JP2011133966A - Device and method for analyzing program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technology for obtaining a detailed analysis result of a computer program. <P>SOLUTION: An analysis device for the program obtains codes of the computer program, sets a code of a part including a variable of the obtained codes as an analysis target, decides possibility of a bug by whether the code of the analysis target satisfies a prescribed static analysis condition, inserts an acquisition code for acquiring a value of the variable included in the code of the analysis target decided that it has the possibility of the bug into the program, executes the program, and decides the bug by whether the code of the analysis target satisfies a prescribed dynamic analysis condition when substituting the value obtained by the acquisition code for the variable. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  This case relates to a technique for analyzing a program.

  One of the tools for detecting program bugs is a static analysis tool. The static analysis method has an advantage that it is possible to analyze a large-scale and complicated code without having to execute a code to be analyzed and without creating a test case.

  Moreover, the following patent documents exist as prior art.

JP-A-9-26897

Static analysis tools point out the possibility of a bug if the source code contains a buggy format, but it may not be possible to determine whether or not an error actually occurs.
[Example 1]
char a [5];
char b [10]
strcpy (b, "123456789");
strcpy (a, b);

  In the program of [Example 1], the size of the variable a is defined as 5 in the first line, the size of the variable b is defined as 10 in the second line, and the value of the variable b is copied to the variable a in the fourth line. The static analysis tool outputs an indication message as follows.

[Indication message]
pgr0532 strcpy (a, b) may copy beyond area a. (Copy destination: a, Copy source: b)
The static analysis tool compares the size of the copy source area (variable b) with the size of the copy destination (variable a) area for a function that copies data from area to area, such as the strcpy function. The above [pointing message] is output when the size of the area is smaller.

In the program of [Example 1], "123456789" is copied to variable b in the 4th line, so 5
A bug occurs because the value copied by strcpy (a, b) on the line exceeds the size of variable A.

On the other hand, in the program of [Example 2], “123” is copied to the variable b in the fourth line.
Since the value copied by strcpy (a, b) on the line does not exceed the size of variable A, there is no bug.

[Example 2]
char a [5];
char b [10]
strcpy (b, "123");
strcpy (a, b);

  Since the program is not actually operated in the static analysis, the actual value cannot be obtained, and the static analysis tool cannot analyze whether or not a bug actually occurs in the case of Example 1 or Example 2.

  Therefore, one form of the disclosure provides a technique for obtaining a detailed analysis result of a computer program.

An analysis apparatus as an embodiment of the disclosure is:
An acquisition unit for acquiring a code of a computer program;
Of the acquired code, a static analysis unit that determines the possibility of a bug depending on whether or not a code including a variable includes a variable and the analysis target code satisfies a predetermined static analysis condition;
An insertion unit that inserts into the program an acquisition code for acquiring the value of the variable included in the code to be analyzed that is determined to have the possibility of the bug;
A dynamic analysis unit that executes the program and determines a bug based on whether or not the analysis target code satisfies a predetermined dynamic analysis condition when the value acquired by the acquisition code is substituted into the variable; Prepared.

  One embodiment of the disclosure provides a technique for obtaining a detailed analysis result of a computer program.

Configuration diagram of analyzer Diagram showing overall flow of analysis method Diagram showing sample program Illustration of static analysis processing Explanatory drawing of the acquisition code insertion process Illustration of dynamic analysis processing Illustration of test cases for dynamic analysis processing Illustration of output processing Figure showing analysis results Figure showing analysis results The figure which shows an example of insertion content DB The figure which shows an example of insertion content DB The figure which shows an example of insertion content DB The figure which shows an example of insertion content DB The figure which shows an example of insertion content DB

  Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings. The configuration of the following embodiment is an exemplification, and the present invention is not limited to the configuration of the embodiment.

<Description of device configuration>
The analysis apparatus according to the present embodiment statically analyzes a computer program and proves the possibility of a bug detected by the static analysis by performing a dynamic test. FIG. 1 is a system configuration diagram of the present invention.

