JP2018147106A - Program analyzer, program analysis method and program analysis program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a program analyzer, a program analysis method and a program analysis program which symbolically execute a program obtained by program slicing.SOLUTION: A slicing unit 11 extracts instruction statements from a program 2 on the basis of a slicing base point 3 to generate an instruction statement list and stores the list in an instruction statement list storage unit 12. Then, a restoration unit 13 reads the instruction statement list from the instruction statement list storage unit 12 to restore an executable program and stores the executable program in a restored program storage unit 14. Then, a symbolic execution unit 15 reads the program from the restored program storage unit 14 to symbolically execute the program.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a program analysis device, a program analysis method, and a program analysis program.

  In maintenance and rebuilding of an existing information system, in order to understand and grasp the current state of the existing system, information such as documents on the existing system and knowledge of experts is necessary. However, in an information system that has been operated and maintained for a long period of time, information necessary for maintenance and reconstruction work may be insufficient due to factors such as document deficiencies and the absence of experts.

  In such a case, as a substitute for information obtained from a document or an expert, a lacking knowledge is compensated by analyzing a program which is an implementation entity of the information system. Such program analysis is called program logic extraction. Here, the logic of the program is the content of the process described in the program, and specifically, the input / output relationship as the execution result of the program.

  One method of program logic extraction is to use symbolic execution technology. Here, symbolic execution is a technique for analyzing a program by setting a symbol value (symbol value) to an input variable and extracting an executable path of the program.

  The symbolic execution technique refers to and updates variable values according to an instruction statement described in a program, and controls the execution of the instruction statement according to the program description in a control statement such as a conditional branch statement or a loop statement. In particular, in a conditional branch, a branch is selected according to the true / false value of the conditional expression. However, the symbolic execution technique cannot calculate the true / false value of the conditional expression if the symbol value is included in the variable value constituting the conditional expression.

  For this reason, the symbolic execution technique controls branch selection of the conditional branch by determining whether the conditional expression is satisfiable (the conditional expression can be true) instead. For the determination of satisfiability, an SMT (Satisfiability Modulo Theories) solver or an SAT (SATisfiability problem) solver is used. When a plurality of conditional branches can be satisfied, the plurality of branches can be executed together. Therefore, the symbolic execution technique extracts an executable path by assuming and selecting one of the plurality of branches in order. .

  The analysis result of symbolic execution is a path condition and a path output for each executable path. One form of the result of organizing these results and extracting the specifications from the analysis target program is a logic table or a decision table. The logic table represents a condition regarding input and an output when the condition is satisfied.

  Hereinafter, an operation example of program logic extraction using symbolic execution will be described. FIG. 21 is a diagram showing a program 91 used for explaining symbolic execution. FIG. 21 shows a program 91 written in COBOL. As shown in FIG. 21, in the program 91, there are IF sentences indicated by IF sentence # 1 and IF sentence # 2 in the 14th and 19th lines, respectively.

  FIG. 22 is a flowchart of the program 91 shown in FIG. As shown in FIG. 22, the flowchart shows the branch structure according to the condition of the program 91 and the processing contents in each branch. For example, the processing contents of two branches based on the branch condition “gender = male” corresponding to the IF statement # 1 of the program 91 are “output =“ M ”” and “output =“ ”, respectively.

  23 is a diagram showing paths extracted by symbolic execution of the program 91 shown in FIG. 21, and FIG. 24 is a logic table showing analysis results by symbolic execution of the program 91 shown in FIG. As shown in FIG. 23, three paths represented by path # 1 to path # 3 are extracted by symbolic execution, and as shown in FIG. 24, path conditions and path outputs corresponding to each path are extracted.

  Here, the path is a sequence of executed statements, and the path condition is a conditional expression of a symbol value that can satisfy the condition among the conditions that are passed until the path ends. The path is executable when the path condition can be satisfied.

  The path condition is not simply extracted from a conditional expression of a conditional branch statement such as an IF statement described in the program, but also includes a variable update result executed between conditional branch statements. The fourth path has a path condition of “(gender = male) ＝ (gender = female)” and the path condition is unsatisfiable (cannot be established), so it is determined as an infeasible path and is not extracted. The path output is an output resulting from the execution of the path. No is a number that identifies the path.

  In the program logic extraction by symbolic execution, it is necessary to exhaustively extract the executable paths of the program in order to extract the logic without omission. For exhaustive path extraction in symbolic execution, there are methods based on depth-first search and breadth-first search, but exhaustive path extraction has the disadvantage of path explosion. Here, there are the following two cases of path explosion.

