The inconsistency of documentation:a study of online C standard library documents  

作　　者：Ruishi Li Yunfei Yang Jinghua Liu Peiwei Hu Guozhu Meng 

机构地区：[1]KLois,Institute oflnformation Engineering,Chinese Academy of Sciences,Bejing,China [2]School of Cyber Security,University of Chinese Academy of Sciences,Beijing,China.

出　　处：《Cybersecurity》2022年第4期117-131,共15页网络空间安全科学与技术（英文）

基　　金：the National Key Research and Development Program(No.2020AAA0104301);National Natural Science Foundation of China(No.U1836211,61902395);the Anhui Department of Science and Technology(No.202103a05020009);Beijing Academy of Artificial Intelligence(BAAl).

摘　　要：The C standard libraries are basic function libraries standardized by the C language.Programmers usually refer to their APl documentation provided by third-party websites.Unfortunately,these documents are not necessarily complete or accurate,especially for constraint sentences of APl usage,which are called Security Specifications(SSs).SS issues can prevent programmers from following obligatory constraints,which results in APl misuse vulnerabilities.Previous work studying SS issues could only find certain types of inaccurate SSs through checking the compliance between APl usage and existing SSs.Therefore,we propose a novel approach SSeeker for quickly discovering missing and inaccurate SSs through the inconsistency of semantically similar SSs.More specifically,SSeeker first completes broken sentences and discovers SSs from them by judging their constraint sentiment.Then SSeeker puts semantically similar SSs from different sources into a group,which can be used to discover missing or inaccurate SSs.With the help of SSeeker,we investigated 4 popular online third-party C standard library documents,studied their conformity with the C99 standard,analyzed their APls and SSs,and discovered 92 prototype issues,15 web page issues,and 96 SS issues.

关 键 词：Documentation issues Security specification Standard library 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]