一句话：提出TsmartGP，用流、上下文、域与准路径敏感指针分析高效检测C程序内存缺陷。
内存缺陷检测依赖精确的指针分析，但流敏感、上下文敏感、域敏感和路径敏感等精度维度难以同时兼顾，需在精度与效率间权衡。本文提出静态分析工具TsmartGP，其指针分析算法同时具备流敏感、上下文敏感、域敏感和准路径敏感：以控制流自动机实现流敏感，用函数摘要获取上下文信息，处理聚合结构元素，并用路径条件过滤不可达路径；为提升效率，还提出多入口机制。基于该算法实现未初始化指针错误检查器，并在13个真实C程序上评估。与Cppcheck和Clang Static Analyzer相比，TsmartGP能发现更多错误且准确率更高。
Precise pointer analysis is desired since it is a core technique to find memory defects. There are several dimensions of pointer analysis precision, flow sensitivity, context sensitivity, field sensitivity and path sensitivity. For static analysis tools utilizing pointer analysis, considering all dimensions is difficult because the trade-off between precision and efficiency should be balanced. This paper presents TsmartGP, a static analysis tool for finding memory defects in C programs with a precise and efficient pointer analysis. The pointer analysis algorithm is flow, context, field, and quasi path sensitive. Control flow automatons are the key structures for our analysis to be flow sensitive. Function summaries are applied to get context information and elements of aggregate structures are handled to improve precision. Path conditions are used to filter unreachable paths. For efficiency, a multi-entry mechanism is proposed. Utilizing the pointer analysis algorithm, we implement a checker in TsmartGP to find uninitialized pointer errors in 13 real-world applications. Cppcheck and Clang Static Analyzer are chosen for comparison. The experimental results show that TsmartGP can find more errors while its accuracy is also higher than Cppcheck and Clang Static Analyzer. The demo video is available at https://youtu.be/IQlshemk6OA.
DOI 原文 ·
@inproceedings{paperbot5315,
title = {TsmartGP: A Tool for Finding Memory Defects with Pointer Analysis},
author = {Yuexing Wang and Guang Chen and Min Zhou and Ming Gu and Jiaguang Sun},
booktitle = {ASE},
year = {2019},
doi = {10.1109/ase.2019.00129}
}