  (1) The number of paths that can be executed by the target program is infinite. The number of passes is infinite when the program has a loop process and the loop end condition includes a symbol value. In this case, since the condition for continuing the loop can always be satisfied, the number of passes becomes infinite.

  (2) When the analysis time or memory exceeds the limit in the path extraction process. For example, in a program in which N independent IF statements are continued, the number of paths is 2 to the Nth power. Therefore, when N increases, the number of paths is not infinite, but the time and memory that can be analyzed are limited. The limit is exceeded.

  Therefore, it is conceivable to prevent path explosion by using program slicing technology. The program slicing technique is a technique for extracting only a process of interest for a program in which a plurality of processes are mixed.

  FIG. 25 is a diagram showing a program 92 used for explanation of program slicing. As shown in FIG. 25, the program 92 has processing related to two variables X and Y. The processing related to X and the processing related to Y are divided into preprocessing and main processing, respectively, and are implemented in a mixed format. Yes. Therefore, the program slicing technique extracts only processing related to X, for example.

  The program slicing technique extracts a command statement that affects a slicing base point by using a command statement S and a variable V in the program as a slicing base point. The slicing base point is described in the format (S, V). In the program slicing technique, a program dependence graph is constructed from the control dependence and the data dependence for the statements in the program, and the influence statements are extracted by tracing these dependences from the slicing base point.

  FIG. 26 is a diagram illustrating a first example of program slicing, and FIG. 27 is a diagram illustrating a second example of program slicing. In FIG. 26, slice result # 1 shows a case where the target program 93 is sliced at the slicing base point (9, X), and slice result # 2 shows a case where the target program 93 is sliced at the slicing base point (9, Y). Show. Note that “9” indicates a line of a command statement. In addition, the extracted command sentence is shown in bold.

  As shown in the slice result # 1, a statement that affects the variable X of “DISPLAY X Y Z” on the ninth line is extracted. Also, as shown in the slice result # 2, a command statement that affects the variable Y of “DISPLAY X Y Z” on the ninth line is extracted. Since Y depends on X due to “Y = X + 1” on the second line, “X = X + 1” on the first line is also extracted as a statement that affects the variable Y of “DISPLAY X Y Z” on the ninth line. .

  FIG. 27 shows the slicing result when the COMPUTE statement on the 23rd line of the program 92 shown in FIG. 25 is set as the slicing base point (23, X). Since the COMPUTE statement on the 23rd line references and updates only the variable X, the variable X need not be explicitly specified as the slicing base point.

  In the right diagram of FIG. 27, a command statement not related to the slicing base point 3 is marked with a strikethrough, and a command statement without a strikethrough is a command statement that affects the slicing base point (23, X). By executing the program slicing, it is possible to extract only the imperative statement that affects the COMPUTE statement on the 23rd line, so that debugging work and testing can be made more efficient.

  A technology that eliminates the need for the user of the program to investigate the attribute information for all variables by inferring the attributes of other variables while tracing the dependency relationships of the variables from the attribute information about some of the program variables. is there. According to this technology, when the system verification model is synthesized from the software model and the external environment model, it is possible to reduce time and effort for matching input / output between the software model and the external environment model.

  In addition, there is a technology that provides information on the software configuration and processing overview to the user by displaying variable dependency relationships between multiple statements from assignment dependency relationships, data dependency relationships, and control dependency relationships between two variables. .

JP 2014-48856 A JP2013-156786A

  Since the program slicing technique can extract statements that affect the slicing base point, path explosion can be prevented by combining with the symbolic execution technique. However, since the result of program slicing is not an executable program, there is a problem that it cannot be used for symbolic execution.

  For example, in FIG. 27, the DISPLAY statement on the 10th line is a command statement that does not affect the slicing base point, and this command statement is marked with a strikethrough, but this command statement is excluded as “no effect”. Then, there is no statement for the THEN branch of the IF statement on the 9th line. For this reason, the description of the slicing result program is incomplete, and the slicing result program becomes “unexecutable”.

  An object of one aspect of the present invention is to symbolically execute a program obtained by program slicing.

