一句话：本文旨在填补 C/C++ 生态第三方库依赖理解的空白，分析其现状、挑战与漏洞风险。
第三方库（TPL）被广泛复用以降低开发成本，但外部依赖可能将漏洞引入宿主应用。Java、Python、JavaScript 等生态已有包管理器与大量依赖研究，而 C/C++ 因缺乏统一包管理器，对其 TPL 依赖的认识仍十分有限，尤其缺乏大规模理解。本文聚焦 C/C++ 生态中的第三方库依赖问题，旨在系统性地理解其依赖现状、管理方式及安全影响，并指出与其它语言生态的差距。摘要未详述具体方法，但强调在大规模层面填补这一空白，为后续依赖分析、漏洞管理和工具支持提供基础。
Third-party libraries (TPLs) are frequently reused in software to reduce development cost and the time to market. However, external library dependencies may introduce vulnerabilities into host applications. The issue of library dependency has received considerable critical attention. Many package managers, such as Maven, Pip, and NPM, are proposed to manage TPLs. Moreover, a significant amount of effort has been put into studying dependencies in language ecosystems like Java, Python, and JavaScript except C/C++. Due to the lack of a unified package manager for C/C++, existing research has only few understanding of TPL dependencies in the C/C++ ecosystem, especially at large scale.
@inproceedings{paperbot7293,
title = {Towards Understanding Third-party Library Dependency in C/C++ Ecosystem},
author = {Wei Tang and Zhengzi Xu and Chengwei Liu and Jiahui Wu and Shouguo Yang and Yi Li and Ping Luo and Yang Liu},
booktitle = {ASE},
year = {2022},
doi = {10.1145/3551349.3560432}
}