CN103744776B - A kind of Static Analysis Method based on symbolization function summary and system - Google Patents

Abstract

The invention discloses a kind of Static Analysis Method based on symbolization function summary, the method includes: utilize RSTVL model, describes the storage state of the variable of the node of the controlling stream graph of current function；Determine when the present node of function is non-final node and present node existence function calls, the function of the function called by current function is made a summary and carries out instantiation, and update the variable affected by function call in current function；Determine that the present node of function is final node and determines when current function has function return value, it is thus achieved that the character expression of described function return value, find out the variable that storage state changes, and obtain the character expression of the variable that storage state changes；The character expression of the external variable in the variable change the character expression of described function return value and storage state adds in the function summary of current function；Meanwhile, the invention also discloses static analysis system based on symbolization function summary.Utilize the technical scheme of the embodiment of the present invention, the precision efficiency of static analysis can be effectively improved.

Description

A kind of Static Analysis Method based on symbolization function summary and system

Technical field

The present invention relates to Static Analysis Technology, be specifically related to static analysis based on symbolization function summary Method and system.

Background technology

By software program is tested it appeared that the deficiency of program self and defect.Wherein, software is surveyed Method for testing includes: static analysis and dynamic analysing method.

Static Analysis Method is also referred to as static test, refers to not actual motion tested software, but by right The scanning discovery of source program may cause the textural anomaly of program, control the situation such as throat floater and data flow anomaly. As can be seen here, program is carried out static test and be to ensure that an important step of software quality.Simultaneously as Static Analysis Method have low cost, realize simple, the advantages such as all paths can be covered and enjoy favor.

Analytical precision and analysis efficiency are two important indicators evaluating Static Analysis Method.Current process Between Static Analysis Method include: process is inline, record function call string, function summary etc.；Wherein, based on The Static Analysis Method of function summary is capable of the sensibility analysis to program context, but due in program Usually contain the data type variable that more multilevel-pointer variable, complex variable etc. are complicated, result in analysis Precision is the most not high enough with analysis efficiency.

Summary of the invention

In view of this, the main purpose of the embodiment of the present invention is to provide a kind of based on symbolization function summary Static Analysis Method and system, it is possible to increase the precision of static analysis and efficiency.

For reaching above-mentioned purpose, the technical scheme of the embodiment of the present invention is achieved in that

Embodiments provide a kind of Static Analysis Method based on symbolization function summary, described method Including:

Utilize symbolization three-valued logic RSTVL model based on region, describe the controlling stream graph of current function The storage state of variable of node；

According to described controlling stream graph, determine that the present node of described function is non-final node and described works as prosthomere When point existence function calls, the function of the function called by current function is made a summary and carries out instantiation, and update The variable affected by function call in described RSTVL model；

Determine that the present node of described function is final node and determines that described present node has function return value Time, obtain the character expression of described function return value；Find out the variable that storage state changes, and Obtain the character expression of the variable that storage state changes；Character expression by described function return value The character expression of the external variable in the variable changed with storage state adds the function of current function to In summary.

In such scheme, described utilization symbolization based on region three-valued logic RSTVL model, describe and work as The storage state of the variable of the node of the controlling stream graph of front function, including:

The global variable using parameter and the described current function of described current function generates and expands variable；

Utilizing described RSTVL model, the parameter and the described global variable that describe described current function account for respectively Region of memory, respectively corresponding character expression and respective interval；

By the parameter of described current function and described global variable expand region of memory that variable takies respectively, Character expression corresponding respectively and respective interval are described as the storage state of variable.

In such scheme, the described parameter to current function and the global variable used generate and expand variable, Including:

Based on definition-use chain, identify the global variable used by described current function, described global variable During for compound type, expand each member variable described global variable；When global variable is pointer type, Expand the every one-level pointer variable described global variable；

When the parameter of described current function is compound type, expand each member variable described parameter, institute State parameter when being pointer type, expand the every one-level pointer variable described parameter.

In such scheme, before the described function by the function called by current function is made a summary and is carried out instantiation, Described method also includes:

The function generating the described function called by current function is made a summary.

In such scheme, the function of the described function called by current function of described generation is made a summary, including:

Using the described function called by current function as called function；

RSTVL model based on described called function, obtains the symbolic formulation of the parameter of described called function Formula, the character expression of global variable；

Determine the variable that expanded the function at described called function by the parameter of described called function pointer type At exit and function entrance inconsistent time, the character expression of described expansion variable and correspondence thereof is added to In the function summary of described called function；

Determine that the interval of described global variable is at the function exit and function entrance of described called function Time inconsistent to, the character expression of described global variable and correspondence thereof is added the function of described called function In summary；

When described called function there are function return value, according to described RSTVL model, obtain described letter The character expression of number return value, and described character expression is added in described function summary.

In such scheme, described method also includes:

For the parameter of described called function, global variable, function return value character expression in every Individual symbol, obtains the interval of described symbol；

When this interval type is pointer type, and the sensing set in this pointer type interval there are When the region of zone number mark is the region of local variable, this zone number is replaced with and represents wild pointer Zone number；What pointer type was interval points to the region of non-domain of the existence number-mark in set is local variable Region time, by the zone number pointed in set interval for this pointer type and the district with this zone number Variable corresponding to territory adds in function summary；

When this interval type is non-pointer type, obtain the variable that described symbol is corresponding；Described symbol When corresponding variable is local variable to, the interval of described symbol Yu described symbol is added function summary In；When the variable that described symbol is corresponding is nonlocal variable, the variable corresponding with described symbol by described symbol Add in function summary.

In such scheme, described summary by the function of the function called by current function carries out instantiation, including:

Based on described current function context environmental at function call point, obtain and described adjusted by current function Function parameter and the argument of described current function between corresponding relation；

Obtain the character expression that argument is corresponding, and according to described corresponding relation, by symbol table corresponding for argument Reach the symbol in the character expression of formula replacement parameter.