  In one aspect, the program analysis apparatus includes a slicing unit, a restoration unit, and a symbolic execution unit. The slicing unit extracts an imperative sentence that influences a slicing base point that specifies an imperative sentence and a variable in the program, and creates an imperative sentence list. The restoration unit restores a program that can be symbolically executed using the command statement list created by the slicing unit. The symbolic execution unit symbolically executes the program restored by the restoration unit and outputs a logic table.

  In one aspect, the present invention can symbolically execute a program obtained by program slicing.

FIG. 1 is a diagram for explaining program restoration by the program analysis apparatus according to the embodiment. FIG. 2 is a diagram illustrating a functional configuration of the program analysis apparatus according to the embodiment. FIG. 3 is a diagram illustrating an example of a program and a slicing base point. FIG. 4 is a diagram illustrating an operation example of the slicing unit. FIG. 5 is a diagram illustrating an operation example of the restoration unit. FIG. 6 is a diagram showing a symbolic execution result of the restored program. FIG. 7 is a diagram illustrating an operation example of the branch setting unit. FIG. 8 is a diagram illustrating an operation example of the branch control unit. FIG. 9 is a flowchart showing a flow of processing by the program analysis apparatus. FIG. 10 is a flowchart showing the flow of the program slicing process. FIG. 11 is a flowchart showing a flow of processing for restoring a program. FIG. 12 is a flowchart illustrating a flow of processing for performing branch setting. FIG. 13 is a diagram illustrating a program having a nested conditional branch statement and a control dependency relationship. FIG. 14 is a diagram showing an example of fixed selection information created from the program shown in FIG. FIG. 15 is a flowchart illustrating a flow of processing for performing branch control. FIG. 16 is a diagram showing the result of symbolic execution of the program shown in FIG. FIG. 17 is a diagram showing a logic table of the program shown in FIG. FIG. 18 is a first diagram illustrating a result of symbolic execution by the program analysis apparatus. FIG. 19 is a second diagram illustrating the result of symbolic execution by the program analysis apparatus. FIG. 20 is a diagram illustrating a hardware configuration of a computer that executes the program analysis program according to the embodiment. FIG. 21 is a diagram showing a program used to explain symbolic execution. FIG. 22 is a flowchart of the program shown in FIG. FIG. 23 is a diagram showing paths extracted by symbolic execution of the program shown in FIG. FIG. 24 is a logic table showing the analysis result of the symbolic execution of the program shown in FIG. FIG. 25 is a diagram showing a program used to explain program slicing. FIG. 26 is a diagram illustrating a first example of program slicing. FIG. 27 is a diagram illustrating a second example of program slicing.

  Embodiments of a program analysis device, a program analysis method, and a program analysis program disclosed in the present application will be described below in detail with reference to the drawings. Note that this embodiment does not limit the disclosed technology.

  First, restoration of a program by the program analysis apparatus according to the embodiment will be described. FIG. 1 is a diagram for explaining program restoration by the program analysis apparatus according to the embodiment. FIG. 1 shows an executable program restored from the program slicing result shown in FIG. 27 and a flow diagram of the restored executable program.

  As shown in FIG. 1, the program analysis apparatus according to the embodiment restores an executable program by inserting a CONTINUE statement, which is a dummy command statement, in the 10th and 25th lines of the program. In the program slicing result of FIG. 27, there is no instruction statement in the THEN branch of the IF statement on the ninth line. For this reason, the program analysis apparatus according to the embodiment inserts a CONTINUE statement in the THEN branch of the IF statement on the ninth line. Similarly, in the program slicing result of FIG. 27, there is no command statement in the ELSE branch of the IF statement on the 22nd line. Therefore, the program analysis apparatus according to the embodiment inserts a CONTINUE statement in the ELSE branch of the IF statement on the 22nd line.

  As described above, the program analysis apparatus according to the embodiment can restore an executable program by inserting a CONTINUE statement at a branch point where there is no valid command statement in the program slicing result.

  Next, a functional configuration of the program analysis apparatus according to the embodiment will be described. FIG. 2 is a diagram illustrating a functional configuration of the program analysis apparatus according to the embodiment. As illustrated in FIG. 2, the program analysis apparatus 1 according to the embodiment includes a slicing unit 11, a command statement list storage unit 12, a restoration unit 13, a restoration program storage unit 14, a symbolic execution unit 15, and a branch setting. Unit 16 and branch control unit 17.