As shown in FIG. 1, the analysis device 1 includes a data processing unit 11 that performs data arithmetic processing, a communication processing unit 12 that performs communication with other devices, and a storage unit that stores data and software for arithmetic processing. The computer includes a (hard disk) 13, an input unit 14, and an output unit 15.

  The communication processing unit 12 communicates with another computer via a network or a line such as a cable.

  The storage unit 13 stores an operating system (OS) and application programs (analysis programs). The storage unit 13 also stores a program to be analyzed and a database used for analysis processing.

  The input unit 14 is a means for inputting information to the data processing unit 11, and includes a user interface such as a keyboard and a pointing device, and a device that reads information from a storage medium such as a memory card or a CD-ROM.

  The output unit 15 is a unit that outputs the processing result of the data processing unit 11, and includes a display device that displays the processing result and a printer that prints data.

  The data processing unit 11 includes a CPU and a main memory, reads the OS and application programs from the storage unit 13 to the main memory, and the CPU performs arithmetic processing according to the read OS and application programs. With this calculation process, the CPU also functions as the acquisition unit 21, the static analysis unit 22, the insertion unit 23, the dynamic analysis unit 24, the output processing unit 25, and the build unit 26.

  The CPU of the data processing unit 11, that is, the acquisition unit 21 acquires the code of a computer program that is a target for bug analysis.

  The CPU of the data processing unit 11, that is, the static analysis unit 22 analyzes a predetermined unit code such as a part including a variable, for example, an instruction, a step, and a line, among the acquired codes, and the analysis target code is a predetermined code. The possibility of a bug is determined by whether or not the static analysis condition is satisfied. The static analysis condition is stored in a static condition database (DB) in the storage unit 13, and a condition corresponding to the analysis target code is appropriately called.

  The static analysis condition is, for example, whether or not the required parameter is described in the function included in the analysis target code, or whether the syntax of the instruction is correct, such as whether the variable type set in the parameter is correct. Also good.

In addition, the static analysis condition may be whether or not it conforms to the “Coding Practice Guide for Embedded Software Developers” formulated by the Information Technology Promotion Organization Software Engineering Center. Further, the static analysis condition may be whether or not it conforms to MISRA (Motor Industry Software Reliability Associationk) guidelines.

  In particular, in the present embodiment, when processing using a variable is performed, such as whether the size of the variable at the assignment destination is larger than the size of the variable at the assignment source or is divided by a variable that may be 0, the variable Whether or not an error or contradiction occurs depending on the value of is included as a static analysis condition. If this condition is not satisfied, an error or contradiction may occur depending on the value of the variable, and the analysis apparatus 1 can determine that dynamic analysis is necessary.

  The CPU of the data processing unit 11, that is, the insertion unit 23 inserts into the program an acquisition code that acquires the value of a variable included in the analysis target code that is determined to have a bug.

  The CPU of the data processing unit 11, that is, the dynamic analysis unit 24 executes the program, and if the value acquired by the acquired code is substituted for the variable of the code to be analyzed, does the code satisfy a predetermined dynamic analysis condition? Judge bugs based on whether or not.

  The CPU of the data processing unit 11, that is, the output processing unit 25 acquires the determination results of the static analysis unit 22 and the dynamic analysis unit 24, and outputs a message or certificate based on the determination results to a display unit, a printer, or the like. Output from the unit 15.

  The CPU of the data processing unit 11, that is, the build unit 26 performs a process such as compiling code of a computer program and linking a library, so-called build, and creates an executable file.

  Note that, among the components of the analysis apparatus 1 of this example, the elements that process information realize the functions described above when a general-purpose processor executes an analysis program as software. Some or all of the elements that process these pieces of information may be hardware that realizes each function by combining basic circuits.