In such scheme, the parameter of the described function called by current function of described acquisition and described current function Argument between corresponding relation, including:

When the parameter of the described function called by current function has father's variable, obtain described father's variable corresponding Argument, and according to the type expression of the described parameter argument corresponding with described father's variable, obtain described parameter Corresponding argument；

When the parameter of the described function called by current function does not has father's variable, according to described current function with Variable corresponding relation between the described function called by current function, determines the argument corresponding with described parameter.

In such scheme, described method also includes:

In described RSTVL model, when function return value is described by character expression, it is thus achieved that symbol Change each symbol in expression formula, when described symbol corresponds to the variable of described current function, it is thus achieved that described The variable that symbol is corresponding, corresponding relation based on parameter Yu argument, it is thus achieved that the argument that this variable is corresponding, according to Described current function is at the context environmental of point of invocation, it is thus achieved that the character expression that this argument is corresponding, uses argument Corresponding character expression replaces the symbol in the character expression of parameter；

Described symbol is corresponding to the symbol of the local variable generation of the described function called by current function, from institute State in the function summary of the function called by current function and obtain the interval that described symbol is corresponding, this value When interval is pointer type interval, based on described function summary, the sensing set that pointer type is interval is carried out reality Example.

In such scheme, described method also includes:

When the function return value of described current function is identified by interval, and when described interval is pointer During type interval, the sensing set interval to this pointer type carries out instantiation.

The embodiment of the present invention additionally provides a kind of static analysis system based on symbolization function summary, described system System includes:

Describe unit, for utilizing symbolization three-valued logic RSTVL model based on region, describe current The storage state of the variable of the node of the controlling stream graph of function；

First instantiating unit, for according to described controlling stream graph, determines that the present node of described function is for working as Non-final node and the described present node existence function of front function call, the function that will be called by current function Function summary carry out instantiation, and update the variable affected by function call in described RSTVL model；

Second instantiating unit, for the final node that present node is current function of described function and determine When described present node has function return value, obtain the character expression of described function return value, find out The variable that storage state changes, and obtain the character expression of the variable that storage state changes；Will The symbol of the external variable in the variable that the character expression of described function return value and storage state change Expression formula is added in the function summary of current function.

In such scheme, described system also includes:

Signal generating unit, makes a summary for generating the function of the described function called by current function.

In such scheme, described signal generating unit, it is additionally operable to:

Using the described function called by current function as called function；

RSTVL model based on described called function, obtains the symbolic formulation of the parameter of described called function Formula, the character expression of global variable；

Determine that being expanded the storage state of the variable by the parameter of described called function pointer type is adjusted described At the function exit of function and function entrance inconsistent time, by described expansion variable and the symbol table of correspondence thereof Reach in the function summary that formula adds described called function to；

Determine that the interval of described global variable is at the function exit and function entrance of described called function Time inconsistent to, the character expression of described global variable and correspondence thereof is added the function of described called function In summary；

When described called function there are function return value, according to described RSTVL model, obtain described letter The character expression of number return value, and described character expression is added in described function summary.

Embodiments provide a kind of Static Analysis Method based on symbolization function summary and system, profit With symbolization three-valued logic based on region (RSTVL, Region-based Symbolic Three Value Logic) model, describes the storage state of the variable of the node of the controlling stream graph of current function；Determine described letter The non-final node that present node is current function of number and described present node existence function be when calling, will be by The function summary of the function that current function calls carries out instantiation, and updates in current function by function call shadow The described variable rung；Determine the final node that present node is current function of described function and determine described working as When front function has function return value, it is thus achieved that the character expression of described function return value, find out storage shape The variable that state changes, and obtain the character expression of the variable that storage state changes；By described letter The character expression of the external variable in the variable that the character expression of number return value and storage state change Add in the function summary of current function.Utilize the technical scheme of the embodiment of the present invention, can be effectively improved quiet The precision of state analysis and efficiency.

Accompanying drawing explanation

Fig. 1 is that the flow process that realizes of the Static Analysis Method based on symbolization function summary of the embodiment of the present invention is shown It is intended to；

Fig. 2 is that the one of the Static Analysis Method based on symbolization function summary of the embodiment of the present invention implements Schematic flow sheet；

Fig. 3 be the embodiment of the present invention external variable generate expand variable realize schematic flow sheet；

Fig. 4 is the carrying out function summary instantiation and realize schematic flow sheet of the embodiment of the present invention；

Fig. 5 be the embodiment of the present invention obtain in function summary each parameter and to expand variable respectively corresponding Argument realize schematic flow sheet；

Fig. 6 is that being sorted according to filiation by the father's variable got of the embodiment of the present invention forms father's variables set That closes realizes schematic flow sheet；

Fig. 7 is the reality that father's variable of the type expression according to parameter of the embodiment of the present invention and this parameter is corresponding That joins argument corresponding to this parameter of acquisition realizes schematic flow sheet；

Fig. 8 is that the renewal of the embodiment of the present invention is shown by the flow process that realizes of the variable of the side effects of function call It is intended to；

Fig. 9 be the embodiment of the present invention calculate function return value realize schematic flow sheet；

Figure 10 be the embodiment of the present invention calculate function side effect realize schematic flow sheet；

Figure 11 is that the function that added to by the associated ancillary information of character expression of the embodiment of the present invention is made a summary Realize schematic flow sheet；

Figure 12 is the composition structure of the static analysis system based on symbolization function summary of the embodiment of the present invention Schematic diagram.

Detailed description of the invention

Embodiments provide a kind of Static Analysis Method based on symbolization function summary, such as Fig. 1 institute Showing, described method includes:

Step 10: utilize RSTVL model, depositing of the variable of the node of the controlling stream graph of description current function Storage state；

In the embodiment of the present invention, the storage state of variable is described, specifically with the four-tuple model of RSTVL Refer to the explanation of subsequent technology scheme.

Step 11: determine the non-final node that present node is current function of described function and described work as prosthomere When point existence function calls, the function of the function called by current function is made a summary and carries out instantiation, and update The described variable affected by function call in current function.

Here, the variable for being affected by function call can be considered as the variable by function call side effects.

Step 12: determine the final node that present node is current function of described function and determine described currently When function has function return value, it is thus achieved that the character expression of described function return value, find out storage state The variable changed, and obtain the character expression of the variable that storage state changes；By described function The character expression of the external variable in the variable that the character expression of return value and storage state change adds It is added in the function summary of current function.