  The slicing unit 11 inputs the program 2 and the slicing base point 3, executes program slicing, and stores a list of command statements that affect the slicing base point 3 in the command statement list storage unit 12. The command statement list storage unit 12 stores a list of command statements that affect the slicing base point 3. For example, the slicing unit 11 reads the program 2 from a file and receives the slicing base point 3 input from the terminal by the user. The command statement list storage unit 12 is an area on the main memory, for example.

  FIG. 3 is a diagram illustrating an example of the program 2 and the slicing base point 3. The program 2 and the slicing base point 3 in FIG. 3 are the same as the program 92 and the slicing base point 3 shown in FIG.

  FIG. 4 is a diagram illustrating an operation example of the slicing unit 11. As shown in FIG. 4, the slicing unit 11 inputs, for example, the program 2 shown in FIG. Further, the slicing unit 11 receives, for example, the COMPUTE statement on the 23rd line and the designation of X as the slicing base point 3. Then, the slicing unit 11 extracts the 9th IF statement, the 13th ADD statement, the 22nd IF statement, and the 23rd COMPUTE statement as a list of command statements that affect the slicing base point 3. Note that the list of command statements affecting the slicing base point 3 is a statement that is not erased by a strikethrough in FIG.

  The restoration unit 13 reads a list of command statements that affect the slicing base point 3 from the command statement list storage unit 12 and restores an executable program using the list of command statements that affect the slicing base point 3. Then, the restoration unit 13 stores the restored program in the restoration program storage unit 14. The restoration program storage unit 14 stores the executable program restored by the restoration unit 13. The restoration program storage unit 14 is an area on the main memory, for example.

  FIG. 5 is a diagram illustrating an operation example of the restoration unit 13. As shown in FIG. 5, the restoration unit 13 obtains intermediate data in which a CONTINUE statement is inserted as a dummy instruction statement at a branch point of line number 10 and line number 25 where there is no instruction statement in the list of instruction statements affecting the slicing base point 3. Create and restore an executable program using the intermediate data. Here, the dummy command statement is a command statement that does nothing. The restored program of FIG. 5 is an executable program by inserting a CONTINUE statement at the branch point of line number 10 and line number 25.

  The symbolic execution unit 15 reads the program restored by the restoration unit 13 from the restoration program storage unit 14 and performs symbolic execution. Then, the symbolic execution unit 15 outputs the logic table 4. The restoration unit 13 may display the logic table 4 on a display device or may output it to a file.

  The user can easily understand the logic of the program 2 using the logic table 4. That is, the logic table 4 assists the user in understanding what kind of output is obtained in what kind of path. Therefore, the program analysis apparatus 1 can support maintenance and reconstruction work of the existing information system.

  FIG. 6 is a diagram showing a symbolic execution result of the restored program. FIG. 6 shows the flow diagram of the restored program, the extracted paths, and the logic table 4. As shown in FIG. 6, three paths are extracted by symbolic execution. For path # 1, the path condition is (X> 0) and the path output is (X + 1). For path # 2, the path condition is (XNOT> 0) AND ((X + 10)> 0) and the path output is ((X + 10) +1). For path # 3, the path condition is (X NOT> 0) AND ((X + 10) NOT> 0), and the path output is (X + 10).

  In FIG. 6, path # 3 that does not pass through the slicing base point (23, X) is included. That is, if the program restored by the restoration unit 13 after program slicing is symbolically executed, a path that does not pass through the slicing base point 3 is also extracted, and the number of paths is not sufficiently reduced. The reason is that the slicing base point (23, X) depends on the IF statement on the 22nd line. That is, in order to reach the slicing base point (23, X), the THEN branch must be fixedly selected in the IF statement on the 22nd line, but in the symbolic execution, the ELSE branch is also selected.

  Therefore, when the slicing base point 3 is dependent on the conditional branch sentence, the program analysis apparatus 1 sets information for fixedly selecting a branch that reaches the slicing base point 3 in the conditional branch sentence. Then, the program analysis apparatus 1 controls branch selection based on the information set in the conditional branch sentence when the executable path is extracted by symbolically executing the program restored by the restoration unit 13. Thus, by limiting and extracting only the paths that pass through the slicing base point 3, the program analysis apparatus 1 can reduce the number of paths to be extracted.

  The branch setting unit 16 determines whether or not the slicing base point 3 is control-dependent on the conditional branch sentence based on the control dependency relationship, and when it depends on the control, the branch setting unit 16 fixedly selects a branch that reaches the slicing base point 3 Is set in the conditional branch statement.

