空指针解引用错误检测的静态方法研究  

A Study of the Static Method of Detecting Null Pointer Dereference

作　　者：徐厚峰 马晓东 

机构地区：[1]并行与分布处理重点实验室,湖南长沙410073

出　　处：《计算机工程与科学》2009年第3期92-96,共5页Computer Engineering & Science

基　　金：国家自然科学基金资助项目(60725206;60673118;90612009);国家863计划资助项目(2006AA01Z429);国家973计划资助项目(2005CB321802);新世纪优秀人才计划资助项目(NCET-04-0996)

摘　　要：空指针解引用是C语言中的一类常见的动态内存错误。Manevich R等提出了一种适用于检测空指针解引用错误的后向分析方法。本文将后向分析的思想和流敏感、上下文敏感的指针分析结合在一起,给出了一种需求驱动的空指针解引用检测静态分析算法。该算法首先由指针分析获得别名信息,然后针对所关心的数据做后向数据流分析,追踪数据传递的源头,以确定程序中的表达式是否产生解引用错误。我们在SUIF2平台上实现了这一算法。实验结果表明,算法具有较高的检测精度。Null pointer dereference is a kind of dynamic memory error that arises frequently in the C language. Roman Manevich has presented a backwards analysis method which is appropriate for detecting null pointer dereferences. In this paper, combining the idea of backwards analysis and a flow- and context-sensitive pointer analysis, we describe a demand-driven static analysis algorithm for detecting null pointer dereferences. It firstly gets the alias information from the pointer analysis, and then makes a backwards dataflow analysis to track the origin of the value of interest. We implement the algorithm in the SUIF2 compiler infrastructure, and the experimental results indicate that our algorithm has a high precision.

关 键 词：空指针解引用 指向图 后向分析 指针分析 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]