  In the analysis apparatus 1 of this example, the acquisition unit 21, the static analysis unit 22, the insertion unit 23, the dynamic analysis unit 24, the output processing unit 25, and the build unit 26 are elements that process the information.

The hardware that is an element for processing these pieces of information may include basic circuits such as an FPGA (Field Programmable Gate Array), an ASIC (Application Specific Integrated Circuit), and an LSI (Large Scale Integration). The hardware may include basic circuits such as an IC [Integrated Circuit], a gate array, a logic circuit, a signal processing circuit, and an analog circuit.

  Examples of the logic circuit include AND, OR, NOT, NAND, NOR, flip-flop, and counter circuit. The signal processing circuit may include a circuit that performs, for example, addition, multiplication, division, inversion, product-sum operation, differentiation, and integration on the signal value. The analog circuit may include, for example, a circuit that performs amplification, addition, multiplication, differentiation, and integration on the signal value.

<Description of analysis method>
FIG. 2 is an explanatory diagram of an analysis method executed by the analysis apparatus 1 according to the present embodiment according to the analysis program.

  When the operator designates the analysis target program and instructs the execution of the analysis program, the acquisition unit 21 of the analysis apparatus 1 acquires the source code of the analysis target program (S1). For example, when a program to be analyzed is stored in the storage unit 13, the acquisition unit 21 sequentially reads out the code of the program from the storage unit 13 and develops it in the main memory. When the analysis target program is stored in a storage medium such as a CD or DVD, the acquisition unit 21 may read the code of the program from the storage medium inserted in the input unit 14. Further, the acquisition unit 21 may acquire (receive) the code of the program to be analyzed from another computer via the communication processing unit 12.

  The static analysis unit 22 sets an instruction including a variable in the acquired code as an analysis target, and determines whether or not there is a possibility of a bug depending on whether or not the analysis target instruction satisfies a predetermined static analysis condition. Determine (S2).

  When it is determined that there is a possibility of a bug (S2, Yes), the insertion unit 23 obtains an acquisition code for acquiring a value of a variable included in the analysis target code from an insertion content database (DB) in the storage unit 13. Read and insert into the source code of the program (S3).

  The build unit 26 builds the source code into which the acquired code is inserted in S3, and creates an executable file (execution module) (S4).

  Then, the dynamic analysis unit 25 executes the execution module created in S4, and determines a bug depending on whether or not the value acquired by the acquisition code satisfies a predetermined dynamic analysis condition (S5).

  After the dynamic analysis, the output processing unit 25 causes the output unit 15 to output the static analysis result in S2 and the dynamic analysis result in S5 (S6).

  The static analysis step S2, the acquisition code insertion step S3, the dynamic analysis step S5, and the analysis result output step S6 will be described in detail below.

  FIG. 3 is a diagram illustrating an example of a program to be analyzed, and FIG. 4 is an explanatory diagram of a static analysis step.

  For each instruction of the source code acquired in S1, the static analysis unit 22 reads a static analysis condition corresponding to the instruction from the storage unit 13 or the memory (S11), and whether or not the instruction satisfies the static analysis condition. Is determined (S12).

For example, in the program of FIG. 3, the 7th line is strcpy (a, b), and the static analysis conditions such as whether the necessary arguments are described and whether the copy source size exceeds the copy destination size It is determined whether or not The static analysis conditions are set in accordance with the format and processing contents for each instruction, and stored in the storage unit 13 or the memory.

Since strcpy (a, b) is an instruction for copying the value of the copy source variable b to the copy destination variable a, the static analysis unit 22 determines whether the size of the variable b exceeds the size of the variable a. Determine. In FIG. 3, the value of the variable a is set to 5 in the first line, and the value of the variable b is set to 10 in the second line. Therefore, the static analysis unit 22 performs the strcpy (a, b) on the seventh line. Determine that there is a possible bug.

