"version":"3.51.4"},"reference-count":108,"publisher":"Association for Computing Machinery (ACM)","issue":"3-4","license":[{"start":{"date-parts":[[2024,11,13]],"date-time":"2024-11-13T00:00:00Z","timestamp":1731456000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"CCF-Huawei Populus Grove Fund","award":["SY202304"],"award-info":[{"award-number":["SY202304"]}]},{"name":"CCF-Tencent Rhino-Bird Open Research Fund","award":["RAGR20230117"],"award-info":[{"award-number":["RAGR20230117"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Comput. Syst."],"published-print":{"date-parts":[[2024,11,30]]},"abstract":"<jats:p>The operating system (OS) is the cornerstone for computer systems. It manages hardware and provides fundamental service for user-level applications. Thus, detecting bugs in OSes is important to improve the reliability of computer systems. Static typestate analysis is a common technique for detecting various types of bugs, but it is often inaccurate or unscalable for large-size OS code, due to imprecision of identifying alias relationships as well as high costs of typestate tracking, path-feasibility validation, and inter-procedural analysis.<\/jats:p>\n          <jats:p>\n            In this article,\n            <jats:xref ref-type=\"fn\">\n              <jats:sup>1<\/jats:sup>\n            <\/jats:xref>\n            we present SPATA, a novel summary-based, alias-aware, and path-sensitive typestate analysis framework to detect OS bugs. To identify precise alias relationships in the OS code, SPATA performs a path-based alias analysis based on control-flow paths and access paths. With these alias relationships, SPATA reduces the costs of typestate tracking and path-feasibility validation, to accelerate path-sensitive typestate analysis for accurate bug detection. Moreover, SPATA uses an alias-summary-based analysis to accelerate inter-procedural bug detection, without time-consuming alias analysis across functions. We have evaluated SPATA on the Linux kernel and three popular IoT OSes, and it finds 651 real bugs with a false-positive rate of 18%. Besides, our alias-summary-based analysis achieves a 6.7x speedup in bug detection compared to non-summary-based analysis.\n          <\/jats:p>","DOI":"10.1145\/3695250","type":"journal-article","created":{"date-parts":[[2024,9,6]],"date-time":"2024-09-06T13:51:52Z","timestamp":1725630712000},"page":"1-40","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":5,"title":["SPATA: Effective OS Bug Detection with Summary-Based, Alias-Aware, and Path-Sensitive Typestate Analysis"],"prefix":"10.1145","volume":"42","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2955-6788","authenticated-orcid":false,"given":"Tuo","family":"Li","sequence":"first","affiliation":[{"name":"Department of Computer Science and Technology, Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9500-6100","authenticated-orcid":false,"given":"Jia-Ju","family":"Bai","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Technology, Beihang University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9510-6574","authenticated-orcid":false,"given":"Yulei","family":"Sui","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, University of New South Wales, Sydney, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7507-6542","authenticated-orcid":false,"given":"Shi-Min","family":"Hu","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Technology, Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2024,11,13]]},"reference":[{"key":"e_1_3_3_2_2","first-page":"1","volume-title":"Proceedings of the 15th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL \u201988)","author":"Alpern Bowen","year":"1988","unstructured":"Bowen Alpern, Mark N. Wegman, and F. Kenneth Zadeck. 1988. Detecting equality of variables in programs. In Proceedings of the 15th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL \u201988). 1\u201311. 10.1145\/73560.73561"},{"key":"e_1_3_3_3_2","volume-title":"Program Analysis and Specialization for the C Programming Language","author":"Andersen Lars Ole","year":"1994","unstructured":"Lars Ole Andersen. 1994. Program Analysis and Specialization for the C Programming Language. Ph. D. Dissertation. University of Copenhagen."},{"key":"e_1_3_3_4_2","first-page":"1","volume-title":"Proceedings of the 35th International Conference of the Chilean Computer Science Society (SCCC \u201916)","author":"Arroyo Marcelo","year":"2016","unstructured":"Marcelo Arroyo, Francisco Chiotta, and Francisco Bavera. 2016. An user configurable clang static analyzer taint checker. In Proceedings of the 35th International Conference of the Chilean Computer Science Society (SCCC \u201916). 1\u201312. 10.1109\/SCCC.2016.7835996"},{"key":"e_1_3_3_5_2","first-page":"259","volume-title":"Proceedings of the 35th International Conference on Programming Language Design and Implementation (PLDI \u201914)","author":"Arzt Steven","year":"2014","unstructured":"Steven Arzt, Siegfried Rasthofer, Christian Fritz, Eric Bodden, Alexandre Bartel, Jacques Klein, Yves Le Traon, Damien Octeau, and Patrick McDaniel. 2014. FlowDroid: Precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps. In Proceedings of the 35th International Conference on Programming Language Design and Implementation (PLDI \u201914). 259\u2013269. 10.1145\/2666356.2594299"},{"key":"e_1_3_3_6_2","doi-asserted-by":"crossref","first-page":"110","DOI":"10.1007\/3-540-46423-9_8","volume-title":"Proceedings of the 9th International Conference on Compiler Construction (CC \u201900)","author":"Aycock John","year":"2000","unstructured":"John Aycock and Nigel Horspool. 2000. Simple generation of static single-assignment form. In Proceedings of the 9th International Conference on Compiler Construction (CC \u201900). 110\u2013125."