INHERENT LIMITATIONS OF COMPUTER PROGRAMS

CSci 4011 INHERENT LIMITATIONS OF COMPUTER PROGRAMS

UNDECIDABILITY A language is a set of strings. It is a mathematical way of expressing a problem: given an input, is it in the set L? If a language is decidable, there is a computer program (TM) that can always solve the problem correctly – it terminates and has the right answer. If a language is undecidable, then no matter how smart you are, and no matter how long you give it, you cannot program a computer to always solve the problem correctly.

UNDECIDABLE PROBLEMS DTM = { 〈M〉 | M is a TM that does not accept 〈M〉 } Theorem. DTM is undecidable. Proof. Suppose machine N decides DTM. Then N accepts 〈N〉 ⇔ 〈N〉  DTM ⇔N does not accept 〈N〉 ATM = { 〈M,w〉 : M is a TM that accepts on input w } Theorem. If ATM is decidable, so is DTM. Proof. If ¬ATM is decided by the program nAccept we can decide DTM by calling nAccept(M,〈M〉). HALTTM = { 〈M,w〉 : M is a TM that halts on input w } Theorem. If HALTTM is decidable, then so is ATM.

In most cases, we will show that a language is undecidable by showing that if it is decidable, then so is ATM We reduce deciding ATM to deciding the language in question

MAPPING REDUCTIONS ƒ : Σ*  Σ* is a computable function if there is a TM that on input w, halts with ƒ(w) on its tape A m B if there is a computable ƒ, such that w  A  ƒ(w)  B ƒ is called a reduction from A to B

Theorem: If A m B and A is undecidable, then B is undecidable Suppose, for contradiction, that BSolver decides B and let ƒ be a reduction from A to B. Proof: Then there is a program ASolver that decides A: ASolver(w): 1. Let s = ƒ(w) 2. Return BSolver(s) Since A is undecidable the program BSolver must not exist. Thus B is undecidable.

# q00 q10  qacc0 qacc 0qacc qacc## qacc q0 #q00# 0qrej  0q1 qrej qacc qacc qacc qacc # # # q1 0 qreject qacc 0 # # q00 # 0 q1 # # # 0 0qacc qacc # #q00# 0q1 # 0 qacc # # # 0 qacc qacc 0 → 0, R  → , R q0 q1 qaccept 0→ 0, R  → , R

MORE UNDECIDABLE PROBLEMS Many “problems about programs” are undecidable: “Does this applet open a network connection?” “Does this function always return the same answer?” “Find all unused methods in this applet.” “Do these programs always have the same output?” “Find all buffer overflows in this program.” “Find all memory leaks in this program.”

TOOLS package cs4011.tools; public class TuringMachine { public TuringMachine(String TM, String Input); public void run(); public boolean accepted(); … /* turing_machine.h – TM emulator in C */ #define ACCEPT 1 #define REJECT 0 /* runTM – simulate the TM with description m * on input string w. Return ACCEPT or REJECT */ int runTM(char *M, char *w);

NET = { J | J is a java applet that opens a network connection } Theorem. ATM ≤m NET. Proof. On input 〈M,w〉, output the Java applet: import cs4011.tools.TuringMachine; import java.net.*; public class OutputApplet extends Applet { public void start() { TuringMachine TM = new TuringMachine(“M”, “w”); TM.run(); if (TM.accepted()) { // open a network connection URL url = new URL(“http://goo.gl/”); Object o = url.getContent(); } } }

import cs4011.tools.TuringMachine; import java.net.*; public class OutputApplet extends Applet { public void start() { TuringMachine TM = new TuringMachine(“M”, “w”); TM.run(); if (TM.accepted()) { // open a network connection URL url = new URL(“http://goo.gl/”); Object o = url.getContent(); } } } If M accepts w: OutputApplet opens url. Thus OutputApplet ∈ NET. If M loops on w: OutputApplet never gets to url. If M rejects w: OutputApplet skips if {… } block. In both cases, OutputApplet ∉ NET.

What’s wrong with this reduction? On input 〈M,w〉: Run M on w. if M accepts, output: public class OutputApplet extends Applet { public void start() { URL url = new URL(“http://is.gd/”); Object o = url.getContent(); } } else output: public class OutputApplet extends Applet { public void start() { return; } }

CONST= { J | J is a Java program that prints the same string for every input } Theorem. ATM ≤mCONST. Proof. On input 〈M,w〉, output the Java program: import cs4011.tools.TuringMachine; public class MightBeConstProgram { public static void main(String[] args) { if (args.length == 1 && args[0].equals(“Y”)) { System.out.print(“Y”);return; } TuringMachine TM = new TuringMachine(“M”, “w”); TM.run(); if (TM.accepted()) System.out.print(“Y”); else System.out.print(args[0]); } }

ALLUSED = { J | J is a java applet with no unused methods} Theorem. ATM ≤m ALLUSED. Proof. On input 〈M,w〉, output the Java applet: import cs4011.tools.TuringMachine; public class AllMethodsApplet extends Applet { public void unusedMethod() { int x = 0; return; } public void start() { TuringMachine TM = new TuringMachine(“M”, “w”); TM.run(); if (TM.accepted()) { this.unusedMethod(); } } }

SAME = { 〈J1,J2〉 | J1 and J2 are java programs that have the same output for all inputs.} Theorem. ¬ATM ≤m SAME. Proof. On input 〈M,w〉, output the Java programs: import cs4011.tools.TuringMachine; public class J1 { public static void main(String[] args) { TuringMachine TM = new TuringMachine(“M”, “w”); TM.run(); if (TM.accepted()) System.out.print(“Y”); } } import cs4011.tools.TuringMachine; public class J2 { public static void main(String[] args) { TuringMachine TM = new TuringMachine(“M”, “w”); TM.run(); if (TM.accepted()) System.out.print(“N”); } }

OFLOW = { P | P is a C program with an exploitable buffer overflow } Theorem. ATM ≤ OFLOW. Proof. On input 〈M,w〉, output the C program: #include <turing_machine.h> int main(int argc, char **argv) { int i; char buf[1024]; for(i = 0; i < 2048 && runTM(“M”,“w”); i++) { buf[i] = fgetc(stdin); } return 0; }

MLEAK = { P | P is a C program with a memory leak} Theorem. ATM ≤ MLEAK. Proof. On input 〈M,w〉, output the C program: #include <turing_machine.h> int main(intargc, char **argv) { char *buf = NULL; buf = malloc(1<<30); if (runTM(“M”,”w”)) { buf = malloc(512); } if (buf != NULL) free(buf); return 0; }

INHERENT LIMITATIONS OF COMPUTER PROGRAMS