JP2017204164A - Program analysis method, program analysis device and analysis program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To efficiently analyze an execution path of a program.SOLUTION: A symbol c1 is allocated to input of a module 21 to generate first information 24 which represents a previous processing result of a call instruction 22 using the symbol c1, and a symbol c2 is allocated to a call result to generate second information 25 which represents a processing result of first execution paths 23a, 23b using the symbol c2. Further, a symbol c3 is allocated to input of a module 26 to generate third information 28 which represents a processing result of second execution paths 27a, 27b using the symbol c3. A processing result of the first information 24 and the symbol c3 are made to correspond to each other, and a processing result of the third information 28 and the symbol c2 are made to correspond to each other to generate path information 32 which represents a processing result of composite execution paths 31a, 31b, 31c, and 31d using the symbol c1.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a program analysis method, a program analysis apparatus, and an analysis program.

  When a conditional branch statement is included in the program, the sequence of instructions to be executed (execution path) changes according to the input to the program. Therefore, the created program may be analyzed to extract an execution path from the program. For example, when modifying or exchanging an existing information processing system, there may be a case where sufficient design data created at the beginning of the development of the information processing system does not remain. In that case, the execution path is extracted from the program as the implementation, and the relationship between the input and output for each execution path is determined to understand the specifications of the information processing system. Further, for example, when testing a created program, an execution path may be extracted from the program, and a test plan may be created for the extracted execution path.

  One of the program analysis methods is symbolic execution (symbol execution). In symbolic execution, a symbol (symbol value) indicating a constant is assigned instead of a specific numerical value or a specific character to a variable for storing an input value to the program. The value of a variable that is updated in a program may be expressed as an expression that includes a symbol. By executing the program instructions in a pseudo manner using symbols, the execution path of the program can be extracted more efficiently than when the program is repeatedly executed by inputting specific values one after another.

  If a conditional branch statement is included in the program, the symbol represents an arbitrary constant, so the branch direction may not be narrowed down to one. When the branch condition is determined to be YES or NO depending on a specific value, the execution path is divided using the conditional branch statement as a division point. That is, it is treated that both an execution path when the determination of the branch condition is YES and an execution path when the determination of the branch condition is NO exist. When the number of conditional branch statements increases, the execution paths extracted from the program often increase exponentially.

  In addition, a test data generation device that extracts an execution path from a program using symbolic execution and generates test data that covers the extracted execution path has been proposed. The proposed test data generation apparatus assigns symbols only to some of a plurality of variables and assigns specific values that are not symbols to other variables in order to reduce the amount of calculation for symbolic execution. When symbolic execution is performed using a combination of symbols and specific values, some execution paths are extracted from among a plurality of execution paths included in the program. The test data generation apparatus extracts all execution paths to be tested from the program by repeating symbolic execution while switching variables to which symbols are assigned.

  In addition, a software test method for searching for an execution path inside a function using symbolic execution has been proposed. In the proposed software test method, a symbol is assigned to the return value of the function, a constraint indicating the range of values that the symbol can take is derived, and the execution path to be searched is limited by performing symbol execution on the function so as to satisfy the constraint. .

JP 2014-153908 A JP 2006-12343 A

  In a program, one module may call another module. The module may be a partial program included in the program, such as a function, procedure, method, or section, and may be called from another module. In this case, the question is how to analyze the program and extract the execution path.

If an attempt is made to directly extract an execution path that extends over both the caller module and the callee module, a problem of path explosion occurs in which an execution path to be searched becomes enormous. For example, if the caller module includes N serial conditional branch statements that are executed once, and the callee module includes M serial conditional branch statements that are executed once. (N and M are integers of 2 or more). In that case, a maximum of 2 ^{M + N} execution paths are extracted from the two modules. If an attempt is made to directly search for 2 ^{M + N} execution paths, the amount of calculation greatly increases as the number of conditional branch statements (N and M) in each module increases.

  On the other hand, simply extracting the execution path independently for each module does not correctly analyze the calling module. This is because an instruction executed in the caller module after calling another module depends on the execution result of the callee module.

  In one aspect, an object of the present invention is to provide a program analysis method, a program analysis apparatus, and an analysis program that can efficiently analyze an execution path of a program.

  In one aspect, a program analysis method executed by a computer is provided. The first module includes a first module and a second module, and the first module obtains a program including a call instruction for calling the second module. The first symbol is assigned to the input of the first module, the first information representing the first processing result before the call instruction using the first symbol is generated, and the call result of the call instruction is the second Are generated, and second information in which the second processing result after the call instruction of each of the plurality of first execution paths included in the first module is expressed using the second symbol is generated. The third symbol is assigned to the input of the second module, and the third information representing the third processing result of each of the plurality of second execution paths included in the second module using the third symbol is provided. Generate. The first processing result indicated by the first information is associated with the third symbol used for the third information, and the third processing result indicated by the third information is used for the second information. Paths in which processing results of a plurality of combined execution paths obtained by combining a plurality of first execution paths and a plurality of second execution paths are represented using the first symbols by associating with the second symbols. Generate information.

  In one aspect, a program analysis device having a storage unit and a calculation unit is provided. In one aspect, an analysis program to be executed by a computer is provided.

  In one aspect, the execution path of the program can be analyzed efficiently.

It is a figure which shows the example of the program analysis apparatus of 1st Embodiment. It is a block diagram which shows the hardware example of a program analyzer. It is a figure which shows the 1st example of a program. It is a figure which shows the 1st example of a logic table. It is a figure which shows the 2nd example of a program. It is a figure which shows the 2nd example of a logic table. It is a figure which shows the example of the division | segmentation of symbolic execution, and the coupling | bonding of a partial logic. It is a figure which shows the example of an update variable table and a symbol allocation table. It is a figure which shows the example of extraction of a hierarchical update variable. It is a figure which shows the example of the logic table of a halfway point, a call destination, and an end point. It is a figure which shows the simplification example of a partial logic. It is a figure which shows the example of a coupling | bonding of a partial logic. It is a figure (example) which shows the example of a combination of a partial logic. It is a figure which shows the 3rd example of a program. It is a block diagram which shows the function example of a program analyzer. It is a flowchart which shows the example of a procedure of a program analysis. It is a flowchart which shows the example of a procedure of update variable extraction. It is a flowchart which shows the example of a procedure of symbolic execution. It is a flowchart (continuation) which shows the example of a procedure of symbolic execution. It is a flowchart which shows the example of a procedure of logic simplification. It is a flowchart which shows the example of a procedure of logic coupling | bonding.

Hereinafter, the present embodiment will be described with reference to the drawings.
[First Embodiment]
A first embodiment will be described.

FIG. 1 is a diagram illustrating an example of a program analysis apparatus according to the first embodiment.
The program analysis apparatus 10 according to the first embodiment analyzes a program by symbolic execution and extracts an execution path from the program. The analysis target program may be a source code described in a programming language, or may be a non-source code such as an executable object code. For example, the program analysis apparatus 10 can be used when extracting an execution path from a program created in the past for the purpose of understanding the specifications of an existing information processing system. Further, for example, the program analysis apparatus 10 can be used when extracting an execution path to be tested from a newly created program for the purpose of testing a newly constructed information processing system.

The program analysis apparatus 10 may be a client computer or a server computer. The program analysis device 10 includes a storage unit 11 and a calculation unit 12.
The storage unit 11 stores the analysis target program 20. The storage unit 11 may be a volatile semiconductor memory such as a RAM (Random Access Memory) or a non-volatile storage device such as an HDD (Hard Disk Drive) or a flash memory.

  The calculation unit 12 analyzes the execution path included in the program 20 stored in the storage unit 11. The arithmetic unit 12 may be a processor such as a CPU (Central Processing Unit) or a DSP (Digital Signal Processor). The arithmetic unit 12 may include an electronic circuit for a specific purpose such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA). The processor executes a program stored in a memory such as a RAM (or the storage unit 11). The program executed by the processor includes an analysis program describing the processing described below. A set of processors may be referred to as “multiprocessor” or simply “processor”.

  The program 20 includes a module 21 (first module) and a module 26 (second module). Each of the modules 21 and 26 may be a partial program included in the program 20 and may be called from another module. For example, the modules 21, 26 include functions, procedures, methods, sections, and the like. The name of the module unit depends on the programming language.

  Module 21 includes a call instruction 22 that calls module 26. Module 21 is a caller module, and module 26 is a callee module. An example of the call instruction 22 is a PERFORM statement that calls another section.

  The calculation unit 12 performs symbolic execution on the module 21. At this time, the arithmetic unit 12 assigns the symbol c1 (first symbol) to the input of the module 21. For example, the arithmetic unit 12 assigns the symbol c <b> 1 to a variable that stores a value provided from outside the module 21 among variables used in the module 21.

  The computing unit 12 generates first information 24 that represents the processing result (first processing result) before the call instruction 22 by using the symbol c1. The first information 24 is, for example, a value of a variable updated before the call instruction 22 among variables used in the module 21 is expressed by an expression including the symbol c1. The first information 24 can be generated, for example, by executing the instructions up to the calling instruction 22 in a pseudo manner using the symbol c1 by symbolic execution. As an example, the first information 24 indicates a processing result that the value of the variable x immediately before the call instruction 22 is c1 + 1.

  The arithmetic unit 12 assigns a symbol c2 (second symbol) independent of the symbol c1 to the call result of the call instruction 22. Thereby, the module 26 is stubbed, and the module 21 can be symbolically executed independently of the module 26. For example, the arithmetic unit 12 assigns the symbol c <b> 2 to a variable that may be updated by the module 26 among the variables used in the module 21. As an example, the arithmetic unit 12 assigns the symbol c2 to the variable y updated by the module 21.