Below in conjunction with Fig. 2～Figure 11, the technical scheme of the embodiment of the present invention is further detailed.

Here, will record at least one function in program file, according to practical situation, each function is in journey All can be as homophony function in preface part, it is also possible to as called function；So, the embodiment of the present invention The said method proposed is applicable to all functions described in program file.

One concrete real such as Static Analysis Method based on symbolization function summary that Fig. 2 is the embodiment of the present invention Existing schematic flow sheet, as shown in Figure 2:

Step A: in the porch of current function, generates the parameter of current function, the global variable of use Expand variable, and initialize above-mentioned variable；

In the embodiment of the present invention, it is external variable and local variable by the variable partitions of function；Wherein, described External variable includes: global variable function parameter.Initialization procedure is: the variable for fundamental type generates Symbol and Region；Variable for non-fundamental type creates Region.

Step B: choose present node in the controlling stream graph of current function；Whether judge described present node For last node of current function, if continuing with step H；Otherwise, step C is continued with；

Step C: judge whether existence function calls present node, if continuing with step D, otherwise Perform step G.

Step D: obtain the function summary of called function, continue with step E；

In the embodiment of the present invention, the function called by current function is called called function；Current function is called main Letter of transfer number.

Step E: according to the context environmental of described current function point of invocation, the function to described called function Summary carries out instantiation, continues executing with step F.

Step F: the variable by the side effects of function call in making a summary for function is updated.

Step G: utilize RSTVL model, to being described of the variable of present node；Continue executing with step Rapid B.

In the embodiment of the present invention, come each variable in description program and change with the four-tuple model of RSTVL The value of amount, this four-tuple model is < Var, Region, S_Exp, Domain >；Wherein: element Var table Show a variable in program；This variable includes top variable and the member variable of compound type variable； Region is expressed as the abstract region of memory of this variable distribution, zone number identify；S_ExpRepresent and be somebody's turn to do The character expression that variable is relevant；Domain represents the interval of this variable；Wherein, it is pointer at variable During categorical variable, the interval of this variable is also referred to as the sensing set of this variable, and this sensing set is by this change The set of the zone number of other variable that amount may be pointed to is constituted.

In short, utilize region of memory that RSTVL model, characterising parameter and global variable take, institute right The character expression answered and interval；The expansion variable of characterising parameter, the expansion variable of global variable account for Region of memory, corresponding character expression and interval.

Step H: judge whether current function has function return value, if continuing with step I；Otherwise, Continue with step J；

Step I: obtain the symbolic formulation formula of the function return value of current function, and by described character expression Add in the function summary of current function, continue executing with step J；

Step J: the node that exits at current function obtains the current function side effects by function call Parameter and global variable, and add this parameter to current letter with global variable and corresponding character expression thereof In the function summary of number, currently processed flow process terminates.

Fig. 3 be in step A for external variable generate expand variable realize schematic flow sheet；As shown in Figure 3:

Step is A.1: obtains whole global variables of current function, and adds in external variable list；

Step is A.2: extracts one by one and adds the global variable in external variable list to, it may be judged whether also has the most not A.3 the global variable being extracted, extract this global variable being not extracted by execution step if had；Otherwise hold Row step is A.5；

Step is A.3: based on definition-use chain, identify whether global variable is used by current function, if Identify and used execution step A.4 by current function；Otherwise perform step A.2；

Step is A.4: generates for this global variable and expands variable, and the expansion generated with it by this global variable Variable adds in external variable list, performs step A.2；

Step is A.5: obtains all parameters of current function, and adds in external variable list；

Step is A.6: extracts one by one and adds the parameter in external variable list to, it may be judged whether also has and do not carried The parameter taken, if it has, then extract this parameter being not extracted by perform step A.7；Otherwise, step is performed A.8；

Step is A.7: generates for this parameter and expands variable, and is added to by the expansion variable of this parameter with generation In external variable list, continue executing with step A.6, until all parameters have been extracted；

Step is A.8: judge whether also have the external variable not being initialised, if sentenced in external variable list Break as having, extract this external variable not being initialised and perform step A.9；Otherwise, step is performed A.12；

Step is A.9: judge that whether this external variable is the variable of fundamental type, if it is, perform step A.10；Otherwise, step is performed A.11；

Step is A.10: creates a symbol for external variable, proceeds step A.11；

Step is A.11: creates abstract area Region for external variable, and sets up external variable directly father The incidence relation of variable；Continue executing with step A.8, until all external variables are all initialised, afterwards, Perform step A.12.

Here, the direct relation of foundation is: set up the relation of external variable directly father's variable.

Step is A.12: external variable initializes and terminates.

Fig. 4 is to make a summary to the function of called function in embodiment of the present invention step E to carry out the realization stream of instantiation Journey schematic diagram, as shown in Figure 4:

Step is E.1: obtain each parameter in the function summary of called function and to expand variable the most corresponding Argument；

Step is E.2: obtains all symbolic formulation formulas in the function summary of called function, and adds symbol to Number change in expression list；

Step is E.3: extracts one by one and adds symbolic formulation formula in symbolic formulation formula list to, it may be judged whether Also have the symbolic formulation formula not being instantiated, extract this symbolic formulation formula not being instantiated and continue to hold Row step is E.4；Otherwise, step is performed E.10；

Step is E.4: extracts all symbols in this character expression one by one, continues executing with step E.5；

Step is E.5: judge whether also have the symbol not being instantiated, if continued in this character expression Continuous execution step is E.6；Otherwise continue executing with step E.3；

Step is E.6: extracts the symbol not being instantiated in character expression, continues executing with step E.7；

Step is E.7: judge whether this symbol not being instantiated has the variable of its correspondence in function is made a summary, If having execution step E.9；Otherwise, step is performed E.8；

Step is E.8: search, from function is made a summary, the interval that this symbol is corresponding, if the interval found For the interval of pointer type, then the sensing set to interval carries out instantiation, and by after instantiation Interval add to routine call point symbol interval set in；Continue executing with step E.5；

Step is E.9: in the function of called function is made a summary, search the variable corresponding to this symbol, Yi Jicha Look for the argument that this variable is corresponding, according to the context environmental of routine call point, obtain the symbol table that argument is corresponding Reach formula, and replace this symbol in the character expression being instantiated with the character expression that argument is corresponding；Continue Continuous execution step is E.5；

Step is E.10: the function summary instantiation process of called function terminates.

