一句话：提出 Pincer：基于 IFDS 的模块化、需求驱动类型状态分析，精准检测 Rust unsafe 代码中的 use-after-free 与 double-free。
Rust 借助严格的所有权与借用规则实现内存安全，但其 unsafe 模式允许裸指针操作，重新引入内存安全漏洞。现有针对 Rust 的全程序分析往往召回率低、误报率高。考虑到 unsafe 代码通常规模小且局部化，作者提出需求驱动的替代方案 Pincer：一个构建于 IFDS 之上、流敏感、域敏感、上下文敏感的数据流分析框架。Pincer 执行双向分析——后向追踪裸指针来源、前向探索别名——并针对 Rust 的所有权模型与底层语义进行适配。在此之上，Pincer 实施模块化、自底向上、面向漏洞的类型状态分析，检测 use-after-free 与 double-free，跟踪裸指针别名与空值性，在容器操作返回处利用强更新，并借助 Rust 安全不变式通过 AXM 检查剪除可证明安全的区域。模块化设计使探索可控（可带预算），提升可扩展性；受控不健全性在保持高召回与高精度的同时进一步提高效率。作者在含漏洞程序与大型 Rust 项目上评估 Pincer，结果表明其比当前最先进的分析更准确地检测内存安全错误，同时保持实用效率。
Rust combines high performance with strong memory safety through strict ownership and borrowing rules. However, its unsafe mode reintroduces vulnerabilities by allowing raw-pointer manipulation, a major source of memory-safety bugs. Existing whole-program analyses for Rust often suffer from low recall and high false positives. Since unsafe code is typically small and isolated, we propose a demand-driven alternative. We present Pincer , a flow-, field-, and context-sensitive dataflow analysis framework built on IFDS. Pincer performs mutually bidirectional analysis—backward to trace raw-pointer origins and forward to explore aliases—adapting this strategy to Rust’s ownership model and low-level semantics. On this foundation, Pincer performs a modular, bottom-up vulnerability-oriented typestate analysis to detect use-after-free and double-free bugs. It tracks raw-pointer aliasing and nullness, exploits strong updates at container-manipulating returns, and leverages Rust’s safety invariants to prune provably safe regions via AXM checking. The modular design enables controlled exploration, optionally under a budget, improving scalability. Controlled unsoundness further boosts efficiency while maintaining high recall and precision. We evaluate Pincer on vulnerable programs and large Rust projects. The results show that Pincer detects memory-safety errors more accurately than state-of-the-art analyses while maintaining practical efficiency.
@article{paperbot3818,
title = {From Raw Pointers to Memory Safety: A Modular Demand-Driven Typestate Analysis for Rust},
author = {Wei Li and Wenyao Chen and Jingling Xue},
journal = {Proceedings of the ACM on Programming Languages},
volume = {10},
number = {OOPSLA1},
year = {2026},
doi = {10.1145/3798266}
}