  The call instruction 22 may be described in a format that does not clearly indicate the operation of the module 26. For example, when the module 26 updates a global variable, the variable for storing the value updated by the module 26 may not be specified in the module 21. In this case, for example, the arithmetic unit 12 searches the module 26 for an update variable that may be updated by the module 26 among the variables used in the module 21.

  The computing unit 12 detects a plurality of first execution paths including the first execution paths 23 a and 23 b from the module 21. The plurality of first execution paths are branched by one or more conditional branch instructions included in the module 21. The conditional branch instruction may exist before the call instruction 22 or may exist after the call instruction 22.

  The computing unit 12 generates second information 25 that represents the processing result (second processing result) after the call instruction 22 of each of the plurality of first execution paths using the symbol c2. The second information 25 represents, for example, a value of a variable updated after the call instruction 22 among variables used in the module 21 by an expression including the symbol c2. The expression may further include a symbol c1. The second information 25 can be generated by, for example, executing the instruction after the call instruction 22 in a pseudo manner using the symbol c2 by symbolic execution.

  The processing result indicated by the second information 25 may vary depending on the first execution path. As an example, the second information 25 indicates a processing result that the value of the variable z at the end point of the first execution path 23a is c2 + 3. The second information 25 indicates a processing result that the value of the variable z at the end point of the first execution path 23b is c2-3. When a conditional branch instruction is present before the call instruction 22, the processing result indicated by the first information 24 may be different depending on the first execution path, similarly to the second information 25.

  In addition, the arithmetic unit 12 performs symbolic execution on the module 26 independently of the module 21. The symbolic execution of the module 26 may be performed before the symbolic execution of the module 21, or may be performed after the symbolic execution of the module 21. The symbolic execution of the module 26 may be performed between the symbolic execution before the call instruction 22 and the symbolic execution after the call instruction 22.

  At this time, the arithmetic unit 12 assigns a symbol c3 (third symbol) independent of the symbols c1 and c2 to the input of the module 26. For example, the computing unit 12 assigns the symbol c3 to a variable that stores a value provided from outside the module 26 among variables used in the module 26. The computing unit 12 detects a plurality of second execution paths including the second execution paths 27 a and 27 b from the module 26. The plurality of second execution paths are branched by one or more conditional branch instructions included in the module 26.

  The computing unit 12 generates third information 28 that represents the processing results (third processing results) of the plurality of second execution paths using the symbol c3. The third information 28 is, for example, a value of a variable updated in the module 26 among variables used in the module 26 expressed by an expression including the symbol c3. The third information 28 can be generated, for example, by executing the instruction of the module 26 in a pseudo manner using the symbol c3 by symbolic execution.

  The processing result indicated by the third information 28 may vary depending on the second execution path. As an example, the third information 28 indicates a processing result that the value of the variable y at the end point of the second execution path 27a is c3 + 2. The third information 28 indicates the processing result that the value of the variable y at the end point of the second execution path 27b is c3-2. In FIG. 1, variables x, y, and z are used, but some or all of these variables may be the same.

  Then, the arithmetic unit 12 combines the plurality of first execution paths and the plurality of second execution paths to generate a plurality of combined execution paths including the combined execution paths 31a, 31b, 31c, and 31d. The synthesis execution path is an execution path that extends over the modules 21 and 26, and is equivalent to an execution path that is obtained when an instruction in the module 26 is executed following the instruction preceding the call instruction 22.

  At this time, the calculation unit 12 acquires the first information 24, the second information 25, and the third information 28. The computing unit 12 associates the processing result indicated by the first information 24 with the symbol c3 used for the third information 28. This is because the processing result before the call instruction 22 is used as an input to the module 26. For example, an expression indicating the value of the variable x is associated with the symbol c3. In addition, the arithmetic unit 12 associates the processing result indicated by the third information 28 with the symbol c <b> 2 used for the second information 25. This is because the processing result of the module 26 is used as an input of an instruction after the call instruction 22. For example, an expression indicating the value of the variable y is associated with the symbol c2.

  The calculation unit 12 uses the first information 24, the second information 25, the third information 28, and the association described above to express the processing results of each of the plurality of synthesis execution paths using the symbol c1. 32 is generated. The path information 32 represents the relationship between the input and output of the module 21 for each synthesis execution path in consideration of the call instruction 22.

  As an example, the arithmetic unit 12 substitutes x = c1 + 1 indicated by the first information 24 for the symbol c3 of the third information 28. As a result, the processing result of the second execution path 27a is expressed as y = c1 + 3, and the processing result of the second execution path 27b is expressed as y = c1-1.

  Further, the arithmetic unit 12 substitutes the processing results of the second execution paths 27a and 27b into the symbol c2 of the second information 25. At this time, the arithmetic unit 12 considers a combination of an arbitrary first execution path and an arbitrary second execution path. Here, the first execution path 23a and the second execution path 27a are combined to generate a combined execution path 31a. The synthesis execution path 31b is generated by synthesizing the first execution path 23a and the second execution path 27b. The synthesis execution path 31c is generated by synthesizing the first execution path 23b and the second execution path 27a. The first execution path 23b and the second execution path 27b are combined to generate a combined execution path 31d.

  The arithmetic unit 12 substitutes y = c1 + 3 of the second execution path 27a into the symbol c2 of z = c2 + 3 of the first execution path 23a. As a result, the processing result of the synthesis execution path 31a is expressed as z = c1 + 6. In addition, the calculation unit 12 substitutes y = c1-1 of the second execution path 27b into the symbol c2 of z = c2 + 3 of the first execution path 23a. As a result, the processing result of the synthesis execution path 31b is expressed as z = c1 + 2. The computing unit 12 substitutes y = c1 + 3 of the second execution path 27a into the symbol c2 of z = c2-3 of the first execution path 23b. As a result, the processing result of the synthesis execution path 31c is expressed as z = c1. The arithmetic unit 12 substitutes y = c1-1 of the second execution path 27b into the symbol c2 of z = c2-3 of the first execution path 23b. As a result, the processing result of the synthesis execution path 31d is expressed as z = c1-4.

  However, all of the combined execution paths obtained by combining the arbitrary first execution path and the arbitrary second execution path may not be effective execution paths that are actually executed in the program 20. In that case, the calculation unit 12 may select only effective combinations from all combinations between the plurality of first execution paths and the plurality of second execution paths.

  For example, the second information 25 may represent the execution condition (first execution condition) of each first execution path using at least one of the symbols c1 and c2. The execution condition of the first execution path can be determined from the branch condition of the conditional branch instruction included in the module 21. Further, the third information 28 may represent the execution condition (second execution condition) of each second execution path using the symbol c3. The execution condition of the second execution path can be determined from the branch condition of the conditional branch instruction included in the module 26.

  In this case, for example, when the execution condition of a certain first execution path and the execution condition of a certain second execution path do not contradict each other, the arithmetic unit 12 determines the first execution path and the second execution path. It is possible to determine that the combined execution path is valid. On the other hand, when the execution condition of a certain first execution path and the execution condition of a certain second execution path contradict each other, the arithmetic unit 12 combines the first execution path and the second execution path. It is possible to determine that the execution path is invalid.

  According to the program analysis apparatus 10 of the first embodiment, the symbolic execution of the module 21 and the symbolic execution of the module 26 are executed independently. By the symbolic execution of the module 21, first information 24 before the call instruction 22 and second information 25 after the call instruction 22 are collected. Further, the third information 28 is collected by the symbolic execution of the module 26. Then, based on the first information 24, the second information 25, and the third information 28, a plurality of first execution paths detected from the module 21 and a plurality of second execution paths detected from the module 26. And are synthesized.

Thereby, the path explosion at the time of analyzing the execution path over the modules 21 and 26 can be suppressed, and the execution path of the program 20 can be analyzed efficiently. For example, it is assumed that the module 21 includes N serial conditional branch instructions, and the module 26 includes M serial conditional branch instructions. When an execution path straddling the modules 21 and 26 is directly detected by symbolic execution, a maximum of 2 ^{M + N} execution paths are detected. On the other hand, according to the first embodiment, the maximum number of execution paths to be detected by symbolic execution is 2 ^M +2 ^N. For this reason, the calculation amount of symbolic execution can be reduced.

  Further, in the first embodiment, the process of the module 26 called from the module 21 is not ignored, and the second execution path detected from the module 26 is detected from the module 21. Synthesized with path. Therefore, the generated path information 32 can correctly represent the relationship between the input and output of the module 21.

[Second Embodiment]
Next, a second embodiment will be described.
The program analysis apparatus according to the second embodiment extracts an execution path from a program by symbolic execution, and generates logic information indicating a relationship between input and output.

FIG. 2 is a block diagram illustrating a hardware example of the program analysis apparatus.
The program analysis apparatus 100 includes a processor 101, a RAM 102, an HDD 103, an image signal processing unit 104, an input signal processing unit 105, a medium reader 106, and a communication interface 107. The unit of the program analysis apparatus 100 is connected to the bus 108. The program analysis device 100 corresponds to the program analysis device 10 of the first embodiment. The processor 101 corresponds to the calculation unit 12 of the first embodiment. The RAM 102 or the HDD 103 corresponds to the storage unit 11 of the first embodiment.

  The processor 101 is a processor including an arithmetic circuit that executes program instructions. The processor 101 is a CPU, for example. The processor 101 loads at least a part of the program and data stored in the HDD 103 into the RAM 102 and executes the loaded program. The processor 101 may include a plurality of processor cores, and the program analysis apparatus 100 may include a plurality of processors. The processes described below may be executed in parallel using a plurality of processors or processor cores.

  The RAM 102 is a volatile semiconductor memory that temporarily stores programs executed by the processor 101 and data used for calculations. Note that the program analysis apparatus 100 may include a type of memory other than the RAM, or may include a plurality of memories.