  FIG. 7 is a diagram illustrating an operation example of the branch setting unit 16. In FIG. 7, the fixed selection information is information on a conditional branch sentence of fixed selection and a selected branch. As shown in FIG. 7, the branch setting unit 16 inputs the program 2, the control dependency relationship, and the slicing base point 3, and outputs fixed selection information. In FIG. 7, the IF statement on the 22nd line is output as the conditional branch statement of fixed selection, and the THEN branch is output as the selected branch.

  Note that the branch setting unit 16 outputs an ELSE branch as a branch when an IF statement with no ELSE and a branch other than the THEN branch is fixedly selected. In the case of a COBOL EVALUATE statement, the branch setting unit 16 sets information that can specify which WHEN the branch is. As information that can specify which WHEN the branch is, for example, there is “WHEN on the 50th line”.

  The branch control unit 17 controls branch selection based on the fixed selection information when the symbolic execution unit 15 performs symbolic execution of the program restored from the program slicing result and extracts an executable path.

  If the true / false value of the conditional branch condition is definite, and the branch selected by the true / false value is the same as the fixedly selected branch, the branch control unit 17 selects the fixedly selected branch. Also, if the true / false value of the conditional branch condition is definite and the branch selected by the true / false value is different from the fixedly selected branch, the branch control unit 17 rejects the symbolic execution path, Instructs the symbolic execution unit 15 to perform backtracking. Here, backtracking means returning to the previous conditional branch and selecting another branch. If the true / false value of the conditional branch condition is indefinite and a plurality of branches can be selected, the branch control unit 17 selects the fixedly selected branch.

  FIG. 8 is a diagram illustrating an operation example of the branch control unit 17. As shown in FIG. 8, the output of the branch control unit 17 is output # 1) a branch selected by a conditional branch statement or output # 2) a backtrack instruction, and the fixed selection branch is a THEN branch. If the determination result of the IF statement condition (X> 0) on the 22nd line by symbolic execution is indefinite and can be satisfied, the branch control unit 17 selects the THEN branch. Also, the IF statement condition on line 22 by symbolic execution! Even when the determination result of (X> 0) is indefinite and can be satisfied, the branch control unit 17 selects the THEN branch. Therefore, in this example, there is no backtrack instruction.

  Next, the flow of processing by the program analysis apparatus 1 will be described. FIG. 9 is a flowchart showing a flow of processing by the program analysis apparatus 1. As shown in FIG. 9, the program analysis apparatus 1 inputs a program 2 to be analyzed and a slicing base point 3 (step S1). Then, the program analysis apparatus 1 executes program slicing processing on the program 2 from the slicing base point 3 (step S2), and restores an executable program from the execution result of program slicing by program restoration (step S2). S3).

  Then, the program analysis apparatus 1 determines whether the slicing base point 3 is control-dependent on the conditional branch statement, and when it is determined that the slicing base point 3 is control-dependent, the program analysis apparatus 1 provides fixed selection information for fixedly selecting the branch including the slicing base point 3 Create (step S4). Then, the program analysis apparatus 1 extracts executable paths by executing symbolically the restoration program while controlling branch selection and backtracking based on the fixed selection information (step S5). Then, the program analysis apparatus 1 outputs the logic table 4 for the extracted path (step S6).

  Thus, the program analysis apparatus 1 can enable symbolic execution by restoring the program obtained by program slicing. Moreover, the program analysis apparatus 1 can prevent extraction of a path that does not pass through the slicing base point 3 by creating fixed selection information and controlling symbolic execution based on the fixed selection information.

  FIG. 10 is a flowchart showing the flow of the program slicing process. Note that the processing in FIG. 10 corresponds to the processing in step S2 shown in FIG. As shown in FIG. 10, the slicing unit 11 parses (syntactically analyzes) the program 2 and constructs a structural tree (step S11).

  Then, the slicing unit 11 constructs a control dependency relationship and a data dependency relationship between the command statements in the structure tree (step S12), traces the control dependency relationship and the data dependency relationship from the slicing base point 3, and determines the intermediate command statement. Collect (step S13). Then, the slicing unit 11 stores the collected command statements in the command statement list storage unit 12 (step S14).

  As described above, the slicing unit 11 slicing the program 2 based on the slicing base point 3 can prevent path explosion caused by symbolic execution.

  FIG. 11 is a flowchart showing a flow of processing for restoring a program. The process of FIG. 11 corresponds to the process of step S3 shown in FIG. As illustrated in FIG. 11, the restoration unit 13 sequentially reads one command statement from the command statement list storage unit 12 (step S21), and determines whether there is an unprocessed command statement (step S22).

