JP2004145381A - Static analysis system for source program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a static analysis system for analyzing errors on the syntax of a source program and the flow of a process which cannot be analyzed unless the source program is operated. <P>SOLUTION: The system includes an input means for inputting the source program 10; a structure analysis tree creating part 110 for creating a structural analysis tree 111 from the source program 10; a structure analyzing part 112 for analyzing the structural analysis tree 111 based on the file of a rule file storing part 116; a resource use management table 118 and an analytical result buffer 113 for retaining the analytical results provided by the structure analyzing part 112; an analysis result editing part 114 for editing the analytical results; and an analytical result output part 115 for outputting the analytical results edited by the analytical result editing part 114. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a static analysis device for a source program, and more particularly to a static analysis device for a source program that statically analyzes a source program and can detect a defect in a source program production stage.
[0002]
[Prior art]
Generally, a static analyzer of a source program according to the related art analyzes a source program input by an input unit of the static analyzer to detect a syntax error, and analyzes the syntax by an output unit of the static analyzer. Output the result.
[0003]
Further, as a technique relating to a source program static analysis apparatus according to another conventional technique, for example, a technique described in Patent Document 1 or the like is known. This conventional technique stores definition information of a source program for each patterned check item, compares the processing of the source program divided based on the check item with the definition information, and determines whether the handling of the definition information is correct. It is to analyze.
[0004]
[Patent Document 1]
JP-A-8-69380 [0005]
[Problems to be solved by the invention]
According to the above-described prior art, the source program is compared with check items prepared in advance, and only the syntax error of the source program is pointed out. There is a problem that it cannot be done. Further, the above-described conventional technique has a problem that the analysis target is a single file, and it is not possible to check a source program over a plurality of files.
[0006]
2. Description of the Related Art Conventionally, a dynamic analyzer has been used to analyze the flow of processing during the operation of a source program. However, in order to use the dynamic analysis device, it takes time and effort to prepare the program execution environment and test data corresponding to all conditional branches.
[0007]
SUMMARY OF THE INVENTION An object of the present invention is to solve the above-described problems of the related art, analyze information and processing that change during the operation of a source program without preparing a program execution environment and test data, and output an analysis result. Another object of the present invention is to provide a static analysis device for a source program capable of performing analysis over a plurality of files.
[0008]
[Means for Solving the Problems]
According to the present invention, an object of the present invention is to provide a static analysis apparatus for a source program that statically analyzes a source program and outputs an analysis result, an input unit capable of inputting a plurality of the source programs, and securing and releasing resources. Analysis means for analyzing the source program input by the input means on the basis of a rule file describing a rule for checking the correspondence between the resource program and the resource occupancy and the release of the occupation, and analysis by the structure analysis means Output means for outputting a result.
[0009]
Further, the above object is achieved when the structure analyzing means includes a control structure tree creating means for expanding a processing flow of the source program input by the input means into a control structure tree.
[0010]
Also, the object is that the structure analysis means refers to the rule file and writes a processing procedure of securing and releasing the resource from the control structure tree to a resource use management table for managing use of the resource, This is achieved by checking the processing order of securing and releasing resources.
[0011]
Further, the object is that the structure analysis means refers to the rule file, writes a processing procedure of occupation and release of the resource from the control structure tree to a resource use management table for managing use of the resource, This is achieved by checking the processing order of occupation and release of the resource.
[0012]
In the above description, when the structure analysis means reads one source program to the end, the structure analysis means continuously reads the specified source program, keeps information of the resource use management table during this time, and checks for securing and releasing resources over a plurality of files. It is possible to do.
[0013]
According to the present invention, by having the above-described means, it is possible to analyze information and processing that change during the operation of the source program without operating the source program. Therefore, it is possible to realize a part of the functions of the conventional dynamic analyzer without having to prepare an execution environment for the source program.
[0014]
Further, according to the present invention, an error can be detected in a source program development stage by detecting an error in a source program development stage and notifying the error to a source program creator.
[0015]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, an embodiment of a static analysis device for a source program according to the present invention will be described in detail with reference to the drawings.
