Abstract Regular Tree Model Checking of Complex Dynamic Data Structures

We consider the verification of non-recursive C programs manipulating dynamiclinked data structures with possibly several next pointer selectors andwith finite domain non-pointer data. We aim at checking basic memory consistencyproperties (no null pointer assignments, etc.) and shape invariants whoseviolation can be expressed in an existential fragment of a first order logic overgraphs. We formalise this fragment as a logic for specifying bad memory patternswhose formulae may be translated to testers written in C that can be attached tothe program, thus reducing the verification problem considered to checkingreachability of an error control line. We encode configurations of programs,which are essentially shape graphs, in an original way as extended tree automataand we represent program statements by tree transducers. Then, we use theabstract regular tree model checking framework for a fully automatedverification. The method has been implemented and successfully applied on severalcase studies.