},{"key":"e_1_3_3_7_2","first-page":"255","volume-title":"Proceedings of the 2019 USENIX Annual Technical Conference (ATC \u201919)","author":"Bai Jia-Ju","year":"2019","unstructured":"Jia-Ju Bai, Julia Lawall, Qiu-Liang Chen, and Shi-Min Hu. 2019. Effective static analysis of concurrency use-after-free bugs in Linux device drivers. In Proceedings of the 2019 USENIX Annual Technical Conference (ATC \u201919). 255\u2013268. https:\/\/www.usenix.org\/system\/files\/atc19-bai.pdf"},{"key":"e_1_3_3_8_2","doi-asserted-by":"publisher","DOI":"10.1145\/3381990"},{"key":"e_1_3_3_9_2","first-page":"367","volume-title":"Proceedings of the 2022 USENIX Annual Technical Conference (ATC \u201922)","author":"Bai Jia-Ju","year":"2022","unstructured":"Jia-Ju Bai, Tuo Li, and Shi-Min Hu. 2022. DLOS: Effective static detection of deadlocks in OS kernels. In Proceedings of the 2022 USENIX Annual Technical Conference (ATC \u201922). 367\u2013382. https:\/\/www.usenix.org\/system\/files\/atc22-bai.pdf"},{"key":"e_1_3_3_10_2","first-page":"635","volume-title":"Proceedings of the 2016 USENIX Annual Technical Conference (ATC \u201916)","author":"Bai Jia-Ju","year":"2016","unstructured":"Jia-Ju Bai, Yu-Ping Wang, Jie Yin, and Shi-Min Hu. 2016. Testing error handling code in device drivers using characteristic fault injection. In Proceedings of the 2016 USENIX Annual Technical Conference (ATC \u201916). 635\u2013647. https:\/\/www.usenix.org\/system\/files\/conference\/atc16\/atc16_paper-bai.pdf"},{"key":"e_1_3_3_11_2","first-page":"7","volume-title":"Proceedings of the 6th International Workshop on State of the Art in Program Analysis","author":"Balatsouras George","year":"2017","unstructured":"George Balatsouras, Kostas Ferles, George Kastrinis, and Yannis Smaragdakis. 2017. A datalog model of must-alias analysis. In Proceedings of the 6th International Workshop on State of the Art in Program Analysis. 7\u201312. 10.1145\/3088515.3088517"},{"key":"e_1_3_3_12_2","first-page":"35","volume-title":"Proceedings of the 2010 International Conference on Formal Methods in Computer-Aided Design (FMCAD \u201910)","author":"Ball Thomas","year":"2010","unstructured":"Thomas Ball, Ella Bounimova, Rahul Kumar, and Vladimir Levin. 2010. SLAM2: Static driver verification with under 4% false alarms. In Proceedings of the 2010 International Conference on Formal Methods in Computer-Aided Design (FMCAD \u201910). 35\u201342. https:\/\/ieeexplore.ieee.org\/stamp\/stamp.jsp?tp=&arnumber=5770931"},{"key":"e_1_3_3_13_2","first-page":"1","volume-title":"Proceedings of the 2021 International Conference on Object-Oriented Programming Systems Languages and Applications (OOPSLA \u201921)","author":"Barbar Mohamad","year":"2021","unstructured":"Mohamad Barbar and Yulei Sui. 2021. Compacting points-to sets through object clustering. In Proceedings of the 2021 International Conference on Object-Oriented Programming Systems Languages and Applications (OOPSLA \u201921). 1\u201327. 10.1145\/3485547"},{"key":"e_1_3_3_14_2","first-page":"Article 24, 26","volume-title":"Proceedings of the 34th European Conference on Object-Oriented Programming (ECOOP \u201920)","author":"Barbar Mohamad","year":"2020","unstructured":"Mohamad Barbar, Yulei Sui, and Shiping Chen. 2020. Flow-sensitive type-based heap cloning. In Proceedings of the 34th European Conference on Object-Oriented Programming (ECOOP \u201920). Article 24, 26 pages. 10.4230\/LIPIcs.ECOOP.2020.24"},{"key":"e_1_3_3_15_2","first-page":"47","volume-title":"Proceedings of the 2014 International Doctoral Workshop on Mathematical and Engineering Methods in Computer Science (MEMICS \u201914)","author":"Bauch Petr","year":"2014","unstructured":"Petr Bauch, Vojt\u011bch Havel, and Ji\u0159\u00ed Barnat. 2014. LTL model checking of LLVM bitcode with symbolic data. In Proceedings of the 2014 International Doctoral Workshop on Mathematical and Engineering Methods in Computer Science (MEMICS \u201914). 47\u201359. 10.1007\/978-3-319-14896-0_5"},{"key":"e_1_3_3_16_2","first-page":"231","volume-title":"Proceedings of the 2014 IEEE 7th International Conference on Software Testing, Verification, and Validation Workshops (ICST \u201914)","author":"Borodin Alexey","year":"2014","unstructured":"Alexey Borodin. 2014. Summary based static analysis for practical search for defects in C programs and libraries. In Proceedings of the 2014 IEEE 7th International Conference on Software Testing, Verification, and Validation Workshops (ICST \u201914). 231\u2013232. 10.1109\/ICSTW.2014.60"},{"key":"e_1_3_3_17_2","first-page":"209","volume-title":"Proceedings of the 8th International Symposium on Operating Systems Design and Implementation (OSDI \u201908)","author":"Cadar Cristian","year":"2008","unstructured":"Cristian Cadar, Daniel Dunbar, and Dawson R. Engler. 2008. KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs. In Proceedings of the 8th International Symposium on Operating Systems Design and Implementation (OSDI \u201908). 209\u2013224. https:\/\/www.usenix.org\/legacy\/event\/osdi08\/tech\/full_papers\/cadar\/cadar.pdf"},{"key":"e_1_3_3_18_2","first-page":"57","volume-title":"Proceedings of the 21st International Conference on Programming Language Design and Implementation (PLDI \u201900)","author":"Cheng Ben-Chung","year":"2000","unstructured":"Ben-Chung Cheng and Wen-Mei W. Hwu. 2000. Modular interprocedural pointer analysis using access paths: Design, implementation, and evaluation. In Proceedings of the 21st International Conference on Programming Language Design and Implementation (PLDI \u201900). 57\u201369. 10.1145\/349299.349311"},{"key":"e_1_3_3_19_2","first-page":"480","volume-title":"Proceedings of the 28th International Conference on Programming Language Design and Implementation (PLDI \u201907)","author":"Cherem Sigmund","year":"2007","unstructured":"Sigmund Cherem, Lonnie Princehouse, and Radu Rugina. 2007. Practical memory leak detection using guarded value-flow analysis. In Proceedings of the 28th International Conference on Programming Language Design and Implementation (PLDI \u201907). 480\u2013491. 