  The HDD 103 is a non-volatile storage device that stores an OS (Operating System), software programs such as middleware and application software, and data. The program includes an analysis program. Note that the program analysis device 100 may include other types of storage devices such as a flash memory and an SSD (Solid State Drive), or may include a plurality of nonvolatile storage devices.

  The image signal processing unit 104 outputs an image to the display 111 connected to the program analysis apparatus 100 in accordance with an instruction from the processor 101. As the display 111, any type of display such as a CRT (Cathode Ray Tube) display, a liquid crystal display (LCD), a plasma display, an organic EL (OEL: Organic Electro-Luminescence) display, or the like can be used.

  The input signal processing unit 105 acquires an input signal from the input device 112 connected to the program analysis apparatus 100 and outputs it to the processor 101. As the input device 112, a mouse, a touch panel, a touch pad, a pointing device such as a trackball, a keyboard, a remote controller, a button switch, or the like can be used. A plurality of types of input devices may be connected to the program analysis apparatus 100.

  The medium reader 106 is a reading device that reads programs and data recorded on the recording medium 113. As the recording medium 113, for example, a magnetic disk, an optical disk, a magneto-optical disk (MO), a semiconductor memory, or the like can be used. Magnetic disks include flexible disks (FD: Flexible Disk) and HDDs. The optical disc includes a CD (Compact Disc) and a DVD (Digital Versatile Disc).

  For example, the medium reader 106 copies a program or data read from the recording medium 113 to another recording medium such as the RAM 102 or the HDD 103. The read program is executed by the processor 101, for example. The recording medium 113 may be a portable recording medium and may be used for distributing programs and data. In addition, the recording medium 113 and the HDD 103 may be referred to as computer-readable recording media.

  The communication interface 107 is an interface that is connected to the network 114 and communicates with other devices via the network 114. The communication interface 107 may be a wired communication interface connected to a communication device such as a switch via a cable, or may be a wireless communication interface connected to a base station via a wireless link.

Next, analysis of a program by symbolic execution will be described.
FIG. 3 is a diagram illustrating a first example of a program.
The program 141 is an example of a program to be analyzed. The program 141 receives a two-character string as the value of the variable “gender” and outputs one character as the value of the variable “output”. The program 141 includes the first conditional branch sentence on the 14th line and the second conditional branch sentence on the 19th line. In the conditional branch sentence on the 14th line, it is determined whether or not the value of the variable “sex” is “male”. If the value of the variable “gender” is “male”, the value of the variable “output” is updated to “M”; otherwise, the value of the variable “output” is updated to “” (blank). . In the conditional branch sentence on the 19th line, it is determined whether the value of the variable “gender” is “female”. If the value of the variable “gender” is “female”, the value of the variable “output” is updated to “F”; otherwise, the value of the variable “output” does not change. Then, the program 141 ends.

  The program 141 has three execution paths. Any one of these three execution paths is executed according to the value of the variable “sex”. When the value of the variable “gender” is “male”, the branch condition on the 14th line is determined as YES, and the branch condition on the 19th line is determined as NO. In this execution path, the value of the variable “output” is “M”. When the value of the variable “gender” is “female”, the branch condition on the 14th line is determined as NO, and the branch condition on the 19th line is determined as YES. In this execution path, the value of the variable “output” is “F”. When the value of the variable “gender” is neither “male” nor “female”, it is determined that both the branch condition on the 14th line and the branch condition on the 19th line are NO. In this execution path, the value of the variable “output” is “” (blank).

  Since the program 141 includes two serial conditional branch statements, there are four execution path candidates if the contents of the branch condition are ignored. However, since the value of the variable “gender” is “male” and the value of the variable “gender” is “female”, both the branch condition on the 14th line and the branch condition on the 19th line are It is not determined as YES. Therefore, of the four execution path candidates, there are three effective execution paths that may be executed.

  In a conditional branch sentence, when there is at least one variable value that satisfies a condition for proceeding in a certain branch direction (YES direction or NO direction), the branch direction may be said to be “satisfiable”. On the other hand, when there is no value of a variable that satisfies the condition for proceeding in a certain branch direction, the branch direction may be said to be “not satisfiable”.

  In the program 141, the value of the variable “gender” is not constrained in the conditional branch statement on the 14th line, so that both of the two branch directions can be satisfied. On the other hand, the satisfiability in the conditional branch sentence on the 19th line depends on the branch direction selected in the conditional branch sentence on the 14th line. When the 14th line YES direction is selected, the 19th line YES direction is no longer satisfiable and only the NO direction can be satisfied. When the NO direction on the 14th row is selected, both of the two branch directions on the 19th row can be satisfied. Therefore, it can be determined that there are three effective execution paths.

  Here, an example in which the program 141 is symbolically executed will be described. The program analysis apparatus 100 assigns an abstract symbol (symbol value) indicating an arbitrary constant instead of a specific character to the variable “gender” indicating the input to the program 141. Here, the same “sex” as the variable name is used as a symbol. The program analysis apparatus 100 executes instructions of the program 141 in a pseudo manner using symbols.

  There is no execution path branch from the start point of the program 141 to the conditional branch statement on the 14th line. For the conditional branch statement on the 14th line, there is no condition (path condition) for selecting the execution path at this point, and both of the two branch directions can be satisfied. Therefore, the program analysis apparatus 100 divides the execution path in the conditional branch statement on the 14th line and selects one execution path. Here, it is assumed that the program analysis apparatus 100 has selected an execution path in the YES direction.

  Next, for the conditional branch sentence on the 19th line, the path condition at this point is that the symbol “sex” is “male”, so the YES direction cannot be satisfied and the NO direction can be satisfied. Therefore, the program analysis apparatus 100 selects the NO direction. Thereafter, the first execution path is terminated. The program analysis apparatus 100 determines that the path condition of the first execution path is that the symbol “sex” is “male” and the symbol “sex” is not “female”. Further, the program analysis apparatus 100 determines that the value of the variable “output” is “M” for the processing result (path output) of the first execution path.

  When the first execution path ends, the program analysis apparatus 100 returns to the nearest division point of the execution path and selects an unselected execution path. Here, the program analysis apparatus 100 returns to the conditional branch statement on the 14th line and selects an execution path in the NO direction.

  Regarding the conditional branch sentence on the 19th line, since the path condition at this point is that the symbol “sex” is not “male”, both the YES direction and the NO direction can be satisfied. Therefore, the program analysis apparatus 100 further divides the execution path in the conditional branch statement on the 19th line and selects one execution path. Here, it is assumed that the program analysis apparatus 100 has selected an execution path in the YES direction. Thereafter, this second execution path ends. The program analysis device 100 determines that the path condition of the second execution path is that the symbol “sex” is not “male” and the symbol “sex” is “female”. Further, the program analysis apparatus 100 determines that the value of the variable “output” is “F” for the path output of the second execution path.

  When the second execution path ends, the program analysis apparatus 100 returns to the conditional branch statement on the 19th line and selects an execution path in the NO direction. Thereafter, the third execution path ends. The program analysis apparatus 100 determines that the path condition of the third execution path is that the symbol “sex” is not “male” and the symbol “sex” is not “female”. Further, the program analysis apparatus 100 determines that the output of the third execution path is “” (blank) as the value of the variable “output”. Then, since there is no unselected execution path, the symbolic execution ends.

  Note that the program analysis apparatus 100 stores the current path condition and the value of each variable at the division point of the execution path. When one execution path is finished and backtracking to the division point, the program analysis apparatus 100 takes over the saved path condition and the value of each variable, and performs another execution corresponding to the unselected branch direction. Continue searching for paths.

FIG. 4 is a diagram illustrating a first example of a logic table.
The program analysis apparatus 100 generates the logic table 142 as a result of the symbolic execution of the program 141. The program analysis apparatus 100 displays the generated logic table 142 on a display included in the program analysis apparatus 100.

  The logic table 142 shows the relationship (logic) between the input to the program 141 and the output from the program 141. The logic table 142 includes items of a pass number, a pass condition, and a pass output. In the path number item, an identification number of an execution path detected by symbolic execution is described. In the path condition item, an input condition for selecting an execution path is described. In the path output item, the value of the output variable at the end point of the execution path is described. The path condition and path output may be expressed using symbols.

  As described above, the pass condition of the first execution pass is “gender is male” and “gender is not female”. This can be simplified as “gender is male”. The path output of the first execution path is “output is M”. The pass condition of the second execution pass is “gender is not male” and “gender is female”. This can be simplified as “gender is female”. The path output of the second execution path is “output is F”. The pass condition of the third execution pass is “gender is not male” and “gender is not female”. The path output of the third execution path is “output is blank”.

  It should be noted that mathematical expression processing techniques can be used to determine the satisfiability of conditional branch sentences and to simplify path conditions. The program analysis apparatus 100 may use an SMT (Satisfiability Modulo Theories) solver or an SAT (Satisfiability) solver. The path condition can be simplified, for example, by solving an expression including the symbol for the symbol.

Next, path explosion in symbolic execution will be described.
FIG. 5 is a diagram illustrating a second example of the program.
The program 121 is an example of an analysis target program different from the program 141. The program 121 receives a numerical value of 3 decimal digits or less as the value of “input 1”, and outputs a numerical value of 3 decimal digits or less as the value of “output 1”. The program 121 includes two modules, section A and section B. The program 121 includes a variable “variable 1”. “Variable 1” is a global variable that can be referenced and updated from both section A and section B.

  The program 121 assigns the received value of “input 1” to “variable 1” and calls section A. When section A ends, program 121 assigns the value of “variable 1” to “output 1”. Then, the process of the program 121 ends.

