# Deciding Memory Safety for Single-Pass Heap-Manipulating Programs

## TL;DR

This paper presents a decision procedure for verifying memory safety in heap-manipulating programs that process forest data-structures in a single pass, demonstrating efficiency and practical applicability.

## Contribution

It extends decidability results to alias-aware programs with map updates and develops algorithms for verifying memory safety in single-pass heap programs.

## Key findings

- Decidable when initial heap is a forest and programs are streaming-coherent.
- Verification algorithms are efficient for common single-pass data-structure algorithms.
- Experimental results confirm practical applicability on library routines.

## Abstract

We investigate the decidability of automatic program verification for programs that manipulate heaps, and in particular, decision procedures for proving memory safety for them. We extend recent work that identified a decidable subclass of uninterpreted programs to a class of alias-aware programs that can update maps. We apply this theory to develop verification algorithms for memory safety--- determining if a heap-manipulating program that allocates and frees memory locations and manipulates heap pointers does not dereference an unallocated memory location. We show that this problem is decidable when the initial allocated heap forms a forest data-structure and when programs are streaming-coherent, which intuitively restricts programs to make a single pass over a data-structure. Our experimental evaluation on a set of library routines that manipulate forest data-structures shows that common single-pass algorithms on data-structures often fall in the decidable class, and that our decision procedure is efficient in verifying them.