Hermes: Making Path-Sensitive Pointer Analysis Scalable for Sparse Value-Flow Analysis
Year: 2026
Type: article
Abstract: Sparse Value-Flow Analysis (SVFA) is essential for detecting software bugs such as null pointer dereference and memory leak. However, SVFA heavily relies on path-sensitive pointer analysis, which faces significant scalability challenges when analyzing industrial-scale projects, notably the summary-explosion problem. To address this issue, we propose Hermes , which symbolizes memory side effects and constructs an incomplete Sparse Value-Flow Graph (SVFG) called Lazy Symbolic Expression Graph (LSEG). Leveraging this structure, Hermes builds inter-procedural value flows relevant to bug detection only when necessary, significantly reducing the overhead of pointer analysis and streamlining the bug-search paths. Evaluations on large-scale real-world projects demonstrate that, compared to the state-of-the-art, Hermes achieves average speedups of at least 9.84× and 9.84× for pointer analysis and bug search, respectively, without sacrificing the effectiveness of bug detection.
DOI: 10.1145/3798211
Institutions: Xiamen University, Nanjing University
Language: English
Subfield: Software
Field: Computer Science
Domain: Physical Sciences
Open Access status: diamond
OpenAlex ID: W7153270159