  Section A includes conditional branch statements on the 17th and 25th lines, and a call statement that calls section B on the 23rd line. Section A uses the value of “variable 1” given from the outside of section A. Section A increments the value of “variable 1” by 1 when the value of “variable 1” is greater than 10, and increments the value of “variable 1” by 1 when the value of “variable 1” is 10 or less. Decrease. Next, section A calls section B. The PERFORM statement that calls section B does not specify a variable for storing the return value. For this reason, whether or not the value of “variable 1” is updated by section B is unknown only from the statement of section A. That is, in the PERFORM statement, the action of the called section is unknown. After that, section A increases the value of “variable 1” by 3 when the value of “variable 1” is smaller than 30, and the value of “variable 1” when the value of “variable 1” is 30 or more. Is reduced by 3. Then, the processing of section A ends.

  Section B includes a conditional branch statement on the 34th line. Section B uses the value of “variable 1” given from the outside of section B. Section B increases the value of “Variable 1” by 2 when the value of “Variable 1” is greater than 20, and increases the value of “Variable 1” by 2 when the value of “Variable 1” is 20 or less. Decrease. Then, the processing of section B ends.

  The program analysis apparatus 100 can also limit the analysis range to be analyzed by symbolic execution to some modules in the program, such as some sections, instead of the entire one program. Thereby, the calculation amount of symbolic execution can be reduced. The analysis range can be specified by the user of the program analysis apparatus 100. Regarding the program 121, it is considered that section A is designated as the analysis range. However, here, it is assumed that the call destination of section A also continuously follows the execution path.

  Section A includes two conditional branch statements, and section B includes one conditional branch statement. Therefore, there are eight execution path candidates that span section A and section B. However, as will be described below, there are four effective execution paths.

  The program analysis apparatus 100 assigns the symbol “variable 1_A” to “variable 1” in which the input of section A is stored. Since the variable 1_A is not restricted in the 17th line, both of the two branch directions can be satisfied. The program analysis apparatus 100 selects the YES direction and updates the value of “variable 1” to the variable 1_A + 1. Next, in the 34th line, since the path condition is that the variable 1_A is larger than 10, both of the two branch directions can be satisfied. The program analysis apparatus 100 selects the YES direction, and updates the value of “variable 1” to variable 1_A + 1 + 2 = variable 1_A + 3. Next, in the 25th line, since the path condition is that the variable 1_A is larger than 10 and the variable 1_A + 1 is larger than 20, both of the two branch directions can be satisfied. The program analysis apparatus 100 selects the YES direction and updates the value of “variable 1” to variable 1_A + 1 + 2 + 3 = variable 1_A + 6.

  As a result, the first execution path ends. The path condition of the first execution path is that the variable 1_A is larger than 10, the variable 1_A + 1 is larger than 20, and the variable 1_A + 1 + 2 is smaller than 30. That is, the path condition of the first execution path is that the variable 1_A is greater than 19 and less than 27. The path output of the first execution path is that the value of “variable 1” is variable 1_A + 6.

  Similarly, the program analysis apparatus 100 detects the remaining three execution paths from the program 121. The second execution path is obtained by selecting the YES direction on the 17th line, the YES direction on the 34th line, and the NO direction on the 25th line. Therefore, the path condition of the second execution path is that the variable 1_A is larger than 10, the variable 1_A + 1 is larger than 20, and the variable 1_A + 1 + 2 is 30 or more. That is, the path condition of the second execution path is that the variable 1_A is 27 or more. The path output of the second execution path is that the value of “variable 1” is variable 1_A + 1 + 2−3 = variable 1_A.

  The third execution path is obtained by selecting the 17th line YES direction, the 34th line NO direction, and the 25th line YES direction. Therefore, the path condition of the third execution path is that the variable 1_A is larger than 10, the variable 1_A + 1 is 20 or less, and the variable 1_A + 1−2 is smaller than 30. That is, the path condition of the third execution path is that the variable 1_A is greater than 10 and 19 or less. The path output of the third execution path is that the value of “variable 1” is variable 1_A + 1−2 + 3 = variable 1_A + 2.

  The fourth execution path is obtained by selecting the NO direction on the 17th line, the NO direction on the 34th line, and the YES direction on the 25th line. Therefore, the path condition of the fourth execution path is that the variable 1_A is 10 or less, the variable 1_A-1 is 20 or less, and the variable 1_A-1-2 is smaller than 30. That is, the path condition of the fourth execution path is that the variable 1_A is 10 or less. The path output of the fourth execution path is that the value of “variable 1” is variable 1_A-1-2 + 3 = variable 1_A. Other combinations of branch directions are not satisfiable.

FIG. 6 is a diagram illustrating a second example of the logic table.
The program analysis apparatus 100 generates the logic table 129 as a result of the above symbolic execution. The program analysis apparatus 100 displays the generated logic table 129 on a display included in the program analysis apparatus 100.

  The logic table 129 shows the relationship between the input to the section A that is the analysis range and the output from the section A. Similar to the logic table 142, the logic table 129 includes items of a pass number, a pass condition, and a pass output. The logic table 129 describes the logic of the four detected execution paths. The pass condition and the pass output may be displayed with simplification or may be displayed without simplification. In FIG. 6, both the path condition and path output before simplification and the path condition and path output after simplification are displayed.

  By the way, in the example of the symbolic execution described above, an execution path straddling the section A as the analysis range and the section B as the call destination is directly detected. However, this symbolic execution method causes a path explosion problem that the number of execution paths detected increases exponentially with the increase in conditional branch statements. On the other hand, ignoring the call statement and analyzing only section A does not correctly analyze the logic of section A. This is because section B updates the value of “variable 1” used by section A. Therefore, the program analysis apparatus 100 performs symbolic execution by the following method.

FIG. 7 is a diagram illustrating an example of symbolic execution division and partial logic combination.
The program analysis apparatus 100 divides the symbolic execution of section A, which is the analysis range, and the symbolic execution of section B, which is the call destination, independently. If section A contains N conditional branch statements and section B contains M conditional branch statements, the amount of calculation for symbolic execution without division is 2 ^{N + M.} On the other hand, the calculation amount of the divided symbolic execution is 2 ^N +2 ^M , and the calculation amount is smaller than the case of not dividing. The program analysis apparatus 100 subsequently combines the partial logic acquired by the symbolic execution of section A and the partial logic acquired by the symbolic execution of section B.

  Specifically, the program analysis apparatus 100 assigns the symbol “X” to “variable 1” that stores the input of section A, and starts symbolic execution of section A. The program analysis apparatus 100 stores the midpoint logic immediately before the call statement that calls the section B. Immediately before the call statement, a logic whose path output is variable 1 = X + 1 and a logic whose path output is variable 1 = X−1 are detected.

  Next, in the symbolic execution of section A, program analysis apparatus 100 stubs section B without executing the call statement. In stubbing, the program analysis apparatus 100 assigns a symbol independent of the symbol “X” to an update variable that may be updated by the section B. The update variable can be retrieved by scanning the command statement in section B in advance. Here, the program analysis apparatus 100 assigns the symbol “Z” to “variable 1”. The program analysis apparatus 100 continues symbolic execution of section A using the symbol “Z” and stores the end point logic at the end point of section A. At the end point of section A, a logic whose path output is variable 1 = Z + 3 and a logic whose path output is variable 1 = Z-3 are detected.

  Further, the program analysis apparatus 100 assigns the symbol “Y” to “variable 1” that stores the input of section B, and starts symbolic execution of section B. The program analysis apparatus 100 stores the callee logic at the end of section B. At the end point of section B, the logic whose path output is variable 1 = Y + 2 and the logic whose path output is variable 1 = Y−2 are detected.

  Then, the program analysis apparatus 100 combines the midpoint logic, the end point logic, and the call destination logic, and reproduces the logic straddling the section A and the section B. The program analysis apparatus 100 associates the path output indicated by the midpoint logic with the symbol “Y” indicating the input of section B. Further, the program analysis apparatus 100 associates the path output indicated by the callee logic with the symbol “Z” used for the section B stubbing. As shown in the path candidate table 143 in FIG. 7, there are eight combinations of combinations of midpoint logic, end point logic, and call destination logic.

  That is, a path output of variable 1 = X + 1 + 2 + 3 can be considered from a combination of variable 1 = X + 1, variable 1 = Y + 2, and variable 1 = Z + 3. From the combination of variable 1 = X + 1, variable 1 = Y + 2, and variable 1 = Z−3, a path output of variable 1 = X + 1 + 2−3 can be considered. From the combination of variable 1 = X + 1, variable 1 = Y−2, and variable 1 = Z + 3, a path output of variable 1 = X + 1−2 + 3 can be considered. From the combination of variable 1 = X + 1, variable 1 = Y-2, and variable 1 = Z-3, a path output of variable 1 = X + 1-2-3 can be considered.

  From the combination of variable 1 = X−1, variable 1 = Y + 2, and variable 1 = Z + 3, a path output of variable 1 = X−1 + 2 + 3 can be considered. From the combination of variable 1 = X−1, variable 1 = Y + 2 and variable 1 = Z−3, a path output of variable 1 = X−1 + 2−3 can be considered. From the combination of variable 1 = X-1, variable 1 = Y-2, and variable 1 = Z + 3, a path output of variable 1 = X-1-2 + 3 can be considered. From the combination of variable 1 = X-1, variable 1 = Y-2, and variable 1 = Z-3, a path output of variable 1 = X-1-2-3 can be considered.

  However, as described above, not all of the above eight logics are valid. The program analysis apparatus 100 selects only combinations in which path conditions do not contradict each other from combinations of midpoint logic, end point logic, and call destination logic. That is, the program analysis apparatus 100 combines the path condition of the midpoint logic, the path condition of the end point logic, and the path condition of the callee logic, and determines whether the combined path condition can be satisfied.