If it is determined that there is a possibility of a bug (S12, No), the static analysis unit 22 extracts an indication message corresponding to the bug from the storage unit 13 and registers it in the memory as an analysis result of the static analysis ( S13). FIG. 5 shows an example of an indication message extracted according to strcpy (a, b) on the seventh line. In FIG. 5, the message is the content of a bug that may occur, and the indication ID is information for identifying the message.

  The static analysis unit 22 stores the indication ID and the static analysis condition in association with each other, and identifies the indication message with the indication ID corresponding to the static analysis condition determined not to be satisfied in S12. Extracted from the storage unit 13. Here, since the static analysis condition also corresponds to a bug that may occur, there is a possibility that it will occur by extracting an indication message corresponding to the static analysis condition determined not to be satisfied in S12. Static analysis conditions according to a certain bug can be extracted.

FIG. 5 is an explanatory diagram of the acquisition code insertion step S3 in FIG.
If it is determined in S2 in FIG. 2 that there is a possibility of a bug, the insertion unit 23 searches the insertion content DB of the storage unit 13 for the result of static analysis, that is, the acquired code corresponding to the indication message extracted in S2. (S21). Specifically, the indication ID of the corresponding indication message is added to each acquisition code of the insertion content DB, and the insertion unit 23 is added with the indication ID that matches the indication ID of the indication message extracted in S2. Search the acquisition code.

If there is a hit acquisition code as a result of the search (S22, Yes), the acquisition code is acquired from the insertion content DB and inserted into the source code. FIG. 15 is a diagram illustrating an example of information including an acquisition code extracted from the insertion content DB. As shown in FIG. 15, information 50 extracted from the insertion content DB includes an indication ID 51, an acquisition code (trace) insertion position 52, and an insertion content 53.
, A bug condition (dynamic analysis condition) 54 is included. Based on the insertion position 52 and the insertion content 53 of the extracted information 50, the insertion unit 23 inserts the acquired code immediately before the line (code to be analyzed) where the possibility of a bug is pointed out. Further, the acquisition code insertion position is not limited to immediately before the code to be analyzed, but may be immediately after. The insertion position of the acquisition code may be a position where an instruction for setting a value of a variable included in the analysis target code is not inserted between the acquisition code and the analysis target code.

  FIG. 5 is a diagram showing a state where an acquisition code is inserted into the program of FIG.

  As shown in FIG. 5, the insertion unit 23 inserts a trace () statement as an acquisition code in the line immediately before strcpy (a, b), and logs the size of the variable a and the length of the value of the variable b. To output.

  Thus, in this embodiment, since the acquisition code used for the dynamic analysis is automatically inserted based on the result of the static analysis, the dynamic analysis can be easily performed.

  FIG. 6 is an explanatory diagram of step S5 of the dynamic analysis in FIG.

  The dynamic analysis unit 25 executes the execution module built by the build unit 26 (S31), and generates an execution log that outputs the value of the variable using the acquisition code inserted in S3 (S32).

When the effective module is executed, the data processing unit 11 sets the sizes of the variables a and b (corresponding to the first and second lines of the source code), and opens input.txt read-only (3 of the source code).
The character of input.txt is stored in the variable b. Further, the data processing unit 11 outputs the size of the variable a and the length of the value of the variable b to the execution log (corresponding to the seventh line of the source code), and copies the value of the variable b to the variable a (source code) Equivalent to line 8). Then, the data processing unit 11 repeats the processing corresponding to the 5th to 10th lines of the source code until the end of input.txt is reached.

  FIG. 7 is a diagram showing an example of an execution log created by executing the execution module. Example 1 in FIG. 7 is a case where the characters of input.txt are 1, 3 and 2, and Example 2 is a case where the characters of input.txt are 1, 3 and 10.

