一句话:指出 C++ STL 序列容器元素访问缺乏边界检查,现有静态分析器因难以精确跟踪容器大小和迭代器目标而难以检测此类缺陷。
论文关注 C++ 标准模板库(STL)中序列容器(如 vector)的元素访问缺陷检测。此类访问操作在编译期和运行期均不检查边界,可能引发缓冲区溢出等内存错误。现有静态分析器难以发现这些 bug,原因在于若不精确分析序列容器和迭代器的行为,就无法准确跟踪容器大小以及迭代器目标。要检测元素访问缺陷,需要针对序列容器与迭代器的行为进行准确分析,以支撑对大小和迭代器目标的跟踪。摘要未提供具体技术方案、实现或评估结果。
Sequence Containers (SC) in the C++ Standard Template Library (STL), such as the vector, are widely used in large-scale projects for their maintainability and flexibility. However, accessing the elements in an SC is bug-prone, as such operations will not check their boundaries during compilation or execution, which can lead to memory errors, such as buffer overflow problems. And these bugs are difficult to detect with available static analyzers, since the size of SCs and the target of iterators cannot be precisely tracked without accurate analysis of the behavior of SCs and iterators.