  If there is an unprocessed command statement, the restoration unit 13 determines whether the command statement is a conditional branch statement (step S23). If the command statement is not a conditional branch statement, the restoration unit 13 returns to step S21. . On the other hand, when the command statement is a conditional branch statement, the restoration unit 13 determines whether there is a command statement effective for branching the conditional branch statement (step S24), and the command effective for branching the conditional branch statement. If there is a sentence, the process returns to step S21.

  On the other hand, when there is no command statement effective for branching the conditional branch statement, the restoration unit 13 adds a dummy command statement to the addition list (step S25), and the process returns to step S21. If there is no unprocessed command statement in step S22, the restoration unit 13 restores an executable program from the command statement list and the additional list (step S26).

  As described above, the restoring unit 13 can restore an executable program by adding a dummy command statement when there is no command statement effective for branching a conditional branch statement.

  FIG. 12 is a flowchart illustrating a flow of processing for performing branch setting. The process of FIG. 12 corresponds to the process of step S4 shown in FIG. As shown in FIG. 12, the branch setting unit 16 receives the program 2 and the slicing base point 3, and receives the control dependency from the slicing unit 11 (step S31).

  Then, the branch setting unit 16 performs fixed branch analysis processing for analyzing and setting the fixed branch using the instruction sentence of the slicing base point 3 as the designated instruction sentence (step S32), and obtains the conditional branch sentence and branch information of the fixed selection. The data is transferred to the branch control unit 17 (step S33).

  Further, in the fixed branch analysis process, the branch setting unit 16 traces the control dependency relationship from the specified command statement, and acquires the previous command statement in the control dependency relationship (step S41). The branch setting unit 16 determines whether there is a command statement and a conditional branch statement (step S42). If there is no command statement, or if it is not a conditional branch statement, the fixed branch analysis is performed. The process ends.

On the other hand, when there is a command statement and a conditional branch statement, the branch setting unit 16 branches the branch B _i of the conditional branch statement C (i = 1, 2,..., N: N is the number of branches). And i = 1 is set (step S43). Then, the branch setting unit 16 determines whether i is equal to or less than N (step S44). If i is not equal to or less than N, the fixed branch analysis process ends.

On the other hand, if i is N or less, the branch setting unit 16 determines whether or not the designated command statement is in the branch B _i (step S45), and if the designated command statement is in the branch B _i , The branch B _i of the conditional branch sentence C is set as a fixed branch (step S46). Then, the branch setting unit 16 performs a fixed branch analysis process using the conditional branch sentence C as the designated instruction sentence (step S47), adds 1 to i (step S48), and returns to step S44. If the specified command statement is not in the branch B _i at step S45, 1 is added to i (step S48), and the process returns to step S44.

  In this way, the branch setting unit 16 can create fixed selection information by recursively calling the fixed branch analysis process. The reason why the fixed branch analysis process is called recursively is to support the nested structure of conditional branch statements. FIG. 13 is a diagram showing a program 2 having a conditional branch statement with a nested structure and a control dependency relationship, and FIG. 14 is a diagram showing an example of fixed selection information created from the program 2 shown in FIG.

  As shown in FIG. 13, for example, the COMPUTE statement on the 21st line is control-dependent on the IF statement on the 20th line, and the IF statement on the 20th line is control-dependent on the IF statement on the 10th line. Therefore, if the COMPUTE statement on line 21 and the variable X are slicing base point 3, as shown in FIG. 14, the fixed selection information includes two sets of conditional branch statements and branches. Specifically, when the COMPUTE statement on the 21st line is a designated command statement, the IF statement on the 20th line is a conditional branch statement and the branch is a THEN branch, and the IF statement on the 20th line is a designated command statement. In such a case, a set including an IF statement on the 10th line as a conditional branch statement and a branch as an ELSE branch is included.

  The branch setting unit 16 creates this fixed selection information by the following processing procedure. First, the branch setting unit 16 receives the program 2 and the slicing base point 3 in step S31 of FIG. In step S32, the branch setting unit 16 calls the fixed branch analysis process using the COMPUTE statement on the 21st line as a designated command statement.