Next, the procedure for dividing symbolic execution and combining partial logic will be described.
FIG. 8 is a diagram illustrating an example of an update variable table and a symbol allocation table.
The program analysis apparatus 100 detects a call sentence (a call sentence with an unknown action) that does not have an action description, such as a PERFORM statement, from the analysis range. The program analysis apparatus 100 searches for an update variable from the module called by the detected call statement, and generates an update variable table 122. The update variable table 122 has items of module name and update variable. Module identification information such as a section name is described in the module name item. In the update variable item, the variable name of the variable whose value is updated in the called module is described. There may be two or more update variables per module. The update variable is, for example, a variable described in the left side of the assignment expression or the second argument of the MOVE statement.

  When the program analysis apparatus 100 detects a call statement with no description of an action in the middle of symbolic execution, the program analysis apparatus 100 assigns a symbol to the update variable described in the update variable table 122. The program analysis apparatus 100 generates a symbol allocation table 123. The symbol assignment table 123 has items of variable names and symbols. The variable name item describes the variable name of the update variable. In the symbol item, a symbol assigned to the update variable is described immediately after the call statement. As an example, a symbol assigned to an update variable is a concatenation of a variable name, a character string indicating that the calling statement is a PERFORM statement, the line number of the calling statement, the name of the called module, and the number of executions of the calling statement. is there. Thus, for example, immediately after passing through the 23rd line of the program 121, the symbol “variable 1_Perform — 23_section B_1” is assigned to “variable 1”.

FIG. 9 is a diagram illustrating an example of extracting hierarchical update variables.
When a module called from the analysis range calls another module, the update variable is searched hierarchically. Here, it is assumed that the analysis range is the section 144, the section 144a (section A1) and the section 144b (section B1) are called from the section 144, and the section 144c (section B2) is called from the section 144b. The section 144a updates the variables “a11” and “a12”. The section 144b updates the variables “b11” and “b12”. Section 144c updates the variable “b21”. In this case, the program analysis apparatus 100 generates an update variable table 145 corresponding to the update variable table 122.

  The program analysis apparatus 100 traces the section 144a from the section 144, and detects the variables “a11” and “a12” as update variables for the first call statement of the section 144. The program analysis apparatus 100 registers the section 144a and the variables “a11” and “a12” in the update variable table 145 in association with each other. The program analysis apparatus 100 traces the sections 144b and 144c from the section 144, and detects the variables “b11”, “b12”, and “b21” as update variables for the second call statement of the section 144. The program analysis apparatus 100 associates the section 144b with the variables “b11”, “b12”, and “b21” and registers them in the update variable table 145.

FIG. 10 is a diagram illustrating an example of a logic table of intermediate points, call destinations, and end points.
The program analysis apparatus 100 generates the midpoint logic table 124, the callee logic table 125, and the end point logic table 126 by symbolic execution.

  The midpoint logic table 124 includes items of a pass number, a pass condition, and a pass output. In the item of the pass number, the identification number of the logic detected before the call statement of the caller module is described. In the path condition item, the path condition immediately before the call statement is described. In the path output item, the value of the variable immediately before the call statement is described. For the path condition and path output of the midpoint logic table 124, a symbol assigned to the input of the calling module can be used.

  For the program 121, the logic that the path condition is “variable 1_A is greater than 10” and the path output is “variable 1 = variable 1_A + 1” is registered in the midpoint logic table 124. Further, in the midpoint logic table 124, the logic that the path condition is “variable 1_A is 10 or less” and the path output is “variable 1 = variable 1_A-1” is registered.

  The callee logic table 125 includes items of a pass number, a pass condition, and a pass output. In the path number item, an identification number of the logic detected between the start point and the end point of the called module is described. In the path condition item, the path condition at the end point of the called module is described. In the path output item, the value of the variable at the end point of the called module is described. For the path condition and path output of the callee logic table 125, a symbol assigned to the input of the callee module can be used.

  For the program 121, the logic that the path condition is “variable 1_B is greater than 20” and the path output is “variable 1 = variable 1_B + 2” is registered in the callee logic table 125. Also, in the callee logic table 125, the logic that the path condition is “variable 1_B is 20 or less” and the path output is “variable 1 = variable 1_B-2” is registered. The symbol “variable 1_B” indicates the input of section B.

  The end point logic table 126 includes items of a pass number, a pass condition, and a pass output. In the item of the pass number, an identification number of the logic detected between the start point and the end point of the calling module is described. The path condition item describes the path condition at the end point of the calling module. In the path output item, the value of the variable at the end point of the calling module is described. For the path condition and path output of the end point logic table 126, a symbol assigned to the input of the caller module or a symbol assigned to the update variable immediately after the call statement can be used.

  Regarding the program 121, the end point logic table 126 registers logic that the path condition is “variable 1_A is greater than 10” and “variable 1_Perform_23_section B_1 is smaller than 30”, and the path output is “variable 1 = variable 1_Perform_23_section B_1 + 3”. Is done. Further, in the end point logic table 126, the logic that the path condition is “variable 1_A is greater than 10” and “variable 1_Perform_23_section B_1 is 30 or more” and the path output is “variable 1 = variable 1_Perform_23_section B_1-3” is registered. The

  In the end point logic table 126, the logic that the path condition is “variable 1_A is 10 or less” and “variable 1_Perform_23_section B_1 is smaller than 30” and the path output is “variable 1 = variable 1_Perform_23_section B_1 + 3” is registered. Further, in the end point logic table 126, the logic that the path condition is "variable 1_A is 10 or less" and "variable 1_Perform_23_section B_1 is 30 or more" and the path output is "variable 1 = variable 1_Perform_23_section B_1-3" is registered. . The symbol “variable 1_Perform — 23_section B” is a symbol assigned to “variable 1” immediately after the call statement.

FIG. 11 is a diagram illustrating a simplified example of partial logic.
When the symbolic execution ends, the program analysis apparatus 100 acquires the midpoint logic table 124, the callee logic table 125, and the end point logic table 126. The program analysis apparatus 100 simplifies the halfway point logic table 124, the callee logic table 125, and the end point logic table 126, respectively. Since there is no room for simplification of the midpoint logic table 124 and the callee logic table 125 shown in FIG. 10, an example of simplification of the end point logic table 126 will be described here.

  The program analysis apparatus 100 searches the end point logic table 126 for logic having the same path output but different path conditions. The program analysis apparatus 100 integrates a plurality of corresponding logics into one by connecting the path conditions of the corresponding logics with disjunction (OR). In the example of FIG. 11, logic # 1 and logic # 3 in the end point logic table 126 of FIG. 10 are integrated and converted to logic # 1x. Logic # 2 and logic # 4 are integrated and converted to logic # 2x.

  The path condition of the logic # 1x is “variable 1_A is greater than 10 and variable 1_Perform_23_section B_1 is less than 30” or “variable 1_A is 10 or less and variable 1_Perform_23_section B_1 is less than 30”. The path output of the logic # 1x is “variable 1 = variable 1_Perform_23_section B_1 + 3”. The path condition of logic # 2x is “variable 1_A is greater than 10 and variable 1_Perform_23_section B_1 is 30 or more” or “variable 1_A is 10 or less and variable 1_Perform_23_section B_1 is 30 or more”. The path output of the logic # 2x is “variable 1 = variable 1_Perform — 23_section B_1-3”.

  The program analysis apparatus 100 simplifies the integrated logic path condition using mathematical expression processing technology. In the example of FIG. 11, the path condition of the logic # 1x can be modified such that “variable 1_A is greater than 10 or variable 1_A is 10 or less” and “variable 1_Perform — 23_section B_1 is less than 30”. Therefore, the path condition of logic # 1x is simplified as “variable 1_Perform — 23_section B_1 is smaller than 30”. Further, the path condition of the logic # 2x can be modified such that “variable 1_A is greater than 10 or variable 1_A is 10 or less” and “variable 1_Perform — 23_section B_1 is 30 or more”. Therefore, the path condition of the logic # 2x is simplified as “variable 1_Perform — 23_section B_1 is 30 or more”. For the simplification of the above path condition, for example, the Quine-Macrasky method can be used.

  The program analysis apparatus 100 further searches for logics having the same simplified path condition but different path outputs. The program analysis apparatus 100 integrates a plurality of corresponding logics into one by connecting path outputs of the corresponding logics with conjunctions (AND). However, there is no logic corresponding to this in the example of FIG.

FIG. 12 is a diagram illustrating an example of combining partial logics.
When the program analysis apparatus 100 simplifies the midpoint logic table 124, the callee logic table 125, and the end point logic table 126, the logics of these three logic tables are combined. First, the program analysis apparatus 100 combines the logic of the midpoint logic table 124 and the logic of the callee logic table 125 to generate an intermediate combined logic table 127.

  The program analysis apparatus 100 selects one waypoint logic from the waypoint logic table 124 and selects one callee logic from the callee logic table 125. The program analysis apparatus 100 substitutes the path output of the selected midpoint logic for the symbol used in the path condition of the selected callee logic. Then, the program analysis apparatus 100 calculates a conjunction (AND) between the substitution result and the path condition of the midpoint logic as the path condition of the intermediate coupling logic. The program analysis apparatus 100 determines whether or not the calculated path condition of the intermediate coupling logic can be satisfied, and if it can be satisfied, adopts a combination of the midpoint logic and the callee logic as an effective combination. On the other hand, when the program analysis device 100 is not satisfiable, the program analysis device 100 does not adopt the combination of the midpoint logic and the callee logic as an invalid combination.

  For the effective combination, the program analysis apparatus 100 substitutes the path output of the midpoint logic into the symbol used for the path output of the callee logic, and calculates the path output of the intermediate coupling logic. The program analysis apparatus 100 registers the path condition and path output calculated for the effective combination in the intermediate combination logic table 127.