10.1145\/1250734.1250789"},{"key":"e_1_3_3_20_2","first-page":"265","volume-title":"Proceedings of the 16th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS \u201911)","author":"Chipounov Vitaly","year":"2011","unstructured":"Vitaly Chipounov, Volodymyr Kuznetsov, and George Candea. 2011. S2E: A platform for in-vivo multi-path analysis of software systems. In Proceedings of the 16th International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS \u201911). 265\u2013278. 10.1145\/1961296.1950396"},{"key":"e_1_3_3_21_2","unstructured":"Clang. 2021. Clang: An LLVM-based C\/C++ Compiler. Retrieved September 9 2024 from http:\/\/clang.llvm.org\/"},{"key":"e_1_3_3_22_2","unstructured":"CLOC. 2021. CLOC: Count Lines of Code. Retrieved September 9 2024 from https:\/\/cloc.sourceforge.net"},{"key":"e_1_3_3_23_2","doi-asserted-by":"crossref","first-page":"361","DOI":"10.1145\/2771783.2771811","volume-title":"Proceedings of the 2015 International Symposium on Software Testing and Analysis (ISSTA \u201915)","author":"Cong Kai","year":"2015","unstructured":"Kai Cong, Li Lei, Zhenkun Yang, and Fei Xie. 2015. Automatic fault injection for driver robustness testing. In Proceedings of the 2015 International Symposium on Software Testing and Analysis (ISSTA \u201915). 361\u2013372. 10.1145\/2771783.2771811"},{"key":"e_1_3_3_24_2","first-page":"1","volume-title":"Proceedings of the 13th International Conference on Quality Software","author":"Cong Kai","year":"2013","unstructured":"Kai Cong, Fei Xie, and Li Lei. 2013. Symbolic execution of virtual devices. In Proceedings of the 13th International Conference on Quality Software. 1\u201310. 10.1109\/QSIC.2013.44"},{"key":"e_1_3_3_25_2","first-page":"2123","volume-title":"Proceedings of the 24th International Conference on Computer and Communications Security (CCS \u201917)","author":"Corina Jake","year":"2017","unstructured":"Jake Corina, Aravind Machiry, Christopher Salls, Yan Shoshitaishvili, Shuang Hao, Christopher Kruegel, and Giovanni Vigna. 2017. DIFUZE: Interface aware fuzzing for kernel drivers. In Proceedings of the 24th International Conference on Computer and Communications Security (CCS \u201917). 2123\u20132138. 10.1145\/3133956.3134069"},{"key":"e_1_3_3_26_2","unstructured":"Coverity. 2021. Coverity: A Commercial Static Analysis Tool. Retrieved September 9 2024 from https:\/\/scan.coverity.com\/"},{"key":"e_1_3_3_27_2","unstructured":"GitHub. 2021. Coverity Reports for Linux Kernel. Retrieved September 9 2024 from https:\/\/github.com\/torvalds\/linux\/search?q=coverity&type=commits"},{"key":"e_1_3_3_28_2","unstructured":"GitHub. 2021. Coverity Reports for Zephyr Project. Retrieved September 9 2024 from https:\/\/github.com\/zephyrproject-rtos\/zephyr\/labels\/Coverity"},{"key":"e_1_3_3_29_2","unstructured":"Cppcheck. 2021. Cppcheck: A Tool for Static C\/C++ Code Analysis. Retrieved September 9 2024 from http:\/\/cppcheck.sourceforge.net\/"},{"key":"e_1_3_3_30_2","unstructured":"Clang. 2021. Clang Static Analyzer. Retrieved September 9 2024 from https:\/\/clang-analyzer.llvm.org\/"},{"key":"e_1_3_3_31_2","doi-asserted-by":"publisher","DOI":"10.1145\/115372.115320"},{"key":"e_1_3_3_32_2","first-page":"35","volume-title":"Proceedings of the 21st International Conference on Programming Language Design and Implementation (PLDI \u201900)","author":"Das Manuvir","year":"2000","unstructured":"Manuvir Das. 2000. Unification-based pointer analysis with directional assignments. In Proceedings of the 21st International Conference on Programming Language Design and Implementation (PLDI \u201900). 35\u201346. 10.1145\/358438.349309"},{"key":"e_1_3_3_33_2","first-page":"57","volume-title":"Proceedings of the 23rd International Conference on Programming Language Design and Implementation (PLDI \u201902)","author":"Das Manuvir","year":"2002","unstructured":"Manuvir Das, Sorin Lerner, and Mark Seigle. 2002. ESP: Path-sensitive program verification in polynomial time. In Proceedings of the 23rd International Conference on Programming Language Design and Implementation (PLDI \u201902). 57\u201368. 10.1145\/512529.512538"},{"key":"e_1_3_3_34_2","first-page":"230","volume-title":"Proceedings of the 15th International Conference on Programming Language Design and Implementation (PLDI \u201994)","author":"Deutsch Alain","year":"1994","unstructured":"Alain Deutsch. 1994. Interprocedural may-alias analysis for pointers: Beyond k-limiting. In Proceedings of the 15th International Conference on Programming Language Design and Implementation (PLDI \u201994). 230\u2013241. 10.1145\/773473.178263"},{"key":"e_1_3_3_35_2","first-page":"425","volume-title":"Proceedings of the 13th International Static Analysis Symposium (SAS \u201906)","author":"Dhurjati Dinakar","year":"2006","unstructured":"Dinakar Dhurjati, Manuvir Das, and Yue Yang. 2006. Path-sensitive dataflow analysis with iterative refinement. In Proceedings of the 13th International Static Analysis Symposium (SAS \u201906). 425\u2013442. 10.1007\/11823230_27"},{"key":"e_1_3_3_36_2","first-page":"1","volume-title":"Proceedings of the 4th International Symposium on Operating System Design (OSDI \u201900)","author":"Engler Dawson","year":"2000","unstructured":"Dawson Engler, Benjamin Chelf, Andy Chou, and Seth Hallem. 2000. Checking system rules using system-specific, programmer-written compiler extensions. In Proceedings of the 4th International Symposium on Operating System Design (OSDI \u201900). 1\u201316. https:\/\/www.usenix.org\/legacy\/events\/osdi2000\/engler\/engler.pdf"},{"key":"e_1_3_3_37_2","first-page":"72","volume-title":"Proceedings of the 41st International Conference on Software Engineering (ICSE \u201919)","author":"Fan Gang","year":"2019","unstructured":"Gang Fan, Rongxin Wu, Qingkai Shi, Xiao Xiao, Jinguo Zhou, and Charles Zhang. 2019. Smoke: Scalable path-sensitive memory leak detection for millions of lines of code. In Proceedings of the 41st International Conference on Software Engineering (ICSE \u201919). 