Fig. 5 is each parameter and expansion variable difference thereof in the step E.1 middle function summary obtaining called function The flowchart of corresponding argument；E.1, step can also be regarded parameter as and map the process of argument.

As shown in Figure 5:

Step is E.1.1: obtains all parameters from the function of called function is made a summary and expands variable, and adding To parameter list；

Here, described parameter includes top parameter.

Step is E.1.2: extracts one by one and adds the parameter in parameter list to, it may be judged whether is also not extracted by Parameter；This parameter being not extracted by execution step is extracted E.1.3 if had；Otherwise, step is performed E.1.11；

Step is E.1.3: obtain direct father's variable corresponding to this parameter and father's variable indirectly, and the father that will get Variable forms father's variables collection according to filiation sequence, continues executing with step E.1.4；

Whether step is E.1.4: extract the parameter variable in father's variables collection one by one, and judge in father's variables collection The parameter being also not extracted by, if there being this parameter of extraction to continue executing with step E.1.5；Otherwise perform step E.1.2；

Step is E.1.5: judge that this parameter has been to have got the variable of argument the most, if it is, perform step The most E.1.6；Otherwise, step is performed E.1.4；

Step is E.1.6: judge whether this parameter variable has father's variable, if it has, then perform step E.1.7； Otherwise, step is performed E.1.9；

Step is E.1.7: obtains the argument corresponding to father's variable of this parameter from parameter argument mapping set, continues Continuous execution step is E.1.8；

Step is E.1.8: according to the type of argument corresponding to the type expression of this parameter and this father's variable, it is thus achieved that The argument that this parameter is corresponding；

Step is E.1.9:；According to the variable corresponding relation between current function and called function, it is thus achieved that with this shape E.1.10 the argument that ginseng is corresponding, continue executing with step；

Step is E.1.10: argument corresponding for this parameter is added in parameter argument mapping set, continues executing with Step is E.1.4；

Step is E.1.11: parameter maps the process of argument and terminates.

Fig. 6 be step E.1.3 in father's variable of getting is formed father's variables collection according to filiation sequence Realize schematic flow sheet, as shown in Figure 6:

Step is E.1.3.1: extract a parameter variable in parameter list as current shape parameter；

Step is E.1.3.2: judge current shape parameter whether shape such as * .exp, if it is, perform step E.1.3.6； Otherwise, step is performed E.1.3.3；

Step is E.1.3.3: judge current shape parameter whether shape such as exp.f, if it is, perform step E.1.3.6； Otherwise, step is performed E.1.3.4；

Step is E.1.3.4: judge current shape parameter whether shape such as exp [i], if it is, perform step E.1.3.6； Otherwise, step is performed E.1.3.5；

Step is E.1.3.5: judge current shape parameter whether shape such as (exp), if it is, perform step E.1.3.6； Otherwise, step is performed E.1.3.7；

Step is E.1.3.6: add the variable of entitled exp to father variables collection, and using exp as current shape E.1.3.2 parameter, continue executing with step；

Step is E.1.3.7: sorts the variable in father's variables collection according to filiation, continues executing with step E.1.3.8；

Step is E.1.3.8: obtains father's variables collection process and terminates.

Fig. 7 be step E.1.8 according to argument corresponding to the type expression of parameter and father's variable of this parameter Obtain argument corresponding to this parameter realizes schematic flow sheet, as shown in Figure 7:

Step is E.1.8.1: extract a parameter variable in parameter list as current shape parameter；

Step is E.1.8.2: judge current shape parameter whether shape such as * .exp, if it is, perform step E.1.8.3； Otherwise, step is performed E.1.8.4；

Step is E.1.8.3: based on formulaObtain the abstract area of current shape parameter E.1.8.10 Region, perform step；

Step is E.1.8.4: judge current shape parameter whether shape such as exp.f, if it is, perform step E.1.8.5； Otherwise, step is performed E.1.8.6；

Step is E.1.8.5: based on formulaObtain the abstract district of current shape parameter E.1.8.10 territory Region, perform step；

Step is E.1.8.6: judge current shape parameter whether shape such as exp [i], if it is, perform step E.1.8.7； Otherwise, step is performed E.1.8.8；

Step is E.1.8.7: based on formulaObtain the abstract area of current shape parameter E.1.8.10 Region, perform step；

Step is E.1.8.8: judge current shape parameter whether shape such as (exp), if it is, perform step E.1.8.9； Otherwise, step is performed E.1.8.11；

Step is E.1.8.9: based on formula R^l[[(e)]]=R^l[[e]] obtains the abstract area of current shape parameter E.1.8.10 Region, perform step；

Step is E.1.8.10: obtain the variable corresponding to the Region of abstract area of current shape parameter；

Step is E.1.8.11: process terminates.

Here, between the information of the abstract storage that RSTVL model describes, association is represented by a four-tuple σ=(σ_r,σ_s,σ_f,σ_d), wherein:

σ_r: V → R, represent the relation of addressable expression formula and abstract area, be the association of a multi-to-multi, one The possible corresponding multiple abstract area of individual addressable expression formula, an abstract area is likely to describe multiple addressable The abstract storage of expression formula；

σ_s:R→S_Exp, represent that abstract area maps with character expression；

σ_f:S_Exp→ S, represents the relation of character expression and symbol, is the association of a multi-to-multi, a symbol Number expression formula is consisted of mathematical operation several symbols；

σ_d: S → D, represent the mapping of symbol and abstract interval, each symbol has an interval；

Various operations to addressable expression formula, all firstly the need of the abstract area corresponding to acquisition.Definition R^l[[e]] represents on program point l, in abstract storage ρ, and the regional ensemble that addressable expression formula e is corresponding.