  In the case of the program 121, the program analysis apparatus 100 substitutes the value of “variable 1” of the path output of the midpoint logic into the symbol “variable 1_B” of the callee logic. The program analysis apparatus 100 selects the midpoint logic # 1 and the callee logic # 1, and calculates a path condition that “variable 1_A is greater than 10” and “variable 1_A + 1 is greater than 20”. This is equivalent to “variable 1_A + 1 is greater than 20”. Since this path condition can be satisfied (there is a symbol “variable 1_A” that satisfies this path condition), the program analysis apparatus 100 performs an intermediate combination of the combination of the midpoint logic # 1 and the callee logic # 1. Adopt as logic # 1. The path output of the intermediate coupling logic # 1 is “variable 1 = variable 1_A + 1 + 2”.

  Further, the program analysis apparatus 100 selects the midpoint logic # 1 and the callee logic # 2, and calculates a path condition “variable 1_A is greater than 10” and “variable 1_A + 1 is 20 or less”. Since this path condition can be satisfied, the program analysis apparatus 100 employs a combination of the midpoint logic # 1 and the callee logic # 2 as the intermediate coupling logic # 2. The path output of the intermediate coupling logic # 2 is “variable 1 = variable 1_A + 1−2”. In addition, the program analysis apparatus 100 selects the midpoint logic # 2 and the callee logic # 1, and calculates a path condition that “variable 1_A is 10 or less” and “variable 1_A + 1 is greater than 20”. Since this path condition cannot be satisfied, the program analysis apparatus 100 does not employ a combination of the midpoint logic # 2 and the callee logic # 1.

  Further, the program analysis apparatus 100 selects the midpoint logic # 2 and the callee logic # 2, and calculates a path condition “variable 1_A is 10 or less” and “variable 1_A + 1 is 20 or less”. This is equivalent to “variable 1_A + 1 is 10 or less”. Since this path condition can be satisfied, the program analysis apparatus 100 employs a combination of the midpoint logic # 2 and the callee logic # 2 as the intermediate coupling logic # 3. The path output of the intermediate coupling logic # 3 is “variable 1 = variable 1_A-1-2”.

FIG. 13 is a diagram (continued) illustrating an example of combining partial logics.
Next, the program analysis apparatus 100 combines the logic of the intermediate combination logic table 127 and the logic of the end point logic table 126 to generate a logic table 128.

  The program analysis apparatus 100 selects one intermediate combination logic from the intermediate combination logic table 127 and selects one end point logic from the end point logic table 126. The program analysis apparatus 100 substitutes the path output of the selected intermediate coupling logic into the symbol used in the path condition of the selected end point logic. Then, the program analysis apparatus 100 calculates a conjunction (AND) between the substitution result and the pass condition of the intermediate join logic as the pass condition of the joined logic. The program analysis apparatus 100 determines whether or not the calculated logic path condition can be satisfied, and if it can be satisfied, adopts the combination of the intermediate coupling logic and the end point logic as an effective combination. On the other hand, when the program analysis apparatus 100 is not satisfiable, the program analysis apparatus 100 does not adopt the combination of the intermediate combination logic and the end point logic as an invalid combination.

  The program analysis apparatus 100 calculates the path output of the combined logic by substituting the path output of the intermediate coupling logic into the symbol used for the path output of the end point logic for the effective combination. The program analysis apparatus 100 registers the path condition and path output calculated for the effective combination in the logic table 128.

  In the case of the program 121, the program analysis apparatus 100 substitutes the value of “variable 1” of the path output of the intermediate coupling logic into the symbol “variable 1_Perform — 23_section B_1” of the end point logic. The program analysis apparatus 100 selects the intermediate combination logic # 1 and the end point logic # 1x, and calculates a path condition that “variable 1_A + 1 is larger than 20” and “variable 1_A + 1 + 2 is smaller than 30”. Since this path condition can be satisfied, the program analysis apparatus 100 employs a combination of the intermediate combination logic # 1 and the end point logic # 1x as the logic # 1. The path output of the logic # 1 is “variable 1 = variable 1_A + 1 + 2 + 3”.

  Further, the program analysis apparatus 100 selects the intermediate combination logic # 1 and the end point logic # 2x, and calculates a path condition that “the variable 1_A + 1 is larger than 20” and “the variable 1_A + 1 + 2 is 30 or more”. This is equivalent to “variable 1_A + 1 + 2 is 30 or more”. Since this path condition can be satisfied, the program analysis apparatus 100 employs a combination of the intermediate combination logic # 1 and the end point logic # 2x as the logic # 2. The path output of the logic # 2 is “variable 1 = variable 1_A + 1 + 2−3”.

  Further, the program analysis apparatus 100 selects the intermediate combination logic # 2 and the end point logic # 1x, and states that “variable 1_A is greater than 10”, “variable 1_A + 1 is 20 or less”, and “variable 1_A + 1−2 is less than 30”. Calculate the pass condition. This is equivalent to “the variable 1_A is larger than 10”. Since this path condition can be satisfied, the program analysis apparatus 100 employs a combination of the intermediate combination logic # 2 and the end point logic # 1x as the logic # 3. The path output of the logic # 3 is “variable 1 = variable 1_A + 1−2 + 3”.

  Further, the program analysis apparatus 100 selects the intermediate combination logic # 2 and the end point logic # 2x, and passes the path “variable 1_A is greater than 10”, “variable 1_A + 1 is 20 or less”, and “variable 1_A + 1−2 is 30 or more”. Calculate the conditions. Since this path condition cannot be satisfied, the program analysis apparatus 100 does not employ a combination of the intermediate coupling logic # 2 and the end point logic # 2x.

  Further, the program analysis apparatus 100 selects the intermediate combination logic # 3 and the end point logic # 1x, and calculates a path condition that “the variable 1_A is 10 or less” and “the variable 1_A-1-2 is less than 30”. This is equivalent to “variable 1_A is 10 or less”. Since this path condition can be satisfied, the program analysis apparatus 100 employs a combination of the intermediate combination logic # 3 and the end point logic # 1x as the logic # 4. The path output of the logic # 4 is “variable 1 = variable 1_A-1-2 + 3”.

  Further, the program analysis apparatus 100 selects the intermediate combination logic # 3 and the end point logic # 2x, and calculates a path condition of “variable 1_A is 10 or less” and “variable 1_A-1-2 is 30 or more”. Since this path condition is not satisfiable, the program analysis apparatus 100 does not employ a combination of the intermediate combination logic # 3 and the end point logic # 2x.

As a result, a logic table 128 in which four logics are registered is generated. The logic table 128 is equivalent to the logic table 129 of FIG. 6 that is generated when an execution path straddling the section A and the section B is directly detected. As described above, the program analysis apparatus 100 can correctly extract the logic of the module in the analysis range even if the calculation amount of symbolic execution is reduced. Incidentally, in the example of a program 121, a candidate execution paths to be symbolic execution is reduced from one ^{2 2 × 2 1 = 8 2} 2 +2 1 = 6 one on. The effect of reducing the amount of calculation increases as the number of conditional branch statements increases.

FIG. 14 is a diagram illustrating a third example of the program.
The program 146 includes a section A and a section B like the program 121. However, in the program 146, a conditional branch statement is added to the section B. In the added statement, when the value of “variable 1” is smaller than 25, the value of “variable 1” is increased by 4, and when the value of “variable 1” is 25 or more, the value of “variable 1” is increased. Decrease by 4.

When an execution path straddling section A and section B is directly detected by symbolic execution, the number of execution path candidates to be searched is 2 ² × 2 ² = 16. On the other hand, according to the method of combining the partial logic after dividing the symbolic execution of section A and the symbolic execution of section B, the number of execution path candidates to be searched is 2 ² +2 ² = 8. In this case, the number of execution path candidates to be searched is reduced by half.

Next, functions and processing procedures of the program analysis apparatus 100 will be described.
FIG. 15 is a block diagram illustrating an example of functions of the program analysis apparatus.
The program analysis apparatus 100 includes a storage unit 120. The storage unit 120 is mounted using, for example, a storage area secured in the RAM 102 or the HDD 103. The storage unit 120 stores a program 121, an update variable table 122, a symbol assignment table 123, a midpoint logic table 124, a callee logic table 125, an end point logic table 126, an intermediate combination logic table 127, and a logic table 128.

  The program analysis apparatus 100 also includes an update variable extraction unit 131, an update value assignment unit 132, a symbolic execution unit 133, a partial logic collection unit 134, a logic simplification unit 135, a partial logic combination unit 136, and an analysis result display unit 137. . The update variable extraction unit 131, the update value assignment unit 132, the symbolic execution unit 133, the partial logic collection unit 134, the logic simplification unit 135, the partial logic combination unit 136, and the analysis result display unit 137 are, for example, programs executed by the processor 101 Implemented using modules.

  When the analysis range in the program 121 to be analyzed and the analysis range in the program 121 is designated, the update variable extraction unit 131 is a call statement that calls a module outside the analysis range from the analysis range and has no description of the action (for example, (PERFORM statement). The update variable extraction unit 131 searches for an update variable whose value may be updated in the call destination module from the call destination module of the retrieved call statement. Thereby, the update variable extraction unit 131 generates the update variable table 122 and stores it in the storage unit 120.

  The update value assignment unit 132 generates the symbol assignment table 123 and stores it in the storage unit 120. The update value assignment unit 132 detects that the symbolic execution by the symbolic execution unit 133 has reached a call statement that calls a module outside the analysis range and has no description of the action. Then, the update value assigning unit 132 searches the update variable table 122 for an update variable corresponding to the callee module, and assigns a new symbol to each searched update variable. The update value assignment unit 132 registers the assigned symbol in the symbol assignment table 123 and notifies the symbolic execution unit 133 of the assigned symbol.