  Then, the dynamic analysis unit 25 determines whether or not there is a bug depending on whether or not the value of the variable acquired by the acquisition code satisfies the dynamic analysis condition (S33). And when the value of the acquired variable does not satisfy the dynamic analysis condition (S33, No), for example, if the length of the value of the variable b exceeds the size of the variable a, the analysis result indicating that it is a bug is displayed. Register in the memory (S34). On the other hand, if the acquired variable value satisfies the dynamic analysis condition (S33, Yes), for example, if the length of the variable b does not exceed the size of the variable a, the analysis result indicating that there is no bug is stored in the memory. (S35).

  FIG. 8 is an explanatory diagram of the analysis result output step S6 of FIG.

After the dynamic analysis S5, the output processing unit 25 acquires the analysis result of the static analysis S2 and the analysis result of the dynamic analysis S5 from the memory (S41), and determines whether there is a bug based on the analysis result of S5. Determine (S42). If there is a bug (S42, Yes), a result certificate indicating that there is a bug is generated and displayed on the display device of the output unit 15 (S43).

  FIG. 9 is a diagram illustrating an example of a result certificate indicating that there is a bug.

  In FIG. 9, the result certificate display field 30 displays a line number 31, an indication ID 32, and a message 33 as a result of the static analysis, and a bug presence / absence (bug determination) 34 as a result of the dynamic analysis. Yes.

FIG. 9 shows that there is a possibility of a bug with the indication ID “pgr0532” on the seventh line of the source code, and that there was a bug in the dynamic analysis of the test case. In FIG. 9, the display column 30 shows the seventh line of the source code, but a result of a plurality of lines may be displayed as a list.

  When the operator clicks Bug of the bug determination 34, the output processing unit 25 displays the linked display column 40.

  In the result certificate display field 40, in addition to the indication ID 42, a test case number 41 of dynamic analysis, a trace result content 43, and an individual determination 44 of bugs are displayed for each test case.

  In FIG. 9, the length of the copy source value is 1 in test case 1, the length of the copy source value is 3 in test case 2, and the length of the copy source value is 10 in test case 3. In test cases 1 and 2, the length of the copy source value does not exceed the copy destination and the individual determination 44 is OK. However, in test case 3, the length of the copy source value exceeds the copy destination and is individually It can be seen that the decision 44 is NG.

  On the other hand, if it is determined in S42 that there is no bug (S42, No), the output processing unit 25 generates a result certificate indicating that there is no bug and displays it on the display device of the output unit 15 (S44).

  FIG. 10 is a diagram illustrating an example of a result certificate indicating that there is no bug.

FIG. 10 shows that there is a possibility of a bug with the indication ID “pgr0532” on the seventh line of the source code, and there was no bug in the dynamic analysis of the test case. In FIG. 10, when the operator clicks Not Bug of the bug determination 34, the output processing unit 25 displays the linked display column 40.

  In the result certificate display field 40, in addition to the indication ID 42, a test case number 41 of dynamic analysis, a trace result content 43, and an individual determination 44 of bugs are displayed for each test case.

  In FIG. 10, the length of the copy source value is 1 in test case 1, the length of the copy source value is 3 in test case 2, and the length of the copy source value is 2 in test case 3. In test cases 1-3, it can be seen that the length of the copy source value does not exceed the copy destination, and the individual determination 44 is OK.

As described above, the analysis device 1 according to the present embodiment identifies a code (instruction) of a portion that may have a bug by static analysis, and acquires a value of a variable included in the code (acquisition code). ) Is automatically inserted and the program is executed. Then, the analysis apparatus 1 determines whether or not there is a bug depending on whether or not the acquired value satisfies the dynamic analysis condition. Thereby, the analysis apparatus 1 of this embodiment can perform a dynamic analysis even if an operator does not set a trace code beforehand.
In addition, the analysis apparatus 1 of the present embodiment performs static analysis, identifies a code that may be a bug and determines the value of the variable depending on whether or not an error occurs depending on the value of the variable included in the code to be analyzed. get. For this reason, the analysis apparatus 1 according to the present embodiment can shorten the dynamic analysis time as compared with acquiring all the values of variables, and does not include values that are not likely to be bugs (less noise), and appropriate analysis. The result can be obtained.