[0016]
FIG. 1 is a block diagram showing the configuration of a source program static analysis device according to an embodiment of the present invention. In FIG. 1, reference numeral 10 denotes a source program, 11 denotes a static analysis device, 12 denotes an analysis result, 110 denotes a control structure tree creation unit, 111 denotes a control structure tree, 112 denotes a structure analysis unit, 113 denotes an analysis result buffer, and 114 denotes an analysis result. A result editing unit, 115 is an analysis result output unit, 116 is a rule file storage unit, 117 is a rule file editing unit, and 118 is a resource use management table.
[0017]
The static analysis device 11 according to the embodiment of the present invention includes a control structure tree creation unit 110, a control structure tree 111, a structure analysis unit 112, an analysis result buffer 113, an analysis result editing unit 114, an analysis result output unit 115, and a rule file accumulation. A rule file editing unit 117 for editing a rule file such as changing or adding a function to be checked, and a resource use management table 118 such as a memory, a file, and a communication socket. Then, the static analysis device 11 reads the source program 10 and expands the source program 10 into the control structure tree 111 in the control structure analysis tree creation unit 110. The structure analysis unit 112 analyzes the control structure tree 111 based on the file contents stored in the rule file storage unit 116, and stores the resource use management table 118 and the analysis result buffer 113 created from the rule file storage unit 116. And outputs the sequential analysis result. The analysis result editing unit 114 edits the analysis result of the analysis result buffer 113 and creates an output format error message. The analysis result output unit 115 receives the analysis result from the analysis result editing unit 114, and outputs the analysis result as the analysis result 12.
[0018]
FIG. 2 is a flowchart for explaining the outline of the processing operation in the static analysis device 11 according to the embodiment of the present invention, which will be described next.
[0019]
(1) First, the static analysis device 11 reads the source program 10. At this time, if a plurality of files are specified in the source program 10, the next file is read continuously. The source program 10 that can be analyzed by the static analysis device 11 is C language, Visual C ₊₊ , Java (registered trademark), or the like. By preparing the static analysis device 11 corresponding to each language, the Analysis becomes possible (step S1).
[0020]
(2) Next, the static analysis device 11 causes the control structure tree creation unit 110 to create the control structure tree 111. The detailed process of creating the control structure tree will be described later with reference to FIGS. 3 and 4 (step S2).
[0021]
(3) After creating the control structure tree 111, the static analysis device 11 reads the rule file in the rule file storage unit 116. The rule file storage unit 116 includes a set of resource securing / release functions to be checked by the static analyzer 11 and a means for confirming success / failure of resource securing, a set of resource occupancy / release functions, and a resource occupancy release function. A means for confirming success / failure is defined. The description format of the rule file in the rule file storage unit 116 will be described later with reference to FIG. 9 (step S3).
[0022]
(4) Next, the static analysis device 11 creates the resource use management table 118 based on the rule file in the rule file storage unit 116. The resource use management table 118 is created by extracting the resource reservation / release and occupancy / release requests defined in the rule file storage unit 116. The structure of the resource use management table 118 will be described later with reference to FIG. 10 (step S4).
[0023]
(5) After creating the resource use management table 118, the structure analysis unit 112 in the static analysis device 11 analyzes the control structure tree 111 based on the rule file in the rule file storage unit 116. The detailed process of analyzing the control structure tree 111 will be described later with reference to FIGS. 5 and 6 (step S5).
[0024]
(6) The static analysis device 11 temporarily stores the analysis result of the structure analysis unit 112 in the analysis result buffer, performs an editing process, and creates an error message if there is an error. The analysis result editing unit 114 combines the contents of the resource use management table 118 with the analysis results stored in the analysis result buffer 113 and outputs the result to the analysis result output unit 115 (step S6).
[0025]
(7) Thereafter, the static analysis device 11 outputs the analysis result 12 of the source program 10. The output format and output example of the analysis result 12 will be described later with reference to FIG. 11 (step S7).
[0026]
FIG. 3 is a flowchart for explaining the control structure tree creation processing of the control structure tree creation unit 110 in the above-described step S2. Next, this will be described.
[0027]
(1) When the process of creating a control structure tree is started, first, it is set to repeat the process until the source program 10 ends, and one instruction is read from the source program 10 (steps S21 and S22).