  The symbolic execution unit 133 starts symbolic execution after the update variable extraction unit 131 extracts the update variable. The object of symbolic execution is a specified analysis range in the program 121. However, when there is a call statement, the symbolic execution unit 133 performs symbolic execution on the callee module independently of the caller module. The symbolic execution unit 133 assigns a symbol to the input of the module at the head of each module. When the symbolic execution unit 133 reaches a call statement that calls a module outside the analysis range and has no description of the action, the symbolic execution unit 133 converts the call destination module into a stub and acquires the update variable symbol from the update value assignment unit 132. . After the call statement, the symbolic execution is continued using the acquired symbol.

  The partial logic collection unit 134 generates the halfway point logic table 124, the callee logic table 125, and the end point logic table 126 and stores them in the storage unit 120. The partial logic collection unit 134 collects various types of logic information in the process of symbolic execution by the symbolic execution unit 133. When the symbolic execution reaches the call statement, the partial logic collection unit 134 acquires the midpoint logic immediately before the call statement and registers it in the midpoint logic table 124. Further, when the symbolic execution reaches the end point of the call destination module, the partial logic collection unit 134 acquires the call destination logic at that time and registers it in the call destination logic table 125. Further, when the symbolic execution reaches the end point of the call source module, the partial logic collection unit 134 acquires the call source logic at that time and registers it in the end point logic table 126.

  The logic simplification unit 135 simplifies the midpoint logic registered in the midpoint logic table 124 after the end of symbolic execution. Also, the logic simplification unit 135 simplifies the callee logic registered in the callee logic table 125 after the end of symbolic execution. In addition, the logic simplification unit 135 simplifies the end point logic registered in the end point logic table 126 after the end of the symbolic execution.

  The partial logic combination unit 136 generates the intermediate combination logic table 127 and the logic table 128 and stores them in the storage unit 120. The partial logic combining unit 136 combines the midpoint logic registered in the midpoint logic table 124 with the callee logic registered in the callee logic table 125, and registers the intermediate bond logic in the intermediate bond logic table 127. In the combination of the midpoint logic and the callee logic, only those that can satisfy the combined path condition are employed. The partial logic combination unit 136 combines the intermediate combination logic and the end point logic registered in the end point logic table 126 and registers the combined logic in the logic table 128. In the connection between the intermediate connection logic and the end point logic, only the path condition after the connection that can run vertically is adopted.

  The analysis result display unit 137 displays the generated logic table 128 on the display 111. However, the program analysis apparatus 100 may transmit the generated logic table 128 to another apparatus. In addition, the program analysis apparatus 100 may output the logic table 128 by other methods such as reproducing a sound for reading out the contents of the logic table 128 from a speaker or outputting the logic table 128 to a printing device.

FIG. 16 is a flowchart illustrating a procedure example of program analysis.
(S1) The program analysis apparatus 100 acquires the specification of the analysis target program 121 and the specification of one or more modules as the analysis range in the program 121. These designations are input from the user using the input device 112, for example.

(S2) The update variable extraction unit 131 extracts update variables of modules outside the analysis range that may be called when the analysis range is executed. Details of the update variable extraction will be described later.
(S3) The symbolic execution unit 133 performs symbolic execution separately for the module within the analysis range and the module outside the analysis range that is the call destination. The partial logic collection unit 134 collects midway point logic, call destination logic, and end point logic while symbolic execution is being performed. Details of the symbolic execution will be described later.

(S4) The logic simplification unit 135 simplifies the collected midpoint logic, call destination logic, and end point logic. Details of the logic simplification will be described later.
(S5) The partial logic combining unit 136 combines the halfway point logic after the simplification and the callee logic. Details of the logic combination will be described later.

(S6) The partial logic combination unit 136 combines the intermediate combination logic and the end point logic generated in step S5. The logic combination algorithm is the same as in step S5.
(S7) The analysis result display unit 137 causes the display 111 to display a logic table 128 indicating the logic combined in step S6.

FIG. 17 is a flowchart illustrating an exemplary procedure for extracting update variables.
The update variable extraction is executed in the above-described step S2.
(S <b> 10) The update variable extraction unit 131 acquires the specification of the analysis target program 121 and the specification of one or more modules as the analysis range in the program 121. The update variable extraction unit 131 pays attention to the module in the designated analysis range.

(S11) The update variable extraction unit 131 searches for a call statement that calls a module outside the analysis range and has no description of the action from the module of interest.
(S12) The update variable extraction unit 131 determines whether or not the corresponding call statement has been searched in step S11. If there is a corresponding call statement, the process proceeds to step S13. If there is no corresponding call statement, the processes in steps S13 to S16 are skipped.

(S13) The update variable extraction unit 131 acquires a call destination module.
(S14) The update variable extraction unit 131 searches the callee module for a variable update statement that updates the value of the variable. The variable whose value is updated (update variable) is, for example, a variable described on the left side of the assignment statement, a variable described as the second argument of the MOVE statement, or the like.

  (S15) The update variable extraction unit 131 associates the module name of the callee module with the variable name of the update variable searched in step S14 and registers it in the update variable table 122. However, when calling is performed hierarchically, the module name of the first-stage module called from the analysis range is used as the module name.

  (S16) The update variable extraction unit 131 pays attention to the call destination module acquired in step S13, and recursively executes the processes of steps S11 to S16 for the call destination module. When the call destination module further includes a call statement (sub-call statement) for calling another module, the update variable is searched recursively.

FIG. 18 is a flowchart illustrating a procedure example of symbolic execution.
The symbolic execution is executed in step S3 described above.
(S20) The symbolic execution unit 133 acquires the specification of the analysis target program 121 and the specification of one or more modules as the analysis range in the program 121. The symbolic execution unit 133 focuses on a module in the designated analysis range.

  (S21) The symbolic execution unit 133 assigns an independent symbol to the input variable in which the input of the module of interest is stored. For example, the symbolic execution unit 133 assigns the symbol “variable 1_A” to “variable 1” in section A of FIG.

(S22) The symbolic execution unit 133 acquires one instruction statement to be executed next from the program 121 in accordance with the processing order of the program 121.
(S23) The symbolic execution unit 133 determines whether a command statement other than the end statement has been acquired in step S22. If a command statement other than the end statement is acquired, the process proceeds to step S24. If the end sentence has been acquired or there is no corresponding statement, the process proceeds to step S29.

  (S24) The symbolic execution unit 133 determines whether the instruction sentence acquired in step S22 is a call sentence for calling a module outside the analysis range and has no description of the action. Like the PERFORM statement in FIG. 5, a call statement in which an update variable to be updated by the callee module is not specified is a call statement without an action description. If the acquired command statement is a corresponding call statement, the process proceeds to step S25, and if the acquired command statement is other than that, the process proceeds to step S31.

  (S25) The partial logic collection unit 134 registers the path condition and path output immediately before the call statement in the midway logic table 124. The path condition is an accumulation of the branch direction conditions selected from the beginning of the module of interest to immediately before the call statement. The path output is the value of the variable just before the call statement. For the path condition and path output, the symbols assigned in step S21 may be used.

  (S26) The symbolic execution unit 133 determines whether the callee module indicated by the call statement has been analyzed. If the callee module has been analyzed, the process proceeds to step S28, and if not yet analyzed, the process proceeds to step S27.

  (S27) The symbolic execution unit 133 pays attention to the called module, and recursively executes the processes of steps S21 to S30. At this time, the symbolic execution unit 133 saves information in the middle of analysis of the caller module, and performs symbolic execution on the callee module independently of the caller module. When the symbolic execution of the callee module is completed, the symbolic execution unit 133 continues the symbolic execution of the caller module using the saved information during the analysis. In the flowchart of FIG. 18, the symbolic execution of the call source module is interrupted and the callee module is executed symbolically. However, the symbolic execution of the callee module may be started after the symbolic execution of the caller module ends.

  (S28) The update value assignment unit 132 searches the update variable table 122 for an update variable corresponding to the callee module. The update value assigning unit 132 assigns an independent symbol to the searched update variable, and registers the assigned symbol in the symbol assignment table 123. Also, the update value assigning unit 132 notifies the symbol execution unit 133 of the assigned symbols. When the symbolic execution unit 133 holds the value of the update variable immediately before the call statement, the symbolic execution unit 133 discards the value and saves the symbol notified from the update value assignment unit 132. That is, the symbolic execution unit 133 treats the value of the update variable as being overwritten by the notified symbol. Then, the process proceeds to step S22.

  (S29) The symbolic execution unit 133 determines that the execution path has reached the end point. The partial logic collection unit 134 registers the current path condition and path output in the end point logic table 126. However, in the case of symbolic execution for the callee module, the partial logic collection unit 134 registers the current pass condition and pass output in the callee logic table 125. The path condition is an accumulation of the branch direction conditions selected from the beginning to the end point of the module of interest. The path output is the value of the variable at the end point of the module of interest. For the path condition and path output, the symbol allocated in step S21 or the symbol allocated in step S28 may be used.

  (S30) The symbolic execution unit 133 determines whether or not there are unselected execution paths that are divided by the conditional branch statement. If there is an unselected execution path, the symbolic execution unit 133 backtracks to the previous division point, and acquires the saved path condition and path output at that division point. The symbolic execution unit 133 selects an unselected branch direction, and continues symbolic execution for the execution path using the acquired path condition and path output. Then, the process proceeds to step S22. On the other hand, if there is no unselected execution path, the symbolic execution of the module of interest ends.