1.long data = 65535;
2.data = ????;
3. short x = data;
In the program of the first embodiment, when the static analysis unit 22 performs the static analysis, the short int type variable “x” on the left side in the short x = data on the third line has the long int type on the right side. Since the initial value "data" is large, it is determined that there is a possibility of a bug.

In the case of an instruction for assigning a value to a variable, such as short x = data on the third line, and the size of the right side is larger than the size of the left side, the static analysis unit 22 responds from the message DB of the storage unit 13. Extract the form of the indication message pgr0383. The static analysis unit 22 then replaces the initial character @ 1 of the form "pgr0383 @ 1 type initial value @ 2 may not be the correct initial value because it is larger than @ 3 type @ 4." Replace ~ 4 with the value of the acquired code. That is, the static analysis unit 22 indicates that the initial value “data” of the long int type is not larger than the “x” of the short int type, and may not be a correct initial value. Is generated.

In the case of the first embodiment, there is no problem if the actual value of data substituted in the second line is in the short range, but a bug occurs if the actual value of data exceeds the short range.

  For this reason, when the possibility of a bug is detected by the static analysis unit 22, the insertion unit 23 retrieves the acquired code corresponding to the extracted indication message from the insertion content DB of the storage unit 13.

FIG. 11 is a diagram showing an acquisition code and dynamic analysis conditions corresponding to the indication ID (pgr0383).

  Then, the insertion unit 23 inserts the retrieved acquisition code into the source code as follows.

[Example of source code after insertion]
1.long data = 65535;
2.data = ????;
3. trace ("pgr0383, data =% d \ n"data);
4. short x = data;
The dynamic analysis unit 24 executes the program in which the acquisition code is inserted to acquire the value of data. Based on the dynamic analysis condition, the dynamic analysis unit 24 determines that there is a bug if the data value exceeds the short x size. If the value of does not exceed the size of short x, it is determined not to be a bug.

20. fp = fopen (filename, "r");
21. size = fread (buf, sizeof (buf), 1, fp); // points out pgr0520 For the program of the second embodiment, the static analysis unit 22 determines whether or not the static analysis condition is satisfied. When size = fread (buf, sizeof (buf), 1, fp) on the 21st line,
Since the variable fp may refer to address 0, it is determined that there is a possibility of a bug.

If there is a possibility of referring to address 0, as in size = fread (buf, sizeof (buf), 1, fp) on the 21st line, the static analysis unit 22 responds from the message DB of the storage unit 13. Extract the form of the indication message pgr0520. And the static analysis part 22 forms "pgr0520 @ 1
The variable @ 2 that may be assigned address 0 on the line may refer to address 0. The replacement characters @ 1 to @ 2 are replaced with the acquired code value. That is, the static analysis unit 22 generates an indication message such as “There is a possibility that the variable“ fp ”that may be assigned 0 address in the 20th line may refer to 0 address”.

In the case of the second embodiment, there is no problem if fopen is normally executed in the 20th line, but if it fails, the 21st line is executed with fp being NULL, resulting in a bug.

  For this reason, when the possibility of a bug is detected by the static analysis unit 22, the insertion unit 23 retrieves the acquired code corresponding to the extracted indication message from the insertion content DB of the storage unit 13.

FIG. 12 is a diagram showing an acquisition code and dynamic analysis conditions corresponding to the indication ID (pgr0520).

  Then, the insertion unit 23 inserts the retrieved acquisition code into the source code as follows.

[Example of source code after insertion]
20. fp = fopen (filename, "r");
21. trace ("pgr0520, fp =% d \ n"fp);
22. size = fread (buf, sizeof (buf), 1, fp); // Indicates pgr0520 The dynamic analysis unit 24 executes the program with the acquired code inserted to acquire the value of fp and performs dynamic analysis Based on the conditions, if the value of fp is Null, it is determined as a bug, and if the value of fp is not Null, it is determined that there is no bug.