[0028]
(2) It is determined whether or not the one instruction read in step S22 is a conditional branch instruction. If the instruction is not a conditional branch instruction, the row of the one instruction is written in the control structure tree (steps S23 and S25).
[0029]
(3) If it is determined in step S23 that the read one instruction is a conditional branch instruction, tree branch processing is performed (step S24).
[0030]
FIG. 4 is a flowchart for explaining the tree branching process in step S24 described above. Next, this will be described.
[0031]
(1) When the tree branching process is started, a new branch of the tree is created first, and the process is set to be repeated until the branch ends for that branch (steps S241 and S242).
[0032]
(2) One instruction is read from the file, and it is determined whether the one instruction is a conditional branch instruction. If the read one instruction is not a conditional branch instruction in this determination, the instruction is written in the control structure tree (steps S243, S244, S246). (3) If it is determined in step S244 that the read one instruction is a conditional branch instruction, tree branch processing is called again, and the processing from step S241 is continued for the instruction. When the tree branching process is completed, the process returns to step S21 in FIG. 3 to continue the process (step S245).
[0033]
FIG. 5 is a flowchart for explaining the structure analysis processing by the structure analysis unit 112 in step S5 in FIG. 2. Next, this will be described.
[0034]
(1) First, the number of function lines output to the resource use management table 118 is cleared, one control structure tree 111 is read, and analysis processing is repeated until the control structure tree ends (steps S51 and S52). .
[0035]
(2) Execute analysis processing of the read control structure tree. Details of this analysis processing will be described later with reference to FIG. 6 (step S53).
[0036]
(3) It is determined whether or not there is an unanalyzed control structure tree, and if so, the process returns to step S51 and repeats the process. If there is no unanalyzed control structure tree, the structure analysis is performed. The process ends (step S54).
[0037]
FIG. 6 is a flowchart for explaining the analysis process of the control structure tree in step S53 described above. Next, this will be described.
[0038]
(1) When a function is included in the read control structure tree 111, it is determined whether or not the function matches the resource reservation / occupation function described in the rule file storage unit 116. The number of lines of the detected resource reservation / occupation function is output to the resource use management table 118 (steps S531, S532).
[0039]
(2) Next, immediately after the resource securing / occupying function, it is determined whether or not the resource securing / occupying is confirmed as defined by the rule file storage unit 116. If the confirmation is made, step S531 is performed. The process is returned to and the process is repeated (step S533).
[0040]
(4) If it is determined in step S533 that the resource reservation / occupation has not been confirmed as defined by the rule file storage unit 116, an error indicating that the resource reservation / occupation has not been confirmed is output to the analysis result buffer 113. Then, the process returns to the process from step S531, and the process is repeated (step S534).
[0041]
(5) If it is determined in step S531 that the function included in the control structure tree 111 does not match the resource reservation / occupation function described in the rule file storage unit 116, the function is stored in the rule file storage unit 116. It is determined whether or not it matches the described resource release / occupancy release function. If not, the control structure tree analysis processing ends (step S535).
[0042]
(6) If the function matches the resource release / dedicated release function described in the rule file storage unit 116 in the determination in step S535, the number of lines of the detected resource released / dedicated release function is output to the resource use management table 118. Then, with reference to the resource use management table 118, it is determined whether or not the use of the resource reservation / release and occupation / occupancy release functions matches the definition of the rule file storage unit 116 (steps S536 and S537).
[0043]
(7) If it is determined in step S537 that the use of the resource reservation / release and occupancy / release of the occupancy matches the definition of the rule file storage unit 116, the control structure tree analysis processing ends. The error information is output to the analysis result buffer 113, and the control structure tree analysis processing ends. After the end of the process, the process returns to the process of FIG. 5 (step S538).
[0044]
The structure analysis processing described with reference to FIGS. 5 and 6 does not require the entity of the resource and uses information of resources such as a memory, a file, and a communication socket managed by the resource use management table 118. It can be carried out. Further, it is possible to perform a structural analysis on an arbitrary range of the source program.
[0045]
Next, the processing in the analyzer according to the embodiment of the present invention described above will be specifically described using an example of a source program.
