tis-interpreter
cbmc
tis-interpreter | cbmc | |
---|---|---|
2 | 5 | |
564 | 774 | |
0.5% | 2.8% | |
10.0 | 9.9 | |
over 7 years ago | 3 days ago | |
OCaml | C++ | |
- | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
tis-interpreter
- The C Bounded Model Checker: Criminally Underused
-
GCC always assumes aligned pointer accesses
What makes you think they don't understand it? They acknowledge that it is UB. I read them as realistic, since they know that people rely on C compilers work in a certain way. They even wrote an interpreter that detects UB: https://github.com/TrustInSoft/tis-interpreter
I understand why people like the compiler being able to leverage UB. I suspect this philosophy actually makes Trust-In-Soft more money: You could argue that if there was no UB, there would be no need for the tis-interpreter.
So isn't it in fact quite self-less that they encourage the world to optimize a bit less (spending more money on 'compute'), while standing to profit from the unintended behaviour they'd otherwise be contracted to help debug?
cbmc
-
Xr0 Makes C Safer than Rust
This appears to be more limited than what CBMC[1] (the C Bounded Model Checker) can do. CBMC can do function contracts. CBMC can prove memory safety and even the absence of memory leaks for non-trivial code bases that pass pointers all over the place that must eventually be freed. Applying all the annotations to make this happen though is like 10x the work of getting the program actually running in the first place. CBMC definitely makes C safer than even safe Rust for projects that can invest the time to use it. There is an experimental Rust front end to CBMC called Kani[2] that aims to verify unsafe Rust (thus making unsafe Rust become safe) but it is far from the speed and robustness of the C front end.
[1] https://github.com/diffblue/cbmc
[2] https://github.com/model-checking/kani
-
The C Bounded Model Checker: Criminally Underused
https://github.com/diffblue/cbmc/issues/7732 I'll note that some form of undefined behavior checking / documentation is on the roadmap for the next major version
- CBMC: The C Bounded Model Checker
-
Using the Kani Rust Verifier on Tokio Bytes
So it seems to use cmbc and a bunch of other tools from cprover under the hood (bundled in the github release and setup on first run...). I would really like to have this "how" more visible in the documentation, it's essential to hint at the limitations of such an automated prover, even if the underlying system is rather powerful.
-
Hard Things in Computer Science
> The only reliable way to have bug-free code is to prove it. It requires solid mathematical foundations and a programming language that allows formal proofs.
I'm going to be the "actually" guy and say that, actually, you can formally verify some studff about programs written in traditional/mainstream languages, like C. Matter of fact, this is a pretty lively research area, with some tools like CBMC [0] and Infer [1] also getting significant adoption in the industry.
[0]: https://github.com/diffblue/cbmc
[1]: https://fbinfer.com/
What are some alternatives?
chibicc - A small C compiler
sudoku-cbmc - SAT-based sudoku solver
c-semantics - Semantics of C in K
infer - A static analyzer for Java, C, C++, and Objective-C
coreHTTP - Client implementation of a subset of HTTP 1.1 protocol designed for embedded devices.
dmd - dmd D Programming Language compiler
kani - Kani Rust Verifier