The strategy that obtain abstract area corresponding to various types of addressable expression formulas be given below:

$R^l\left[\right[v\left]\right]={\mathrm{\&rho;}}_v^l\left(v\right)$

$R^l\left[\right[e.f\left]\right]=\underset{r\&Element;R^l\left[e\right]}{\mathrm{\&cup;}}{\mathrm{\&rho;}}_f^l(r,f)$

$R^l\left[\right[e\left[i\right]\left]\right]=\underset{r\&Element;R^l\left[e\right]}{\mathrm{\&cup;}}{\mathrm{\&rho;}}_f^l(r,i)$

$R^l\left[\right[*e\left]\right]=\underset{r\&Element;R^l\left[e\right]}{\mathrm{\&cup;}}{\mathrm{\&rho;}}_r^l\left(r\right)$

R^l[[(e)]]=R^l[[e]]

$R^l\left[\right[e->f\left]\right]=\underset{r\&Element;R^l\left[e\right]}{\mathrm{\&cup;}}\left(\underset{r^{\&prime;}\&Element;{\mathrm{\&rho;}}_r^l\left(r\right)}{\mathrm{\&cup;}}{\mathrm{\&rho;}}_f^l(r^{\&prime;},f)\right)$

Wherein, to each program point l, gather R^lSimulation can be accessed for regional ensemble at l.Set S^l Represent the assemble of symbol used at l program point.

In the embodiment of the present invention, each program point l is all had an abstract storage:Its In:

Map memory object to abstract area；

Represent the points relationship between abstract area；

Map member to the abstract area of a composite construction variable.

Fig. 8 be step F updates the side effects by function call variable realize schematic flow sheet； As shown in Figure 8:

Step is F.1: obtain the regional ensemble of argument corresponding to parameter；

Step is F.2: judge in this regional ensemble whether only one of which region, if it is, perform step F.3； Otherwise, step is performed F.4；

Step is F.3: replace character expression corresponding in region with the character expression after instantiation, it is achieved strong Update, perform step F.8；

Step is F.4: judge whether also have the region not being updated in regional ensemble, if it has, perform step F.5；Otherwise, step is performed F.8；

Step is F.5: takes a region not being updated from regional ensemble as current region, continues executing with step The most F.6；

Step is F.6: context environmental based on routine call point, calculates the character expression after instantiation Interval (first is interval), and calculate the interval corresponding to character expression (the in this interval (the first interval) Two is interval), the first interval and the second interval are asked and obtained between a new district；

Step is F.7: the variable corresponding for current region creates a new symbol, the district that this new symbol is corresponding Between for ask and after described new district between, and add described new symbol and described new interval to program point In the set of symbol interval；A new character expression is generated, with this new symbol table for described new symbol Reach formula and replace the character expression in current region, it is achieved weak renewal operates, and continues executing with step F.4；

Step is F.8: currently processed flow process terminates.

Fig. 9 is the symbolic formulation formula of the function return value obtaining current function in step I, and by described symbol Number expression formula is added to and is realized schematic flow sheet in the function summary of current function；Fig. 9 can also be considered as meter Calculate the process of function return value；Concrete, as shown in Figure 9:

Step is I.1: exits all predecessor node of node and then obtains institute by obtaining function from controlling stream graph There is the node of function return statement；

Step is I.2: extract the node of function return statement one by one, it may be judged whether the function being also not extracted by returns Return the node of statement, if it has, then perform step I.3；Otherwise, step is performed I.6；

Step is I.3: the node of the function return statement this being not extracted by, as present node, continues executing with step The most I.4；

Step is I.4: according to the program state of the return node of current function, worked as based on RSTVL model I.4 the character expression of front nodal point, continue executing with step；

Step is I.5: using described character expression as the description value of the function return value to present node, add In the function summary of current function；

Step is I.6: calculates function return value and terminates.

Figure 10 is parameter and the global variable that step J obtains the side effects by function call, and by this ginseng Number adds to global variable and corresponding character expression thereof and to realize schematic flow sheet during function is made a summary；This Outward, Figure 10 can also be considered as calculating the process of function side effect；Concrete, as shown in Figure 10:

Step is J.1: obtain all external variables of current function；

This external variable includes: parameter, global variable and expansion variable；

Step is J.2: extract external variable one by one, it may be judged whether have by undrawn external variable, if it has, Perform step J.3；Otherwise, step is performed J.8；

Step is J.3: the external variable this being not extracted by is as variable to be analyzed；

Step is J.4: obtains this variable to be analyzed and exits the character expression of node at function；

Step is J.5: judge this variable to be analyzed function exit the character expression of node with at the initial joint of function The character expression of point is the most consistent, if it is, perform step J.2；Otherwise, step is performed J.6；

Step is J.6: at function, this variable to be analyzed is exited the character expression of node with it and adds function to and pluck In Yaoing；

Step is J.7: added to by the associated ancillary information of this character expression in function summary；

Here, the associated ancillary information of described character expression includes: the abstract area that character expression is corresponding, Variable etc. corresponding to this abstract area.

Step is J.8: calculates function side effect and terminates.

Figure 11 be step J.7 the associated ancillary information of character expression is added to function summary realize flow process Schematic diagram；As shown in figure 11:

Step is J.7.1: RSTVL model based on current function, it is thus achieved that in the character expression of current function All symbols；

Step is J.7.2: extract the symbol in character expression one by one, it may be judged whether also have undrawn symbol table Reach formula；If it is, perform step J.7.3；Otherwise perform step J.7.17；

Step is J.7.3: using undrawn symbol as pending symbol；

Step is J.7.4: the most existing this pending symbol in discriminant function summary, if having execution step J.7.2； Otherwise perform step J.7.5；

Step is J.7.5: obtains the variable that this symbol is corresponding, continues executing with step J.7.6；

Step is J.7.6: judge whether the variable that this symbol is corresponding is external variable, if it is, perform step J.7.7； Otherwise perform step J.7.8；

Step is J.7.7: is added to by variable corresponding for this symbol in function summary, continues executing with step J.7.2；