72\u201382. 10.1109\/ICSE.2019.00025"},{"key":"e_1_3_3_38_2","first-page":"465","volume-title":"Proceedings of the 2015 Asian Symposium on Programming Languages and Systems (APLAS \u201915)","author":"Feng Yu","year":"2015","unstructured":"Yu Feng, Xinyu Wang, Isil Dillig, and Thomas Dillig. 2015. Bottom-up context-sensitive pointer analysis for Java. In Proceedings of the 2015 Asian Symposium on Programming Languages and Systems (APLAS \u201915). 465\u2013484. 10.1007\/978-3-319-26529-2_25"},{"key":"e_1_3_3_39_2","doi-asserted-by":"crossref","first-page":"133","DOI":"10.1145\/1146238.1146254","volume-title":"Proceedings of the 2006 International Symposium on Software Testing and Analysis (ISSTA \u201906)","author":"Fink Stephen","year":"2006","unstructured":"Stephen Fink, Eran Yahav, Nurit Dor, G. Ramalingam, and Emmanuel Geay. 2006. Effective typestate verification in the presence of aliasing. In Proceedings of the 2006 International Symposium on Software Testing and Analysis (ISSTA \u201906). 133\u2013144. 10.1145\/1348250.1348255"},{"key":"e_1_3_3_40_2","first-page":"256","volume-title":"Proceedings of the 28th International Conference on Programming Language Design and Implementation (PLDI \u201907)","author":"Guo Bolei","year":"2007","unstructured":"Bolei Guo, Neil Vachharajani, and David I. August. 2007. Shape analysis with inductive recursion synthesis. In Proceedings of the 28th International Conference on Programming Language Design and Implementation (PLDI \u201907). 256\u2013265. 10.1145\/1250734.1250764"},{"key":"e_1_3_3_41_2","first-page":"69","volume-title":"Proceedings of the 23rd International Conference on Programming Language Design and Implementation (PLDI \u201902)","author":"Hallem Seth","year":"2002","unstructured":"Seth Hallem, Benjamin Chelf, Yichen Xie, and Dawson Engler. 2002. A system and language for building system-specific, static analyses. In Proceedings of the 23rd International Conference on Programming Language Design and Implementation (PLDI \u201902). 69\u201382. 10.1145\/512529.512539"},{"key":"e_1_3_3_42_2","first-page":"226","volume-title":"Proceedings of the 36th International Symposium on Principles of Programming Languages (POPL \u201909)","author":"Hardekopf Ben","year":"2009","unstructured":"Ben Hardekopf and Calvin Lin. 2009. Semi-sparse flow-sensitive pointer analysis. In Proceedings of the 36th International Symposium on Principles of Programming Languages (POPL \u201909). 226\u2013238. 10.1145\/1594834.1480911"},{"key":"e_1_3_3_43_2","doi-asserted-by":"crossref","first-page":"289","DOI":"10.1109\/CGO.2011.5764696","volume-title":"Proceedings of the 2011 International Symposium on Code Generation and Optimization (CGO \u201911)","author":"Hardekopf Ben","year":"2011","unstructured":"Ben Hardekopf and Calvin Lin. 2011. Flow-sensitive pointer analysis for millions of lines of code. In Proceedings of the 2011 International Symposium on Code Generation and Optimization (CGO \u201911). 289\u2013298. 10.1109\/CGO.2011.5764696"},{"key":"e_1_3_3_44_2","article-title":"Scalable static analysis using Facebook Infer","author":"Harmim Dominik","year":"2019","unstructured":"Dominik Harmim, Vladim\u0131r Marcin, and Ondrej Pavela. 2019. Scalable static analysis using Facebook Infer. In Proceedings of theExcel@ FIT19 Conference. https:\/\/excel.fit.vutbr.cz\/submissions\/2019\/059\/59.pdf","journal-title":"Excel@ FIT19 Conference."},{"key":"e_1_3_3_45_2","first-page":"254","volume-title":"Proceedings of the 22nd International Conference on Programming Language Design and Implementation (PLDI \u201901)","author":"Heintze Nevin","year":"2001","unstructured":"Nevin Heintze and Olivier Tardieu. 2001. Ultra-fast aliasing analysis using CLA: A million lines of C code in a second. In Proceedings of the 22nd International Conference on Programming Language Design and Implementation (PLDI \u201901). 254\u2013263. 10.1145\/381694.378855"},{"key":"e_1_3_3_46_2","doi-asserted-by":"publisher","DOI":"10.1145\/325478.325519"},{"key":"e_1_3_3_47_2","unstructured":"Infer. 2021. Facebook Infer: A Tool to Detect Bugs in Java and C\/C++\/Objective-C Code. Retrieved September 9 2024 from https:\/\/fbinfer.com\/"},{"key":"e_1_3_3_48_2","first-page":"329","volume-title":"Proceedings of the 25th International Symposium on Principles of Programming Languages (POPL \u201998)","author":"Jagannathan Suresh","year":"1998","unstructured":"Suresh Jagannathan, Peter Thiemann, Stephen Weeks, and Andrew Wright. 1998. Single and loving it: Must-alias analysis for higher-order languages. In Proceedings of the 25th International Symposium on Principles of Programming Languages (POPL \u201998). 329\u2013341. 10.1145\/268946.268973"},{"key":"e_1_3_3_49_2","first-page":"1","volume-title":"Proceedings of the 4th Asia-Pacific Symposium on Internetware","author":"Ji Xiujuan","year":"2012","unstructured":"Xiujuan Ji, Jufeng Yang, Jing Xu, Lei Feng, and Xiaohong Li. 2012. Interprocedural path-sensitive resource leaks detection for C programs. In Proceedings of the 4th Asia-Pacific Symposium on Internetware. 1\u20139. 10.1145\/2430475.2430494"},{"key":"e_1_3_3_50_2","first-page":"128","volume-title":"Proceedings of the 30th International Symposium on Software Reliability Engineering (ISSRE \u201919)","author":"Jiang Zu-Ming","year":"2019","unstructured":"Zu-Ming Jiang, Jia-Ju Bai, Julia Lawall, and Shi-Min Hu. 2019. Fuzzing error handling code in device drivers based on software fault injection. In Proceedings of the 30th International Symposium on Software Reliability Engineering (ISSRE \u201919). 128\u2013138. 10.1109\/ISSRE.2019.00022"},{"key":"e_1_3_3_51_2","first-page":"249","volume-title":"Proceedings of the 29th International Conference on Programming Language Design and Implementation (PLDI \u201908)","author":"Kahlon Vineet","year":"2008","unstructured":"Vineet Kahlon. 