[0046]
FIG. 7 is a diagram illustrating a part of a description example of the source program 10 in the C language and an example of a control structure tree generated thereby.
[0047]
The description example of the source program 10 in the C language shown in FIG. 7A includes the conditional branch instructions “if” and “else”. Here, "else" indicates a complement of "if", and is replaced by a conditional expression using "if" in the tree branching process in step S24 in FIG. 3, and expanded into a tree as shown in FIG. 7B. Is done. The control structure tree 111 is generated covering the entire route from the top to the bottom of the tree. The tree shown in FIG. 7B has two control structures shown in FIGS. 7C and 7D. Generated in the tree 111.
[0048]
FIG. 8 is a diagram illustrating a part of another description example of the source program 10 in the C language and an example of a control structure tree generated thereby.
[0049]
The third and fourth lines of the example of the source program in the C language shown in FIG. 8A correspond to “processing A” shown in FIG. 7A, and the seventh and eighth lines correspond to FIG. This corresponds to “process B” shown in a). In the control structure tree creation unit 110, the program shown in FIG. 8A is expanded into a tree shown in FIG. 8B, and from this tree, FIG. 8C, FIG. 8D, and FIG. A control structure tree 111 as shown in FIG.
[0050]
FIG. 9 is a diagram showing a description format of a rule file in the rule file storage unit 116. In the rule file, the symbol “|” is used as a delimiter when defining a plurality of values. If there is no return value for success / failure of the resource reservation / occupation function, the return value is "-". If both return values for success and failure are "-", the resource reservation / occupation function succeeds. / Do not judge failure. In addition, when there is no resource release / exclusive release function for the resource securing / exclusive function, the resource release / exclusive release function name is blank.
[0051]
As shown in FIG. 9A, the rule file includes a “return value when resource reservation succeeds” and a “return value when resource reservation fails” between the “resource reservation function” and the “resource release function”. And a row having a “return value when resource occupation succeeds” and a “return value when resource occupation fails” between the “resource occupancy function” and the “resource occupancy release function”.
[0052]
FIG. 9B shows a specific description example of the rule file corresponding to FIG. 9A. In FIG. 9B, it is defined that the resource securing function is “function A” and the resource releasing function is “function B”. Further, it is defined that the resource occupancy function is "function C" and the resource occupancy release function is "function D". When the resource A is successfully allocated by the function A, “1” is returned. When the resource A is unsuccessful, “0” or “NULL” is returned. Is returned.
[0053]
FIG. 10 is a diagram showing an example of the resource use management table 118 created from the rule file of the rule file storage unit 116 described with reference to FIG. 9. This will be described next.
[0054]
As shown in FIGS. 10A to 10C, “function A”, “function B”, “function C”, and “function D” are output to the resource use management table 118. When the structure analysis unit 112 detects these functions from the control structure tree 111, the number of lines indicating the number of the lines is output to the resource use management table 118.
[0055]
Next, the process of analyzing the control structure tree created from the source program illustrated in FIG. 8A will be specifically described. First, the procedure of the control structure tree analysis processing shown in FIG. 8C will be described.
[0056]
“Function A” is detected from the first line of the control structure tree shown in FIG. 8C, and “1” is output to the line of “Function A” in the resource use management table 118. Here, the return value of “function A” is “x”.
The conditional branch instruction “if” is detected from the second line, and a new tree branch is created. Here, “x == 0” indicates a determination at the time of failure in securing resources of the function A.
Since the output instruction “printf” from the third line is not defined in the rule file storage unit 116, the process proceeds to the next step.
The function is terminated from the fourth line by a function termination instruction “exit”. The fifth line is not executed.
[0057]
Next, the procedure of the control structure tree analysis processing shown in FIG. 8D will be described.
[0058]
"Function A" is detected from the first line, and "1" is output to the line of "function A" in the resource use management table 118.
The conditional branch instruction “else if” is detected from the sixth line, and a new tree branch is created. Here, “x == 1” indicates a determination at the time of successful resource securing of the function A.
[0059]
Since the output instruction “printf” from the seventh line is not defined in the rule file storage unit 116, the process proceeds to the next step.
"Function B" is detected from the eighth line, and "8" is output to the line of "function B" in the resource use management table 118. This “function B” corresponds to “function A” on the first line, and matches the definition of the rule file storage unit 116.