FIG. 19 is a flowchart (continuation) illustrating an example of the procedure of symbolic execution.
(S31) The symbolic execution unit 133 determines whether the command statement acquired in step S22 is a variable update statement that updates the value of the variable. The variable update statement is, for example, an assignment statement or a move statement in which the left side and the right side are joined with an equal sign. If the acquired command statement is a variable update statement, the process proceeds to step S32; otherwise, the process proceeds to step S33.

(S32) The symbolic execution unit 133 updates the value of the variable according to the variable update statement. The value of a variable may be represented by an expression that includes a symbol. Then, the process proceeds to step S22.
(S33) The symbolic execution unit 133 determines whether the instruction statement acquired in step S22 is a conditional branch statement. If the acquired command statement is a conditional branch statement, the process proceeds to step S34, and if not, the process proceeds to step S37.

  (S34) The symbolic execution unit 133 can satisfy each of the two branch directions of the YES direction and the NO direction based on the branch condition described in the conditional branch statement, the value of the variable at that time, and the path condition at that time. Determine sex. If the value of the variable is an expression that includes a symbol, it may be determined that both of the two branch directions are satisfiable.

  (S35) The symbolic execution unit 133 determines whether both of the two branch directions can be satisfied. If both branch directions can be satisfied, the process proceeds to step S36. If only one branch direction can be satisfied, the process proceeds to step S37.

  (S36) The symbolic execution unit 133 divides the execution path. The symbolic execution unit 133 selects one of the two branch directions (for example, the YES direction) and sets it as the traveling direction of the current execution path. Also, the symbolic execution unit 133 saves the current path condition and path output. The divided execution paths corresponding to the branch direction not selected are set as unselected execution paths. Then, the process proceeds to step S22.

  (S37) The symbolic execution unit 133 performs processing according to the command sentence acquired in step S22. If it is determined in step S35 that only one branch direction can be satisfied, the symbolic execution unit 133 selects a branch direction that can be satisfied according to the conditional branch sentence. At this time, the execution path is not divided. Then, the process proceeds to step S22.

FIG. 20 is a flowchart illustrating an example of a logic simplification procedure.
The logic simplification is executed in step S4 described above.
(S40) The logic simplification unit 135 selects one of the midpoint logic table 124, the callee logic table 125, and the end point logic table 126.

(S41) The logic simplification unit 135 searches the logic table selected in step S40 for a plurality of logics having the same path output but different path conditions.
(S42) When a plurality of logics corresponding to step S41 are searched, the logic simplification unit 135 connects the searched logics to one by connecting OR the path conditions of the searched logics. Integrate into logic.

(S43) The logic simplification unit 135 simplifies the path conditions of each logic after integration in step S42 by reducing redundancy.
(S44) The logic simplification unit 135 searches the logic after the simplification in step S43 for a plurality of logics having the same path condition and different path outputs.

  (S45) When a plurality of logics corresponding to step S44 are searched, the logic simplification unit 135 concatenates the searched logics into one by connecting AND the path outputs of the searched logics. Integrate into logic.

  (S46) The logic simplification unit 135 determines whether all of the midway logic table 124, the callee logic table 125, and the end point logic table 126 have been selected in step S40. If there is an unselected logic table, the process proceeds to step S40, and if all three logic tables are selected, the logic simplification ends.

FIG. 21 is a flowchart illustrating an exemplary procedure of logic combination.
The logic combination is performed in the above-described step S5 and step S6. In step S5 and step S6, a common logic combination algorithm can be used.

  (S50) The partial logic combination unit 136 acquires the logic table T1 and the logic table T2 to be combined. In step S5, the logic table T1 is the midpoint logic table 124, and the logic table T2 is the callee logic table 125. In step S6, the logic table T1 is the intermediate join logic table 127, and the logic table T2 is the end point logic table 126.

(S51) The partial logic combination unit 136 selects the record R1 from the logic table T1. The record R1 represents one logic in the logic table T1.
(S52) The partial logic combination unit 136 selects the record R2 from the logic table T2. The record R2 represents one logic in the logic table T2.

  (S53) The partial logic combination unit 136 substitutes the path output of the record R1 for the symbol used in the path condition of the record R2. The partial logic combining unit 136 connects the substitution result and the path condition of the record R1 with AND, and calculates the combined path condition.

  (S54) The partial logic combining unit 136 determines whether or not the combined path condition calculated in step S53 is satisfied. If the combined path condition can be satisfied, the process proceeds to step S55, and if not, the process proceeds to step S57.

(S55) The partial logic combination unit 136 substitutes the path output of the record R1 for the symbol used for the path output of the record R2, and calculates the combined path output.
(S56) The partial logic combination unit 136 registers the path condition calculated in step S53 and the path output calculated in step S55 in the logic table of the combination result. In step S5, the logic table of the join result is the intermediate join logic table 127. In step S <b> 6, the logic table of the combination result is the logic table 128.

  (S57) The partial logic combination unit 136 determines whether there is a record not selected in step S52 in the logic table T2. If there is an unselected record, the process proceeds to step S52. If all records are selected, the process proceeds to step S58.

  (S58) The partial logic combination unit 136 determines whether there is a record not selected in step S51 in the logic table T1. If there is an unselected record, the process proceeds to step S51. If all the records are selected, the logic combination is terminated.

  According to the program analysis apparatus 100 of the second embodiment, the symbolic execution of the caller module and the symbolic execution of the callee module are performed independently. In the symbolic execution of the calling module, the path condition and path output immediately before the calling statement are saved, the calling statement is skipped, and new symbols are assigned to update variables that may be updated in the called module. . Then, the logic information immediately before the call statement, the logic information at the end point of the call source module, and the logic information at the end point of the call destination module are combined to reproduce the execution path.

  As a result, it is possible to suppress path explosion when analyzing an execution path extending over a plurality of modules, and to reduce the amount of calculation of symbolic execution. Therefore, the execution path can be analyzed efficiently. Since the processing contents of the callee module are not ignored, the reproduced execution path correctly represents the relationship between the input and output of the caller module.

DESCRIPTION OF SYMBOLS 10 Program analyzer 11 Memory | storage part 12 Operation part 20 Program 21, 26 Module 22 Call instruction 23a, 23b 1st execution path 24 1st information 25 2nd information 27a, 27b 2nd execution path 28 3rd information 31a, 31b, 31c, 31d Combining execution path 32 Path information c1, c2, c3 symbols

Claims (6)

A program analysis method executed by a computer,
A first module and a second module, wherein the first module obtains a program including a call instruction for calling the second module;
A first symbol is assigned to an input of the first module, first information representing a first processing result before the call instruction is expressed using the first symbol, and the call of the call instruction is generated. A second symbol is assigned to the result, and a second processing result after the call instruction of each of the plurality of first execution paths included in the first module is expressed using the second symbol. Generate information for
A third symbol is assigned to the input of the second module, and a third processing result of each of a plurality of second execution paths included in the second module is expressed using the third symbol. Generate information for
The first processing result indicated by the first information is associated with the third symbol used for the third information, and the third processing result indicated by the third information is By associating the second symbol used for the second information, the processing results of the plurality of combined execution paths obtained by combining the plurality of first execution paths and the plurality of second execution paths are obtained. Generating path information represented using the first symbol;
Program analysis method. The second information represents a first execution condition of each of the plurality of first execution paths using at least one of the first and second symbols, and the third information represents the plurality of first execution paths. A second execution condition of each of the two execution paths is expressed using the third symbol;
In the generation of the path information, when the first execution condition corresponding to one first execution path and the second execution condition corresponding to one second execution path do not contradict each other, Combining a first execution path and the one second execution path;
The program analysis method according to claim 1. The first information indicates the first processing result for each of a plurality of partial execution paths detected when the plurality of first execution paths are executed before the call instruction,
In the generation of the path information, the first processing result of the plurality of partial execution paths, the second processing result of the plurality of first execution paths, and the third of the plurality of second execution paths. Combining with the processing result,
The program analysis method according to claim 1. Search the program for an update variable to be updated by the second module among the variables used in the first module;
In the generation of the second information, the second symbol is assigned to the update variable.
The program analysis method according to claim 1. A storage unit including a first module and a second module, wherein the first module stores a program including a call instruction for calling the second module;
A first symbol is assigned to an input of the first module, first information representing a first processing result before the call instruction is expressed using the first symbol, and the call of the call instruction is generated. A second symbol is assigned to the result, and a second processing result after the call instruction of each of the plurality of first execution paths included in the first module is expressed using the second symbol. Generate information for
A third symbol is assigned to the input of the second module, and a third processing result of each of a plurality of second execution paths included in the second module is expressed using the third symbol. Generate information for
The first processing result indicated by the first information is associated with the third symbol used for the third information, and the third processing result indicated by the third information is By associating the second symbol used for the second information, the processing results of the plurality of combined execution paths obtained by combining the plurality of first execution paths and the plurality of second execution paths are obtained. A calculation unit for generating path information represented by using the first symbol;
A program analysis apparatus. On the computer,
A first module and a second module, wherein the first module obtains a program including a call instruction for calling the second module;
A first symbol is assigned to an input of the first module, first information representing a first processing result before the call instruction is expressed using the first symbol, and the call of the call instruction is generated. A second symbol is assigned to the result, and a second processing result after the call instruction of each of the plurality of first execution paths included in the first module is expressed using the second symbol. Generate information for
A third symbol is assigned to the input of the second module, and a third processing result of each of a plurality of second execution paths included in the second module is expressed using the third symbol. Generate information for
The first processing result indicated by the first information is associated with the third symbol used for the third information, and the third processing result indicated by the third information is By associating the second symbol used for the second information, the processing results of the plurality of combined execution paths obtained by combining the plurality of first execution paths and the plurality of second execution paths are obtained. Generating path information represented using the first symbol;
An analysis program that executes processing.

Images