2008. Bootstrapping: A technique for scalable flow and context-sensitive pointer alias analysis. In Proceedings of the 29th International Conference on Programming Language Design and Implementation (PLDI \u201908). 249\u2013259. 10.1145\/1379022.1375613"},{"key":"e_1_3_3_52_2","first-page":"226","volume-title":"Proceedings of the 19th International Conference on Computer Aided Verification (CAV \u201907)","author":"Kahlon Vineet","year":"2007","unstructured":"Vineet Kahlon, Yu Yang, Sriram Sankaranarayanan, and Aarti Gupta. 2007. Fast and accurate static data-race detection for concurrent programs. In Proceedings of the 19th International Conference on Computer Aided Verification (CAV \u201907). 226\u2013239. 10.1007\/978-3-540-73368-3_26"},{"key":"e_1_3_3_53_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2008.11.003"},{"key":"e_1_3_3_54_2","first-page":"48","volume-title":"Proceedings of the 27th International Conference on Compiler Construction (CC \u201918)","author":"Kastrinis George","year":"2018","unstructured":"George Kastrinis, George Balatsouras, Kostas Ferles, Nefeli Prokopaki-Kostopoulou, and Yannis Smaragdakis. 2018. An efficient data structure for must-alias analysis. In Proceedings of the 27th International Conference on Compiler Construction (CC \u201918). 48\u201358. 10.1145\/3178372.3179519"},{"key":"e_1_3_3_55_2","first-page":"147","volume-title":"Proceedings of the 27th International Symposium on Operating Systems Principles (SOSP \u201919)","author":"Kim Seulbae","year":"2019","unstructured":"Seulbae Kim, Meng Xu, Sanidhya Kashyap, Jungyeon Yoon, Wen Xu, and Taesoo Kim. 2019. Finding semantic bugs in file systems with an extensible fuzzing framework. In Proceedings of the 27th International Symposium on Operating Systems Principles (SOSP \u201919). 147\u2013161. 10.1145\/3341301.3359662"},{"key":"e_1_3_3_56_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2009.10.004"},{"key":"e_1_3_3_57_2","doi-asserted-by":"crossref","first-page":"109","DOI":"10.1145\/1390630.1390645","volume-title":"Proceedings of the 2008 International Symposium on Software Testing and Analysis (ISSTA \u201908)","author":"Kondoh Goh","year":"2008","unstructured":"Goh Kondoh and Tamiya Onodera. 2008. Finding bugs in Java native interface programs. In Proceedings of the 2008 International Symposium on Software Testing and Analysis (ISSTA \u201908). 109\u2013118. 10.1145\/1390630.1390645"},{"key":"e_1_3_3_58_2","first-page":"1","volume-title":"Proceedings of the 2010 USENIX Annual Technical Conference (ATC \u201910)","author":"Kuznetsov Volodymyr","year":"2010","unstructured":"Volodymyr Kuznetsov, Vitaly Chipounov, and George Candea. 2010. Testing closed-source binary device drivers with DDT. In Proceedings of the 2010 USENIX Annual Technical Conference (ATC \u201910). 1\u201314. https:\/\/www.usenix.org\/legacy\/event\/atc10\/tech\/full_papers\/Kuznetsov.pdf"},{"key":"e_1_3_3_59_2","first-page":"278","volume-title":"Proceedings of the 28th International Conference on Programming Language Design and Implementation (PLDI \u201907)","author":"Lattner Chris","year":"2007","unstructured":"Chris Lattner, Andrew Lenharth, and Vikram Adve. 2007. Making context-sensitive points-to analysis with heap cloning practical for the real world. In Proceedings of the 28th International Conference on Programming Language Design and Implementation (PLDI \u201907). 278\u2013289. 10.1145\/1273442.1250766"},{"key":"e_1_3_3_60_2","first-page":"27","volume-title":"Proceedings of the 26th International Static Analysis Symposium (SAS \u201919)","author":"Lei Yuxiang","year":"2019","unstructured":"Yuxiang Lei and Yulei Sui. 2019. Fast and precise handling of positive weight cycles for field-sensitive pointer analysis. In Proceedings of the 26th International Static Analysis Symposium (SAS \u201919). 27\u201347. 10.1007\/978-3-030-32304-2_3"},{"key":"e_1_3_3_61_2","first-page":"859","volume-title":"Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS \u201922)","author":"Li Tuo","year":"2022","unstructured":"Tuo Li, Jia-Ju Bai, Yulei Sui, and Shi-Min Hu. 2022. Path-sensitive and alias-aware typestate analysis for detecting OS bugs. In Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS \u201922). 859\u2013872. 10.1145\/3503222.3507770"},{"key":"e_1_3_3_62_2","unstructured":"LLVM. 2021. The LLVM Compiler Infrastructure. Retrieved September 9 2024 from https:\/\/llvm.org\/"},{"key":"e_1_3_3_63_2","first-page":"1867","volume-title":"Proceedings of the 26th International Conference on Computer and Communications Security (CCS \u201919)","author":"Lu Kangjie","year":"2019","unstructured":"Kangjie Lu and Hong Hu. 2019. Where does it go? Refining indirect-call targets with multi-layer type analysis. In Proceedings of the 26th International Conference on Computer and Communications Security (CCS \u201919). 1867\u20131881. 10.1145\/3319535.3354244"},{"key":"e_1_3_3_64_2","first-page":"1769","volume-title":"Proceedings of the 28th USENIX Security Symposium","author":"Lu Kangjie","year":"2019","unstructured":"Kangjie Lu, Aditya Pakki, and Qiushi Wu. 2019. Detecting missing-check bugs via semantic-and context-aware criticalness and constraints inferences. In Proceedings of the 28th USENIX Security Symposium. 1769\u20131786. https:\/\/www.usenix.org\/system\/files\/sec19-lu.pdf"},{"key":"e_1_3_3_65_2","first-page":"146","volume-title":"Proceedings of the 2012 International Conference on Verified Software: Tools, Theories, Experiments (VSTTE \u201912)","author":"Merz Florian","year":"2012","unstructured":"Florian Merz, Stephan Falke, and Carsten Sinz. 2012. LLBMC: Bounded model checking of C and C++ programs using a compiler IR. In Proceedings of the 2012 International Conference on Verified Software: Tools, Theories, Experiments (VSTTE \u201912). 146\u2013161. 10.1007\/978-3-642-27705-4_12"},{"key":"e_1_3_3_66_2","doi-asserted-by":"publisher","DOI":"10.1023\/B:AUSE.0000008666.56394.a1"},{"key":"e_1_3_3_67_2","first-page":"125","volume-title":"Proceedings of the 2014 International Conference on Fundamental Approaches to Software Engineering (FASE \u201914)","author":"Mudduluru Rashmi","year":"2014","unstructured":"Rashmi Mudduluru and Murali Krishna Ramanathan. 