1.int x = 0;
2. if (data! = 1)
3. [
4. x = 2;
Five. ]
6. return data / x; // pgr0074
When the analysis of the program of the third embodiment is started and the static analysis unit 22 determines whether or not the static analysis condition is satisfied, there is a possibility of 0 in the return data / x on the sixth line. Since it is divided by the variable x, it is determined that there is a possibility of a bug.

When dividing by a variable x that may be 0, such as return data / x on the sixth line, the static analysis unit 22 extracts the form of the corresponding indication message pgr0074 from the message DB of the storage unit 13 To do. Then, the static analysis unit 22 uses the variable “pgr0074 zero-possible variable”.
Dividing by @ 1. The replacement character @ 1 is replaced with the acquired code value. That is, the static analysis unit 22 generates an indication message such as “dividing by a variable“ x ”having a possibility of zero”.

In the case of the third embodiment, if the if statement in the second line is true, there is no problem because the value is assigned to x in the fourth line, but if the if statement is false, x remains 0 and 6 lines Divide by eye and bug.

  For this reason, when the possibility of a bug is detected by the static analysis unit 22, the insertion unit 23 retrieves the acquired code corresponding to the extracted indication message from the insertion content DB of the storage unit 13.

FIG. 12 is a diagram illustrating an acquisition code and dynamic analysis conditions corresponding to the indication ID (pgr0074).

Then, the insertion unit 23 inserts the retrieved acquisition code into the source code as follows.
1.int x = 0;
2. if (data! = 1)
3. [
4. x = 2;
Five. ]
6. trace ("pgr0074, x =% d \ n"x);
7.return data / x; // pgr0074
The dynamic analysis unit 24 executes the program in which the acquisition code is inserted to acquire the value of x. Based on the dynamic analysis conditions, the dynamic analysis unit 24 determines that the bug is if the value of x is 0, and the value of x is 0. If it is not, it is determined that it is not a bug.

1. int data [10];
2.
3. for (int i = 0; i <= 10; i ++)
Four. [
5. Code where i changes dynamically
6.
7. data [i] = 0; // point out pgr0013
8.]
When the analysis of the program of the fourth embodiment is started and the static analysis unit 22 determines whether or not the static analysis condition is satisfied, 10 is set to i in data [i] = 0 on the seventh line. Enter 1
Since it may exceed the range declared in the line, it is determined that there is a possibility of a bug.

When there is a possibility of exceeding the declared range as in data [i] on the seventh line, the static analysis unit 22
Extracts the form of the corresponding indication message pgr0013 from the message DB of the storage unit 13. And the static analysis part 22 will exceed the range of the array with @ 4 because @ 3 is in @ 2 in the for statement on the form "pgr0013 @ 1 line. (The @ 6 line of the array declaration: @ 5 Replace the replacement character @ 1 ") with the value of the acquired code. That is, the static analysis unit 22 reads “For statement on the third line.
"i" has "10", so "data [i]" will exceed the range. (Array declaration: "file.c"
1st line) ”and generate an indication message.

  In the case of the fourth embodiment, there is no problem if i changes to less than 10 in the fifth line, but if i is 10 in the fifth line, data [10] = 0 and exceeds the declared range. It becomes a bug.

  For this reason, when the possibility of a bug is detected by the static analysis unit 22, the insertion unit 23 retrieves the acquired code corresponding to the extracted indication message from the insertion content DB of the storage unit 13.

FIG. 13 is a diagram illustrating an acquisition code and dynamic analysis conditions corresponding to the indication ID (pgr0013).

Then, the insertion unit 23 inserts the retrieved acquisition code into the source code as follows.
1. int data [10];
2.
3. for (int i = 0; i <= 10; i ++)
Four. [
5. Code where i changes dynamically
6.
7. trace ("pgr0013, value =% d \ n"i);
8. data [i] = 0; // point out pgr0013
9.]

