基于区域内存模型的空指针引用缺陷检测  

Null Pointer Dereference Defect Detected Based on Region-Based Memory Model

作　　者：董玉坤[1,2] 宫云战[1] 金大海[1] 

机构地区：[1]北京邮电大学网络与交换技术国家重点实验室,北京100876 [2]中国石油大学(华东)计算机与通信工程学院,山东青岛266580

出　　处：《电子学报》2014年第9期1744-1752,共9页Acta Electronica Sinica

基　　金：国家自然科学基金(No.91318301;No.61202080);国家863高技术研究发展计划(No.2012AA011201)

摘　　要：为了实现对C程序中空指针引用的充分检测,本文提出了一种基于区域内存模型的空指针引用缺陷检测方法.首先,提出了基于区域的符号化三值逻辑(Region-based Symbolic Three-Valued Logic,RSTVL),RSTVL能够描述C程序运行时内存中数据结构的形态信息与变量的存储状态,以及可寻址表达式间的各种关系;其次,给出了基于抽象语法树与函数摘要识别被引用指针方法;最后,结合基于RSTVL的数据流分析结果,将对被引用指针的检测转换为对相应区域的检测,给出了空指针引用缺陷检测的方法,通过函数摘要实现过程间的空指针引用缺陷检测.对比实验结果表明,本文方法在保证一定检测准确率的前提下,能够极大的减少空指针引用缺陷的漏报.In order to fully detect null pointer dereference for C procedures ,this paper introduces a method based on region-based memory model .Firstly ,region-based symbolic three-valued logic （RSTVL ） is proposed ,which can describe shape of data structures ,all kinds of memory states and relations of addressable expressions .Then ,an approach to fully recognizing pointer deref-erences based on abstract syntax tree and procedure summary is introduced .Furthermore ,this paper introduces a null pointer derefer-ence detection method ,which translates pointer dereference detection into region detection applying the result of data flow analysis based on RSTVL ,and detects interprocedural null pointer dereference based on procedure summary .Experiment results show that compared with DTSC-STVL and Klocwork9 ,the proposed method could dramatically reduce null pointer dereference false negative on the precondition of guarantee the detection precision .

关 键 词：空指针引用 内存模型 静态分析 函数摘要 缺陷检测 

分 类 号：TP311.5[自动化与计算机技术—计算机软件与理论]