Step is J.7.8: obtains the interval of variable corresponding to this symbol, continues executing with step J.7.9；

Step is J.7.9: judge whether this interval is pointer type interval, if it is, perform step J.7.11；Otherwise, step is performed J.7.10；

Step is J.7.10: is added to by interval corresponding for this symbol in function summary, performs step J.7.2；

Step is J.7.11: obtains the sensing set of this pointer type interval, continues executing with step J.7.12；

Step is J.7.12: extract the zone number in this sensing set one by one, it may be judged whether the most undrawn During zone number, if performing step J.7.13；Otherwise perform step J.7.10；

Step is J.7.13: obtain variable (the letter speech described by the region that this zone number being not extracted by is corresponding Variable corresponding to this zone number)；

Step is J.7.14: judge whether the variable that this zone number is corresponding is external variable, if it is, perform Step is J.7.15；Otherwise, step is performed J.7.16；

Step is J.7.15: this zone number and the variable corresponding to this zone number are added in function summary；

Step is J.7.16: this zone number replaces with wild pointer " wild "；

Step is J.7.17: currently processed end.

Below in conjunction with one section of code, as a example by RSFVL model, the technical scheme of the embodiment of the present invention is carried out Further instruction.In this code homophony function be function g, called function be function f, specific as follows:

In above-mentioned code, S1～S16 of left part represents the line number of this section of code；As can be seen here, generation The execution statement of S9～the S16 action-function g of code；S5～S8 is the execution statement of function f；Wherein, homophony Function g calls called function f at S15 row.

Order performs above-mentioned code, when going to called function f, analyzes first in function f carries out process The function summary of defined function f；The function summary of function f now is sky, needs along with the mistake to function f The function summary of stuffing function f is analyzed in journey.Wherein, described function summary record has: variable and correspondence thereof Character expression between corresponding relation and variable and the Region of correspondence thereof between corresponding relation and Corresponding relation between the character expression of variable and the Domain of correspondence thereof and representing with character expression Function return value.

In the S5 position of the i.e. code in function f porch, getting the variable that function f used is parameter pst And p；And respectively parameter pst and p generate respective expansion variable；Because parameter pst is pointer type Structure variable, thus for parameter pst generate expansion variable include: * pst, (* pst) .m, (* pst) .n, *(*pst).n；Parameter p is pointer type variable, so the expansion variable for the generation of parameter p is * p.Above-mentioned In parameter pst, parameter p and respective expansion variable thereof, pst, (* pst) .m, (* pst) .n, * (* pst) .n, p, * p is the variable of fundamental type, then the variable for these fundamental types generates symbol and creates respective Region, the symbol generated such as (* pst) .n is * (* pst) .n_1213, zone number is 1213.And expand variable * pst is not the variable of fundamental type, it is not necessary to generate symbol for * pst, is only required to be * pst and creates Region. Here, * pst be direct father's variable of (* pst) .n, pst be direct father's variable of * pst, set up sub-variable with straight Connect the relation of father's variable.Take out for the distribution of these external variables by creating Region for each external variable As region of memory.

Owing to S6, S7 row there are program statement as implied above, so, in the exit of function f, outward The value of portion's variable (* pst) .m and (* pst) .n all there occurs change；Wherein, owing to time at function entrance being * the character expression that (* pst) .n generates is * (* pst) .n_1213, so by * (* pst) .n and character expression * during the corresponding relation between (* pst) .n_1213 adds the function summary of function f to；

After performing the statement of S6 row, using * (* pst) .n_1213+1 as the symbol of external variable (* pst) .m Expression formula；And by the corresponding pass between external variable (* pst) .m and character expression * thereof (* pst) .n_1213+1 System adds in the function summary of function f.Owing to being the Region of external variable * p establishment at function entrance Zone number be ubm_3, so zone number ubm_3 corresponding for * p to be added to the letter of function f In number summary.So far, the function summarization generation of function f, terminates analyzing in the process of function f.

Go to the program statement about homophony function g, describe homophony on controlling stream graph with RSTVL model Program state on each program point of function g i.e. by the execution of the program statement to homophony function g, by Step obtains the abstract region of memory corresponding to all variablees of homophony function f, each variable (by zone number Characterize) character expression relevant with variable and the interval of each variable.

There are at S15 row and function f is called, it is thus achieved that the function summary of function f, need afterwards letter Variable (* pst) .m, * p, * (* pst) .n in number f function summary obtains corresponding argument variable, process As follows:

Judge that * (* pst) .n is the variable of shape such as * .exp, add (* pst) .n to father variables collection；And judge (* pst) .n is the variable of shape such as exp.f, adds * pst to father variables collection；Judge that * pst is shape such as * .exp Variable, pst is added to father's variables collection；Thus can get father's variables collection of * (* pst) .n for pst, *pst、(*pst).n}；Similar with above-mentioned processing procedure, father's variables collection of available (* pst) .m is { pst, * pst}. Understood pst by S15 row and correspond to argument ps, upper according to the program point before S15 row in homophony function g Hereafter environment understands again * pst and correspond to argument s, it is judged that parameter * pst corresponding to argument s is shape such as * .exp Variable, then according to formulaThe zone number obtaining the region corresponding to * pst is S_03, s_03 point to s.n, argument, and the S14 row at code understands, and s.n has pointed to argument a, so * (* pst) .n Correspond to argument a；Available (* pst) .m similar with above-mentioned processing procedure correspond to argument s.m；

Because father's variable list of * p is that { p}, p correspond to Shi Can &b, according to S15 row in homophony function g The context environmental of program point before understands * p and correspond to argument b；So far complete variable (* pst) .m, * p, * the processing procedure of the argument variable that (* pst) is corresponding for .n.

After the argument variable corresponding to variable in the function finding out function f is made a summary, find out by function call The variable of side effects, and update in the RSTVL model of homophony function g and become by side effects Amount, process is as follows:

The character expression corresponding to (* pst) .m in function summary is * (* pst) .n_1213+1, * (* pst) .n_1213 is the character expression generated for * (* pst) .n, and * (* pst) .n correspond to homophony function g In argument a, the character expression of argument a be the value of 0(argument a be 0), then with 0 replace symbol table Reach * (* pst) .n_1213 in formula * (* pst) .n_1213+1, obtain 0+1, i.e. obtain 1.And (* pst) .m pair Answer argument s.m, i.e. homophony function f is after calling called function f, and the value of parameter s.m is subject to The side effects of function call is modified to 1, then update the ginseng in the RSTVL model of homophony function g The interval Domain of number s.m.