2014. Efficient incremental static analysis using path abstraction. In Proceedings of the 2014 International Conference on Fundamental Approaches to Software Engineering (FASE \u201914). 125\u2013139. 10.1007\/978-3-642-54804-8_9"},{"key":"e_1_3_3_68_2","first-page":"165","volume-title":"Proceedings of the 11th International Static Analysis Symposium (SAS \u201904)","author":"Nystrom Erik M.","year":"2004","unstructured":"Erik M. Nystrom, Hong-Seok Kim, and Wen-Mei W. Hwu. 2004. Bottom-up and top-down context-sensitive summary-based pointer analysis. In Proceedings of the 11th International Static Analysis Symposium (SAS \u201904). 165\u2013180. 10.1007\/978-3-540-27864-1_14"},{"key":"e_1_3_3_69_2","first-page":"247","volume-title":"Proceedings of the 3rd European Conference on Computer Systems (EuroSys \u201908)","author":"Padioleau Yoann","year":"2008","unstructured":"Yoann Padioleau, Julia Lawall, Ren\u00e9 Rydhof Hansen, and Gilles Muller. 2008. Documenting and automating collateral evolutions in Linux device drivers. In Proceedings of the 3rd European Conference on Computer Systems (EuroSys \u201908). 247\u2013260. 10.1145\/1357010.1352618"},{"key":"e_1_3_3_70_2","first-page":"181","volume-title":"Proceedings of the 30th USENIX Security Symposium","author":"Poeplau Sebastian","year":"2020","unstructured":"Sebastian Poeplau and Aur\u00e9lien Francillon. 2020. Symbolic execution with SymCC: Don\u2019t interpret, compile! In Proceedings of the 30th USENIX Security Symposium. 181\u2013198. https:\/\/www.usenix.org\/system\/files\/sec20-poeplau.pdf"},{"key":"e_1_3_3_71_2","doi-asserted-by":"crossref","first-page":"365","DOI":"10.1109\/IFITA.2010.217","volume-title":"Proceedings of the 2010 International Forum on Information Technology and Applications (IFITA \u201910)","volume":"3","author":"Qing Xiao","year":"2010","unstructured":"Xiao Qing, Yang Zhao Hong, and Gong Yun Zhan. 2010. A method of detecting vulnerability defects based on static analysis. In Proceedings of the 2010 International Forum on Information Technology and Applications (IFITA \u201910), Vol. 3. 365\u2013368. 10.1145\/2430475.2430494"},{"key":"e_1_3_3_72_2","first-page":"49","volume-title":"Proceedings of the 24th USENIX Security Symposium","author":"Ramos David A.","year":"2015","unstructured":"David A. Ramos and Dawson Engler. 2015. Under-constrained symbolic execution: Correctness checking for real code. In Proceedings of the 24th USENIX Security Symposium. 49\u201364. https:\/\/www.usenix.org\/system\/files\/conference\/usenixsecurity15\/sec15-paper-ramos.pdf"},{"key":"e_1_3_3_73_2","first-page":"279","volume-title":"Proceedings of the 10th International Symposium on Operating Systems Design and Implementation (OSDI \u201912)","author":"Renzelmann Matthew J.","year":"2012","unstructured":"Matthew J. Renzelmann, Asim Kadav, and Michael M. Swift. 2012. SymDrive: Testing drivers without devices. In Proceedings of the 10th International Symposium on Operating Systems Design and Implementation (OSDI \u201912). 279\u2013292. https:\/\/www.usenix.org\/system\/files\/conference\/osdi12\/osdi12-final-4.pdf"},{"key":"e_1_3_3_74_2","unstructured":"RIOT. 2021. RIOT: A Real-Time Multi-Threading Operating System. Retrieved September 9 2024 from https:\/\/github.com\/RIOT-OS\/RIOT"},{"key":"e_1_3_3_75_2","first-page":"Article 2, 31 p","volume-title":"Proceedings of the 35th European Conference on Object-Oriented Programming (ECOOP \u201921)","author":"Schubert Philipp Dominik","year":"2021","unstructured":"Philipp Dominik Schubert, Ben Hermann, and Eric Bodden. 2021. Lossless, persisted summarization of static callgraph, points-to and data-flow analysis. In Proceedings of the 35th European Conference on Object-Oriented Programming (ECOOP \u201921). Article 2, 31 pages. 10.4230\/LIPIcs.ECOOP.2021.2"},{"key":"e_1_3_3_76_2","first-page":"167","volume-title":"Proceedings of the 26th USENIX Security Symposium","author":"Schumilo Sergej","year":"2017","unstructured":"Sergej Schumilo, Cornelius Aschermann, Robert Gawlik, Sebastian Schinzel, and Thorsten Holz. 2017. kAFL: Hardware-assisted feedback fuzzing for OS kernels. In Proceedings of the 26th USENIX Security Symposium. 167\u2013182. https:\/\/www.usenix.org\/system\/files\/conference\/usenixsecurity17\/sec17-schumilo.pdf"},{"key":"e_1_3_3_77_2","unstructured":"GitHub. 2021. Project to Study Faults in Linux. Retrieved September 9 2024 from https:\/\/github.com\/coccinelle\/faults-in-Linux"},{"key":"e_1_3_3_78_2","first-page":"264","volume-title":"Proceedings of the 2012 International Symposium on Code Generation and Optimization (CGO \u201912)","author":"Shang Lei","year":"2012","unstructured":"Lei Shang, Xinwei Xie, and Jingling Xue. 2012. On-demand dynamic summary-based points-to analysis. In Proceedings of the 2012 International Symposium on Code Generation and Optimization (CGO \u201912). 264\u2013274. 10.1145\/2259016.2259050"},{"key":"e_1_3_3_79_2","first-page":"580","article-title":"Device driver fault simulation using KEDR","author":"Shekar V. Shakti D.","year":"2012","unstructured":"V. Shakti D. Shekar, B. B. Meshram, and M. P. Varshapriya. 2012. Device driver fault simulation using KEDR. International Journal of Advanced Research in Computer Engineering and Technology 1, 4 (2012), 580\u2013584.","journal-title":"International Journal of Advanced Research in Computer Engineering and Technology"},{"key":"e_1_3_3_80_2","first-page":"812","volume-title":"Proceedings of the 42nd International Conference on Software Engineering (ICSE \u201920)","author":"Shi Qingkai","year":"2020","unstructured":"Qingkai Shi, Rongxin Wu, Gang Fan, and Charles Zhang. 2020. Conquering the extensional scalability problem for value-flow analysis frameworks. In Proceedings of the 42nd International Conference on Software Engineering (ICSE \u201920). 