“Function B” is detected from the tenth line, and “10” is output to the “function B” line of the resource use management table 118. Since “function B” already exists in the eighth line, it does not match the definition in the rule file storage unit 116. The detected error information and the number of lines “10” of the function B are output to the analysis result buffer.
[0060]
The resource management tables shown in FIGS. 10B and 10C described above are obtained by analyzing the control structure tree 111 shown in FIGS. 8C and 8D by the structure analysis unit 112, respectively. The usage management table 118 is shown, and the number of lines that called “function A” and “function B” are output.
[0061]
FIG. 11 is a diagram showing an output format and an output example of the analysis result 12 of the source program shown in FIG.
[0062]
As shown in FIG. 11, as the analysis result 12, a program name and a function name to be analyzed, the number of error detection lines, and an analysis result (error) message are output. In the illustrated example, “source program A” is output as the program name, and “there is no resource securing function corresponding to the resource release function” is output as the analysis result (error) message.
[0063]
FIG. 12 is a diagram showing still another example of the source program 10 and an example of the created control structure tree. The program shown in this figure is an example of a case where a resource securing / releasing function is executed across functions. This program may be a source program that spans a plurality of files. That is, the static analysis device of the present invention is capable of analyzing between a plurality of functions. In this case, portions following each of the functions X, Y, and Z in FIG. 12A are described in different files. It is assumed that the rule file in the rule file storage unit 116 of the source program shown in FIG. 12 is the same as that shown in FIG. 9B.
[0064]
The program shown in FIG. 12A executes the resource securing function “function A” by the “function X” and then fails the “function Y” when the resource securing by the conditional branch instruction “if” succeeds. Sometimes, "function Z" is called.
[0065]
FIGS. 12B and 12C show a control structure tree 111 of the program shown in FIG. 12A. “Function Y” and “Function Z” are expanded to “Function X” when the control structure tree 111 is created. In FIG. 12B, it is determined whether “function B” has released the resources secured by “function A”, and if the same resources have been released, the analysis ends without error. However, when the resource released by “function B” is different from the resource reserved by “function A” and “function X” ends without releasing the resource, the resource reserved by “function A” is stored in the analysis result buffer 113. Is output and the error that the resource to be released by “function B” does not exist is output. In FIG. 12 (c), when securing of resources by “function A” fails, “function X” ends. At this time, “function X” does not detect an error.
[0066]
According to the source program static analysis device according to the embodiment of the present invention described above, it is possible to check the correspondence between securing and releasing resources among a plurality of functions and the correspondence between occupation and release of resources, Similarly, it is also possible to check the correspondence between the resource reservation / release and the resource occupation / release of the function between the plurality of files.
[0067]
Each processing according to the above-described embodiment of the present invention can be configured as a processing program, and the processing program is provided by being stored in a recording medium such as an HD, a DAT, an FD, an MO, a DVD-ROM, and a CD-ROM. can do.
[0068]
【The invention's effect】
As described above, according to the present invention, it is possible to analyze information and processes that change during operation without executing a source program. The time to build and the time can be eliminated.
[0069]
Further, since the present invention can be used in a static analysis device that uses a different pattern file for analyzing a source program, the analysis target can be easily determined, and the program can be freely responded to when the program is revised.
[0070]
Further, according to the present invention, a test can be performed at the time of coding a source program, so that the quality of the source program can be improved, a defect can be detected in an early stage of development, and a cost of a correction generated in a later process can be improved. And time can be kept to a minimum.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a source program static analysis device according to an embodiment of the present invention.
FIG. 2 is a flowchart illustrating an outline of a processing operation in the static analysis device according to the embodiment of the present invention.
FIG. 3 is a flowchart illustrating a control structure tree creation process in a control structure tree creation unit.
FIG. 4 is a flowchart illustrating a tree branching process in the flow of FIG. 3;
FIG. 5 is a flowchart illustrating a structure analysis process performed by a structure analysis unit 112;
FIG. 6 is a flowchart illustrating a control structure tree analysis process in the flow of FIG. 5;
FIG. 7 is a diagram illustrating a part of a description example of a source program in C language and an example of a control structure tree generated thereby.