(* pst) .n during function is made a summary, the interval sensing collection of corresponding pointer type be combined into ubm_3}, In the function of function f is made a summary, the zone number that ubm_3 is distributed by * p, and * p correspond to homophony function Argument b in g；After the S14 of homophony function g performs, the zone number of b is bm_2, function summary f In the sensing set of (* pst) .n { ubm_3} is replaced by zone number { bm_2}, and (* pst) .n of argument b Correspond to argument s.n in homophony function, function f passes through after calling called function f, parameter s.n Pointed to argument b by the side effects of function call, then update RSTVL parameter s.n of homophony function g Sensing set.

Meanwhile, the embodiment of the present invention has also stated that a kind of static analysis system based on symbolization function summary, As shown in figure 12, described system includes:

Describe unit 21, be used for utilizing RSTVL model, describe the node of the controlling stream graph of current function The storage state of variable；

First instantiating unit 22, for according to described controlling stream graph, determines that the present node of described function is Non-final node and the described present node existence function of current function call, the letter that will be called by current function The function summary of number carries out instantiation, and updates the variable affected by function call in described RSTVL model；

Second instantiating unit 23, for the final node that present node is current function and really of described function When fixed described present node has function return value, obtain the character expression of described function return value, search Go out the variable that storage state changes, and obtain the character expression of the variable that storage state changes； By the character expression of the external variable that the character expression of described function return value changes with storage state Add in the function summary of current function.

Described system also includes: signal generating unit 24, for generating the letter of the described function called by current function Number summary.

Described signal generating unit 24, specifically for:

Using the described function called by current function as called function；

RSTVL model based on described called function, obtains the symbolic formulation of the parameter of described called function Formula, the character expression of global variable；

Determine that being expanded the storage state of the variable by the parameter of described called function pointer type is adjusted described At the function exit of function and function entrance inconsistent time, by described expansion variable and the symbol table of correspondence thereof Reach in the function summary that formula adds described called function to；

Determine that the interval of described global variable is at the function exit and function entrance of described called function Time inconsistent to, the character expression of described global variable and correspondence thereof is added the function of described called function In summary；

If described called function there are function return value, according to described RSTVL model, obtain described The character expression of function return value, and described character expression is added in described function summary.

It will be appreciated by those skilled in the art that the static analysis based on symbolization function summary shown in Figure 12 The function that realizes of each processing unit of system can refer to aforementioned Static Analysis Method based on symbolization function summary Associated description and understand.It will be appreciated by those skilled in the art that plucking based on symbolization function shown in Figure 12 In the static analysis system wanted, the function of each processing unit can be realized by the program that runs on processor, Also can be realized by concrete logic circuit.

The said method of embodiment of the present invention offer and system, compared with prior art, can be effectively improved static state The analytical precision analyzed and analysis efficiency, additionally, also have the advantage that

1) embodiment of the present invention application RSTVL model describes variable, applies this model both can represent variable Value, can represent that again level between the another name relation between variable, composite data type variable and its member closes It is, also can represent the logic association relation of the value of fundamental type variable；It is to say, this model can represent Between memory object when program is run, lvalue that may be present associate with between r value, between lvalue between association, r value Likely associating of association；As can be seen here, embodiment of the present invention RSTVL model can the most comprehensively be retouched State the incidence relation between the incidence relation of variable self and variable.

2) the function summary of embodiment of the present invention symbolization, wherein the value character expression of variable is retouched State, for the symbol in character expression, the variable of its correspondence is divided into local variable and external variable two kinds Situation；For the symbol of local variable, add the interval that this symbol function exits node to function In summary；For the symbol of external variable, including: parameter or global variable, by corresponding for this symbol External variable add to function summary in for function make a summary instantiation time；If taking in function summary Value interval is pointer type interval, then compiled in the region pointed in set of this pointer type interval Number corresponding variable adds in function summary；As can be seen here, the function that the embodiment of the present invention uses is plucked Want, have recorded the information that function summary is relevant comprehensively.

3) because function summary comprehensively encapsulates the information of called function, obtain based on RSTVL model The corresponding relation between variable and the variable at routine call point in function summary, thus function is made a summary In character expression, pointer type interval carry out instantiation.As can be seen here, the present invention is used to implement The technical scheme of example, can be effectively improved the accuracy of function summary instantiation.

The above, only presently preferred embodiments of the present invention, it is not intended to limit the protection model of the present invention Enclose.

Claims (13)

1. a Static Analysis Method based on symbolization function summary, it is characterised in that described method includes:

Utilize symbolization three-valued logic RSTVL model based on region, describe the controlling stream graph of current function The storage state of variable of node；

According to described controlling stream graph, determine that the present node of described function is non-final node and described works as prosthomere When point existence function calls, the function of the function called by current function is made a summary and carries out instantiation, and update The variable affected by function call in described RSTVL model；

Determine that the present node of described function is final node and determines that described present node has function return value Time, obtain the character expression of described function return value；Find out the variable that storage state changes, and Obtain the character expression of the variable that storage state changes；Character expression by described function return value The character expression of the external variable in the variable changed with storage state adds the function of current function to In summary.

The Static Analysis Method of symbolization function the most according to claim 1 summary, it is characterised in that Described utilization symbolization based on region three-valued logic RSTVL model, describes the controlling stream graph of current function The storage state of variable of node, including:

The global variable using parameter and the described current function of described current function generates and expands variable；

Utilizing described RSTVL model, the parameter and the described global variable that describe described current function account for respectively Region of memory, respectively corresponding character expression and respective interval；

By the parameter of described current function and described global variable expand region of memory that variable takies respectively, Character expression corresponding respectively and respective interval are described as the storage state of variable.

