一句话：对 C++ 智能指针的生命周期行为建模并追踪堆内存状态迁移，在 Clang Static Analyzer 上实现静态检测，检出大量真实缺陷。
C++ 标准不断改进的智能指针机制通过自动释放内存来防止内存泄漏，但并不能免疫所有内存错误，例如对空智能指针解引用仍会导致程序失败；由于缺乏针对智能指针的专门支持，现成的 C++ 静态分析器难以有效揭示这类缺陷。本文提出一种静态方法，通过跟踪智能指针的堆内存管理来检测内存相关缺陷：对智能指针在其生命周期内的行为建模，追踪所管理内存块的状态迁移，并针对收集到的五类缺陷模式设计专用检查器。作者在 Clang Static Analyzer 之上实现该工具，用一组手工代码片段和九个热门开源 C++ 项目与四个其他分析器对比。结果显示，该方法几乎能发现全部内置缺陷；开源项目产生的 648 条报告中经人工复核有 442 条为真阳性，其中空智能指针解引用最为常见。作者进一步为 Aria2、Restbed、MySQL 和 LLVM 设计补丁，目前已有 7 个覆盖 76 条缺陷报告的 pull request 被开发者合并。
The smart pointer mechanism, which is improved in the continuous versions of the C++ standards over the last decade, is designed to prevent memory-leak bugs by automatically deallocating the managed memory blocks. However, not all kinds of memory errors can be immunized by adopting this mechanism. For example, dereferencing a null smart pointer will lead to a software failure. Due to the lack of specialized support for smart pointers, the off-the-shelf C++ static analyzers cannot effectively reveal these bugs.In this paper, we propose a static approach to detecting memory-related bugs by tracking the heap memory management of smart pointers. The behaviors of smart pointers are modeled during their lifetime to trace the state transitions of managed memory blocks. And the specially designed checkers are used to check the state changes according to five collected bug patterns. To evaluate the effectiveness of our approach, we implement it on the top of the Clang Static Analyzer. A set of handmade code snippets, as well as nine popular open-source C++ projects, are used to compare our tool against four other analyzers. The results show that our approach can successfully discover nearly all the built-in bugs. And 442 out of 648 reports generated from the open-source projects are true positives after manual reviewing, where the bugs of dereferencing null smart pointers are most frequently reported. To further confirm our reports, we design patches for Aria2, Restbed, MySQL and LLVM, in which seven pull requests covering 76 bug reports have been merged by the developers up to now. The results indicate that pointers should always be carefully used even after migrated to smart pointers and static analysis upon specialized models can effectively detect such bugs.
DOI 原文 ·
@inproceedings{paperbot6487,
title = {Detecting Memory-Related Bugs by Tracking Heap Memory Management of C++ Smart Pointers},
author = {Xutong Ma and Jiwei Yan and Wei Wang and Jun Yan and Jian Zhang and Zongyan Qiu},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678836}
}