812\u2013823. 10.1145\/3377811.3380346"},{"key":"e_1_3_3_81_2","first-page":"693","volume-title":"Proceedings of the 39th International Conference on Programming Language Design and Implementation (PLDI \u201918)","author":"Shi Qingkai","year":"2018","unstructured":"Qingkai Shi, Xiao Xiao, Rongxin Wu, Jinguo Zhou, Gang Fan, and Charles Zhang. 2018. Pinpoint: Fast and precise sparse value flow analysis for million lines of code. In Proceedings of the 39th International Conference on Programming Language Design and Implementation (PLDI \u201918). 693\u2013706. 10.1145\/3192366.3192418"},{"key":"e_1_3_3_82_2","first-page":"930","volume-title":"Proceedings of the 42nd ACM SIGPLAN International Conference on Programming Language Design and Implementation (PLDI \u201921)","author":"Shi Qingkai","year":"2021","unstructured":"Qingkai Shi, Peisen Yao, Rongxin Wu, and Charles Zhang. 2021. Path-sensitive sparse analysis without path conditions. In Proceedings of the 42nd ACM SIGPLAN International Conference on Programming Language Design and Implementation (PLDI \u201921). 930\u2013943. 10.1145\/3453483.3454086"},{"key":"e_1_3_3_83_2","unstructured":"Smatch. 2021. Smatch: A Static Bug-Finding Tool for C. Retrieved September 9 2024 from http:\/\/smatch.sourceforge.net\/"},{"key":"e_1_3_3_84_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1986.6312929"},{"key":"e_1_3_3_85_2","first-page":"160","volume-title":"Proceedings of the 2016 International Symposium on Code Generation and Optimization (CGO \u201916)","author":"Sui Yulei","year":"2016","unstructured":"Yulei Sui, Peng Di, and Jingling Xue. 2016. Sparse flow-sensitive pointer analysis for multithreaded programs. In Proceedings of the 2016 International Symposium on Code Generation and Optimization (CGO \u201916). 160\u2013170. 10.1145\/2854038.2854043"},{"key":"e_1_3_3_86_2","doi-asserted-by":"publisher","DOI":"10.1145\/3168364"},{"key":"e_1_3_3_87_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2014.2302311"},{"key":"e_1_3_3_88_2","unstructured":"GitHub. 2021. SVF Wiki. Retrieved September 9 2024 from https:\/\/github.com\/SVF-tools\/SVF\/wiki\/Detecting-memory-leaks"},{"key":"e_1_3_3_89_2","unstructured":"Syzkaller. 2021. Syzkaller: A Kernel Fuzzer. Retrieved September 9 2024 from https:\/\/github.com\/google\/syzkaller"},{"key":"e_1_3_3_90_2","volume-title":"Proceedings of the 30th USENIX Security Symposium","author":"Talebi Seyed Mohammadjavad Seyed","year":"2021","unstructured":"Seyed Mohammadjavad Seyed Talebi, Zhihao Yao, Ardalan Amiri Sani, Zhiyun Qian, and Daniel Austin. 2021. Undo workarounds for kernel bugs. In Proceedings of the 30th USENIX Security Symposium. https:\/\/www.usenix.org\/system\/files\/sec21-talebi.pdf"},{"key":"e_1_3_3_91_2","unstructured":"GitHub. 2021. TencentOS-tiny: A Real-Time IoT Operating System Developed by Tencent. Retrieved September 9 2024 from https:\/\/github.com\/Tencent\/TencentOS-tiny"},{"key":"e_1_3_3_92_2","first-page":"999","volume-title":"Proceedings of the 42nd International Conference on Software Engineering (ICSE \u201920)","author":"Wang Haijun","year":"2020","unstructured":"Haijun Wang, Xiaofei Xie, Yi Li, Cheng Wen, Yuekang Li, Yang Liu, Shengchao Qin, Hongxu Chen, and Yulei Sui. 2020. Typestate-guided fuzzer for discovering use-after-free vulnerabilities. In Proceedings of the 42nd International Conference on Software Engineering (ICSE \u201920). 999\u20131010. 10.1145\/3377811.3380386"},{"key":"e_1_3_3_93_2","first-page":"31","volume-title":"Proceedings of the 2021 USENIX Annual Technical Conference (ATC \u201921)","author":"Wang Wenwen","year":"2021","unstructured":"Wenwen Wang. 2021. MLEE: Effective detection of memory leaks on early-exit paths in OS kernels. In Proceedings of the 2021 USENIX Annual Technical Conference (ATC \u201921). 31\u201345. https:\/\/www.usenix.org\/system\/files\/atc21-wang-wenwen.pdf"},{"key":"e_1_3_3_94_2","first-page":"1137","volume-title":"Proceedings of the 25th ACM SIGSAC Conference on Computer and Communications Security (CCS \u201918)","author":"Wei Fengguo","year":"2018","unstructured":"Fengguo Wei, Xingwei Lin, Xinming Ou, Ting Chen, and Xiaosong Zhang. 2018. JN-SAF: Precise and efficient NDK\/JNI-aware inter-language static analysis framework for security vetting of Android applications with native code. In Proceedings of the 25th ACM SIGSAC Conference on Computer and Communications Security (CCS \u201918). 1137\u20131150. 10.1145\/3243734.3243835"},{"key":"e_1_3_3_95_2","first-page":"1","volume-title":"Proceedings of the 16th International Conference on Programming Language Design and Implementation (PLDI \u201995)","author":"Wilson Robert P.","year":"1995","unstructured":"Robert P. Wilson and Monica S. Lam. 1995. Efficient context-sensitive pointer analysis for C programs. In Proceedings of the 16th International Conference on Programming Language Design and Implementation (PLDI \u201995). 1\u201312. 10.1145\/207110.207111"},{"key":"e_1_3_3_96_2","unstructured":"GitHub. 2021. WLLVM: Whole Program LLVM. Retrieved September 9 2024 from https:\/\/github.com\/travitch\/whole-program-llvm"},{"key":"e_1_3_3_97_2","doi-asserted-by":"crossref","first-page":"116","DOI":"10.1145\/2610384.2610395","volume-title":"Proceedings of the 2014 International Symposium on Software Testing and Analysis (ISSTA \u201914)","author":"Xiao Xusheng","year":"2014","unstructured":"Xusheng Xiao, Gogul Balakrishnan, Franjo Ivan\u010di\u0107, Naoto Maeda, Aarti Gupta, and Deepak Chhetri. 2014. ARC++: Effective typestate and lifetime dependency analysis. In Proceedings of the 2014 International Symposium on Software Testing and Analysis (ISSTA \u201914). 116\u2013126. 