The Static Analysis Method of symbolization function summary the most according to claim 2, it is characterised in that institute State the parameter to current function and the global variable generation expansion variable used, including:

Based on definition-use chain, identify the global variable used by described current function, described global variable During for compound type, expand each member variable described global variable；When global variable is pointer type, Expand the every one-level pointer variable described global variable；

When the parameter of described current function is compound type, expand each member variable described parameter, institute State parameter when being pointer type, expand the every one-level pointer variable described parameter.

The Static Analysis Method of symbolization function the most according to claim 1 summary, it is characterised in that Before the described function by the function called by current function is made a summary and carried out instantiation, described method also includes:

The function generating the described function called by current function is made a summary.

The Static Analysis Method of symbolization function the most according to claim 4 summary, it is characterised in that The function of the described function called by current function of described generation is made a summary, including:

Using the described function called by current function as called function；

RSTVL model based on described called function, obtains the symbolic formulation of the parameter of described called function Formula, the character expression of global variable；

Determine the variable that expanded the function at described called function by the parameter of described called function pointer type At exit and function entrance inconsistent time, the character expression of described expansion variable and correspondence thereof is added to In the function summary of described called function；

Determine that the interval of described global variable is at the function exit and function entrance of described called function Time inconsistent to, the character expression of described global variable and correspondence thereof is added the function of described called function In summary；

When described called function there are function return value, according to described RSTVL model, obtain described letter The character expression of number return value, and described character expression is added in described function summary.

The Static Analysis Method of symbolization function the most according to claim 5 summary, it is characterised in that Described method also includes:

For the parameter of described called function, global variable, function return value character expression in every Individual symbol, obtains the interval of described symbol；

When this interval type is pointer type, and the sensing set in this pointer type interval there are When the region of zone number mark is the region of local variable, this zone number is replaced with and represents wild pointer Zone number；What pointer type was interval points to the region of non-domain of the existence number-mark in set is local variable Region time, by the zone number pointed in set interval for this pointer type and the district with this zone number Variable corresponding to territory adds in function summary；

When this interval type is non-pointer type, obtain the variable that described symbol is corresponding；Described symbol When corresponding variable is local variable to, the interval of described symbol Yu described symbol is added function summary In；When the variable that described symbol is corresponding is nonlocal variable, the variable corresponding with described symbol by described symbol Add in function summary.

The Static Analysis Method of symbolization function the most according to claim 1 summary, it is characterised in that Described summary by the function of the function called by current function carries out instantiation, including:

Based on described current function context environmental at function call point, obtain and described adjusted by current function Function parameter and the argument of described current function between corresponding relation；

Obtain the character expression that argument is corresponding, and according to described corresponding relation, by symbol table corresponding for argument Reach the symbol in the character expression of formula replacement parameter.

The Static Analysis Method of symbolization function the most according to claim 7 summary, it is characterised in that Corresponding between parameter and the argument of described current function of the described function called by current function of described acquisition Relation, including:

When the parameter of the described function called by current function has father's variable, obtain described father's variable corresponding Argument, and according to the type expression of the described parameter argument corresponding with described father's variable, obtain described parameter Corresponding argument；

When the parameter of the described function called by current function does not has father's variable, according to described current function with Variable corresponding relation between the described function called by current function, determines the argument corresponding with described parameter.

The Static Analysis Method of symbolization function the most according to claim 1 summary, it is characterised in that Described method also includes:

In described RSTVL model, when function return value is described by character expression, it is thus achieved that symbol Change each symbol in expression formula, when described symbol corresponds to the variable of described current function, it is thus achieved that described The variable that symbol is corresponding, corresponding relation based on parameter Yu argument, it is thus achieved that the argument that this variable is corresponding, according to Described current function is at the context environmental of point of invocation, it is thus achieved that the character expression that this argument is corresponding, uses argument Corresponding character expression replaces the symbol in the character expression of parameter；

Described symbol is corresponding to the symbol of the local variable generation of the described function called by current function, from institute State in the function summary of the function called by current function and obtain the interval that described symbol is corresponding, this value When interval is pointer type interval, based on described function summary, the sensing set that pointer type is interval is carried out reality Example.

10. the Static Analysis Method made a summary according to the symbolization function described in claim 1 or 9, its feature Being, described method also includes:

When the function return value of described current function is identified by interval, and when described interval is pointer During type interval, the sensing set interval to this pointer type carries out instantiation.

11. 1 kinds of static analysis systems based on symbolization function summary, it is characterised in that described system bag Include:

Describe unit, for utilizing symbolization three-valued logic RSTVL model based on region, describe current The storage state of the variable of the node of the controlling stream graph of function；

First instantiating unit, for according to described controlling stream graph, determines that the present node of described function is for working as Non-final node and the described present node existence function of front function call, the function that will be called by current function Function summary carry out instantiation, and update the variable affected by function call in described RSTVL model；

Second instantiating unit, for the final node that present node is current function of described function and determine When described present node has function return value, obtain the character expression of described function return value, find out The variable that storage state changes, and obtain the character expression of the variable that storage state changes；Will The symbol of the external variable in the variable that the character expression of described function return value and storage state change Expression formula is added in the function summary of current function.

12. static analysis systems based on symbolization function summary according to claim 11, its feature Being, described system also includes:

Signal generating unit, makes a summary for generating the function of the described function called by current function.

13. static analysis systems based on symbolization function summary according to claim 12, its feature It is that described signal generating unit is additionally operable to:

Using the described function called by current function as called function；

RSTVL model based on described called function, obtains the symbolic formulation of the parameter of described called function Formula, the character expression of global variable；

Determine that being expanded the storage state of the variable by the parameter of described called function pointer type is adjusted described At the function exit of function and function entrance inconsistent time, by described expansion variable and the symbol table of correspondence thereof Reach in the function summary that formula adds described called function to；

Determine that the interval of described global variable is at the function exit and function entrance of described called function Time inconsistent to, the character expression of described global variable and correspondence thereof is added the function of described called function In summary；

When described called function there are function return value, according to described RSTVL model, obtain described letter The character expression of number return value, and described character expression is added in described function summary.