  The dynamic analysis unit 24 executes the program in which the acquisition code is inserted to acquire the value of i. Based on the dynamic analysis conditions, the dynamic analysis unit 24 determines that the bug is when the value of i is 10, and the value of i is less than 10. If so, it is determined that it is not a bug.

In the fourth embodiment, the static analysis unit 22 sets data [i] = based on the code for setting the variable data [10] on the first line and the code for setting the variable i on the third line. It is determined that 0 may exceed the range of variable data [i]. That is, the static analysis unit 22 points out that the value of the variable i dynamically changes in the fifth line, so that there is a possibility instead of determining whether or not it is actually a bug. However, if there is a code that statically determines the value of the variable i between the code in which the variable i dynamically changes and data [i] = 0, the static analysis unit 22 may consider this code. good. For example, if the variable i is 10 on the 6th line, if there is a code that includes an instruction that jumps to another process, it is determined that there is no possibility of a bug because the range of data [i] = 0 is not exceeded. May be.

<Others>
The present invention is not limited to the illustrated examples described above, and various modifications can be made without departing from the scope of the present invention.

  The above-described program may be recorded on a computer-readable recording medium.

  Here, the computer-readable recording medium refers to a recording medium that accumulates information such as data and programs by electrical, magnetic, optical, mechanical, or chemical action and can be read from the computer. . Examples of such a recording medium that can be removed from the computer include a flexible disk, a magneto-optical disk, a CD-ROM, a CD-R / W, a DVD, a DAT, an 8 mm tape, and a memory card.

  Further, there are a hard disk, a ROM (read only memory) and the like as a recording medium fixed to the computer.

DESCRIPTION OF SYMBOLS 1 Analysis apparatus 14 Input part 15 Output part 21 Acquisition part 22 Static analysis part 23 Insertion part 24 Dynamic analysis part 25 Output control part 26 Build part

Claims (6)

An acquisition unit for acquiring a code of a computer program;
Of the acquired code, a static analysis unit that determines the possibility of a bug depending on whether or not a code including a variable includes a variable and the analysis target code satisfies a predetermined static analysis condition;
An insertion unit that inserts into the program an acquisition code for acquiring the value of the variable included in the code to be analyzed that is determined to have the possibility of the bug;
A dynamic analysis unit that executes the program and determines a bug depending on whether or not the analysis target code satisfies a predetermined dynamic analysis condition when the value acquired by the acquisition code is substituted into the variable;
Analysis device with   The analysis apparatus according to claim 1, wherein the static analysis condition is whether or not an error occurs depending on a value of a variable included in a code to be analyzed. Obtaining the code of the computer program;
Of the obtained code, a code including a part including a variable is set as an analysis target, and a step of determining a possibility of a bug depending on whether the analysis target code satisfies a predetermined static analysis condition;
Inserting an acquisition code for acquiring a value of the variable included in the analysis target code determined to be a bug, into the program;
Executing the program and determining a bug depending on whether or not the analysis target code satisfies a predetermined dynamic analysis condition when the value acquired by the acquisition code is substituted into the variable;
Analysis method that the computer executes.   The analysis method according to claim 3, wherein the static analysis condition is whether or not an error occurs depending on a value of a variable included in a code to be analyzed. Obtaining the code of the computer program;
Of the obtained code, a code including a part including a variable is set as an analysis target, and a step of determining a possibility of a bug depending on whether the analysis target code satisfies a predetermined static analysis condition;
Inserting an acquisition code for acquiring a value of the variable included in the analysis target code determined to be a bug, into the program;
Executing the program and determining a bug depending on whether or not the analysis target code satisfies a predetermined dynamic analysis condition when the value acquired by the acquisition code is substituted into the variable;
An analysis program that causes a computer to execute.   The analysis program according to claim 5, wherein the static analysis condition is whether or not an error occurs depending on a value of a variable included in a code to be analyzed.

Images