10.1145\/2610384.2610395"},{"key":"e_1_3_3_98_2","first-page":"168","volume-title":"Proceedings of the 10th International Symposium on Theoretical Aspects of Software Engineering (TASE \u201916)","author":"Xu Zhiwu","year":"2016","unstructured":"Zhiwu Xu, Dongxiao Fan, and Shengchao Qin. 2016. State-taint analysis for detecting resource bugs. In Proceedings of the 10th International Symposium on Theoretical Aspects of Software Engineering (TASE \u201916). 168\u2013175. 10.1016\/j.scico.2017.06.010"},{"key":"e_1_3_3_99_2","first-page":"155","volume-title":"Proceedings of the 2011 International Symposium on Software Testing and Analysis (ISSTA \u201911)","author":"Yan Dacong","year":"2011","unstructured":"Dacong Yan, Guoqing Xu, and Atanas Rountev. 2011. Demand-driven context-sensitive alias analysis for Java. In Proceedings of the 2011 International Symposium on Software Testing and Analysis (ISSTA \u201911). 155\u2013165. 10.1145\/2001420.2001440"},{"key":"e_1_3_3_100_2","first-page":"42","volume-title":"Proceedings of the 33rd Annual Computer Security Applications Conference (ACSAC \u201917)","author":"Yan Hua","year":"2017","unstructured":"Hua Yan, Yulei Sui, Shiping Chen, and Jingling Xue. 2017. Machine-learning-guided typestate analysis for static use-after-free detection. In Proceedings of the 33rd Annual Computer Security Applications Conference (ACSAC \u201917). 42\u201354. 10.1145\/3134600.3134620"},{"key":"e_1_3_3_101_2","first-page":"144","volume-title":"Proceedings of the 2012 International Symposium on Software Testing and Analysis (ISSTA \u201912)","author":"Yang Guowei","year":"2012","unstructured":"Guowei Yang, Corina S. P\u0103s\u0103reanu, and Sarfraz Khurshid. 2012. Memoized symbolic execution. In Proceedings of the 2012 International Symposium on Software Testing and Analysis (ISSTA \u201912). 144\u2013154. 10.1145\/2338965.2336771"},{"key":"e_1_3_3_102_2","first-page":"319","volume-title":"Proceedings of the 21st International Static Analysis Symposium (SAS \u201914)","author":"Ye Sen","year":"2014","unstructured":"Sen Ye, Yulei Sui, and Jingling Xue. 2014. Region-based selective flow-sensitive pointer analysis. In Proceedings of the 21st International Static Analysis Symposium (SAS \u201914). 319\u2013336. 10.1007\/978-3-319-10936-7_20"},{"key":"e_1_3_3_103_2","first-page":"218","volume-title":"Proceedings of the 2010 International Symposium on Code Generation and Optimization (CGO \u201910)","author":"Yu Hongtao","year":"2010","unstructured":"Hongtao Yu, Jingling Xue, Wei Huo, Xiaobing Feng, and Zhaoqing Zhang. 2010. Level by level: Making flow-and context-sensitive pointer analysis scalable for millions of lines of code. In Proceedings of the 2010 International Symposium on Code Generation and Optimization (CGO \u201910). 218\u2013229. 10.1145\/1772954.1772985"},{"key":"e_1_3_3_104_2","first-page":"363","volume-title":"Proceedings of the 25th USENIX Security Symposium","author":"Yun Insu","year":"2016","unstructured":"Insu Yun, Changwoo Min, Xujie Si, Yeongjin Jang, Taesoo Kim, and Mayur Naik. 2016. APISan: Sanitizing API usages through semantic cross-checking. In Proceedings of the 25th USENIX Security Symposium. 363\u2013378. https:\/\/www.usenix.org\/system\/files\/conference\/usenixsecurity16\/sec16_paper_yun.pdf"},{"key":"e_1_3_3_105_2","unstructured":"GitHub. 2021. Z3: A Theorem Prover. Retrieved September 9 2024 from https:\/\/github.com\/Z3Prover\/z3"},{"key":"e_1_3_3_106_2","unstructured":"GitHub. 2021. Zephyr: A Scalable Real-Time Operating System. Retrieved September 9 2024 from https:\/\/github.com\/zephyrproject-rtos\/zephyr"},{"key":"e_1_3_3_107_2","first-page":"221","volume-title":"Proceedings of the 28th International Symposium on the Foundations of Software Engineering (FSE \u201920)","author":"Zhai Yizhuo","year":"2020","unstructured":"Yizhuo Zhai, Yu Hao, Hang Zhang, Daimeng Wang, Chengyu Song, Zhiyun Qian, Mohsen Lesani, Srikanth V. Krishnamurthy, and Paul Yu. 2020. UBITect: A precise and scalable method to detect use-before-initialization bugs in Linux kernel. In Proceedings of the 28th International Symposium on the Foundations of Software Engineering (FSE \u201920). 221\u2013232. 10.1145\/3368089.3409686"},{"key":"e_1_3_3_108_2","first-page":"829","volume-title":"Proceedings of the 2014 International Conference on Object-Oriented Programming Systems Languages and Applications (OOPSLA \u201914)","author":"Zhang Qirun","year":"2014","unstructured":"Qirun Zhang, Xiao Xiao, Charles Zhang, Hao Yuan, and Zhendong Su. 2014. Efficient subcubic alias analysis for C. In Proceedings of the 2014 International Conference on Object-Oriented Programming Systems Languages and Applications (OOPSLA \u201914). 829\u2013845. 10.1145\/2660193.2660213"},{"key":"e_1_3_3_109_2","first-page":"197","volume-title":"Proceedings of the 35th International Symposium on Principles of Programming Languages (POPL \u201908)","author":"Zheng Xin","year":"2008","unstructured":"Xin Zheng and Radu Rugina. 2008. Demand-driven alias analysis for C. In Proceedings of the 35th International Symposium on Principles of Programming Languages (POPL \u201908). 197\u2013208. 10.1145\/1328438.1328464"}],"container-title":["ACM Transactions on Computer Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3695250","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3695250","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T00:58:11Z","timestamp":1750294691000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3695250"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,11,13]]},"references-count":108,"journal-issue":{"issue":"3-4","published-print":{"date-parts":[[2024,11,30]]}},"alternative-id":["10.1145\/3695250"],"URL":"https:\/\/doi.org\/10.1145\/3695250","relation":{},"ISSN":["0734-2071","1557-7333"],"issn-type":[{"value":"0734-2071","type":"print"},{"value":"1557-7333","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,11,13]]},"assertion":[{"value":"2023-01-09","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-07-25","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-11-13","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}