FIG. 8 is a diagram illustrating a part of another description example of a source program in the C language and an example of a control structure tree generated thereby.
FIG. 9 is a diagram illustrating a description format of a rule file in a rule file storage unit.
FIG. 10 is a diagram illustrating an example of a resource use management table created from a rule file of a rule file storage unit described with reference to FIG. 9;
11 is a diagram showing an output format and an output example of an analysis result of the source program shown in FIG. 8;
FIG. 12 is a diagram showing an example of a source program in which a resource securing / release function is executed across functions and an example of a created control structure tree.
[Explanation of symbols]
Reference Signs List 10 Source program 11 Static analysis device 12 Analysis result 110 Control structure tree creation unit 111 Control structure tree 112 Structure analysis unit 113 Analysis result buffer 114 Analysis result editing unit 115 Analysis result output unit 116 Rule file storage unit 117 Rule file editing unit 118 Resource usage management table

Claims (14)

In a static analysis apparatus for a source program that statically analyzes a source program and outputs an analysis result, an input unit capable of inputting a plurality of the source programs, a correspondence between securing and releasing resources, and occupation of the resources. A structure analysis unit configured to analyze the source program input by the input unit based on a rule file that describes a rule for checking correspondence with the occupancy release; and an output unit configured to output an analysis result of the structure analysis unit. A static analysis device for a source program, characterized in that: 2. The static analysis of a source program according to claim 1, wherein the structure analysis unit includes a control structure tree creating unit that expands a processing flow of the source program input by the input unit into a control structure tree. apparatus. 2. The source program according to claim 1, wherein the rule file is described in accordance with a predetermined notation, and the function to be checked by a rule file editing unit can be changed or added. Analytical device. The structure analysis unit refers to the rule file, writes the processing procedure of securing and releasing the resource from the control structure tree into a resource use management table that manages the use of the resource, and secures and releases the resource. 2. The static analysis apparatus for a source program according to claim 1, wherein the processing order of the source program is checked. The structure analysis unit refers to the rule file, writes a processing procedure of occupation and release of the resource from the control structure tree to a resource use management table for managing use of the resource, and occupies and occupies the resource. 2. The static analysis apparatus for a source program according to claim 1, wherein a processing order of the cancellation is checked. 2. The apparatus according to claim 1, wherein the structural analysis unit refers to the rule file to check whether the resource has been successfully allocated. 2. The apparatus according to claim 1, wherein the structural analysis unit refers to the rule file to check whether the resource is successfully occupied. 2. The structure analysis unit according to claim 1, wherein the structure analysis unit checks the source program and verifies whether a method of securing and releasing the resource is appropriate without requiring the entity of the resource. Source program static analyzer. 2. The method according to claim 1, wherein the structure analysis unit checks the source program and verifies whether a method of occupation and release of the resource is appropriate without requiring the entity of the resource. Static analyzer for the described source program. The structure analyzing means is capable of analyzing an arbitrary range of the source program and verifying whether a method of using and securing the resource in an arbitrary range of the source program is appropriate. The static analysis device for a source program according to claim 1, wherein: The structure analysis unit can analyze an arbitrary range of the source program and verify whether a method of occupation and release of the resource in an arbitrary range of the source program is appropriate. The static analysis device for a source program according to claim 1, wherein: The structure analysis means reads one source program to the end, successively reads the next specified source program, holds information of a resource use management table for managing the use of the resources during this time, and stores resources over a plurality of files. 2. The static analysis device for a source program according to claim 1, wherein it is possible to check for securement and release, and occupancy and release of occupancy. The structure analysis means refers to the rule file and manages the resource securing and release processing procedures along the route of all the processings generated by the conditional branch from the control structure tree. 2. The static analysis apparatus for a source program according to claim 1, wherein the apparatus writes the information in a management table and checks a processing order of securing and releasing the resources. The structure analysis unit refers to the rule file, and executes a processing procedure for occupation and release of the resource along a route of all the processings generated by the conditional branch from the control structure tree. 2. The static analysis apparatus for a source program according to claim 1, further comprising writing in a use management table and checking a processing order of occupation and release of the resource.

Images