In step S41, the branch setting unit 16 traces control dependence and acquires the IF statement on the 20th line as a command statement. In step S42, the branch setting unit 16 determines whether the IF statement on the 20th line is a conditional branch statement. To do. Since the IF statement on the 20th line is a conditional branch statement, the branch setting unit 16 sets B ₁ as the THEN branch of the IF statement on the 20th line and B ₂ on the IF statement on the 20th line in step S43. Let ELSE branch.

Then, the branch setting unit 16, in step S45, COMPUTE statement in line 21 it is determined whether within B _1, since in the B _1, in step S46, the THEN branch of an IF statement in line 20 Set as fixed branch. In step S47, the branch setting unit 16 calls the fixed branch analysis process using the IF statement on the 20th line as the designated command statement.

In step S41, the branch setting unit 16 traces the control dependence and acquires the IF statement on the 10th line as a command statement. In step S42, the branch setting unit 16 determines whether the IF statement on the 10th line is a conditional branch statement. To do. Since the IF statement on the 10th line is a conditional branch statement, the branch setting unit 16 sets B ₁ as the THEN branch of the IF statement on the 10th line and B ₂ on the IF statement on the 10th line in step S43. Let ELSE branch.

Then, the branch setting unit 16, in step S45, IF statement in line 20 it is determined whether within B _1, since it is not in the B _1, at step S48, 1 is added to i, at step S45, iF statement of line 20 determines whether the inside B _2. Then, the branch setting unit 16, the IF statement of line 20 because it is in the B _2, in step S46, sets a fixed branch ELSE branch of an IF statement in line 10.

  Thereafter, the branch setting unit 16 ends the fixed branch analysis process in step S47 and ends the fixed branch analysis process in step S32. The branch setting unit 16 passes the fixed selection information to the branch control unit 17 in step S33.

  FIG. 15 is a flowchart illustrating a flow of processing for performing branch control. The process of FIG. 15 is included in the process of step S5 shown in FIG. As shown in FIG. 15, the branch control unit 17 determines whether or not a plurality of branches can be selected by the symbolic execution condition determination by the symbolic execution unit 15 for the conditional branch sentence included in the fixed selection information (step S51). .

  Then, when a plurality of branches can be selected, the branch control unit 17 selects a branch of the fixed selection information (step S52). When a plurality of branches cannot be selected, the branch to be selected is the fixed selection information. It is determined whether the branch is the same as (2). If the selected branch is the same as the branch of the fixed selection information, the branch control unit 17 selects the branch (step S54). If the selected branch is not the same as the branch of the fixed selection information, the branch control unit 17 executes symbolic execution. The backtrack is instructed to the unit 15 (step S55).

  In this way, the branch control unit 17 can prevent extraction of a path that does not pass through the slicing base point 3 by controlling the branch of symbolic execution based on the fixed selection information.

  Next, the effect of the program analysis apparatus 1 will be described with reference to FIGS. FIG. 16 is a diagram showing a result of symbolic execution of the program 2 shown in FIG. FIG. 16 shows a case where the program 2 is symbolically executed without program slicing. As shown in FIG. 16, when program slicing is not performed, nine paths are extracted by symbolic execution.

  FIG. 17 is a diagram showing the logic table 4 of the program 2 shown in FIG. 17A shows the logic table 4 related to the variable X, and FIG. 17B shows the logic table 4 related to the variable Y. That is, when program slicing is performed for the variable X and the slicing base point 3 does not depend on the conditional branch sentence, the logic table 4 shown in FIG. 17A is obtained. Further, when program slicing is performed on the variable Y and the slicing base point 3 does not depend on the conditional branch sentence, the logic table 4 shown in FIG. 17B is obtained.

  FIG. 18 and FIG. 19 are diagrams showing the results of symbolic execution by the program analysis apparatus 1. FIG. 18 shows the case of the slicing base point (23, X), and FIG. 19 shows the case of the slicing base point (25, X). As shown in FIGS. 18 and 19, the program analysis apparatus 1 can symbolically execute the slicing result.

  18 is compared with FIG. 16, the number of extracted paths is reduced from 9 to 2. 18 is compared with FIG. 6, it can be seen that the path # 3 that does not pass through the slicing base point (23, X) is not extracted. 18 and 19 are the same as the logic table 4 shown in FIG. 6, and it can be seen that the program analysis apparatus 1 creates the same logic table 4 as when no fixed selection information is used. .

  As described above, in the embodiment, the slicing unit 11 extracts a command statement from the program 2 based on the slicing base point 3, creates a command statement list, and stores it in the command statement list storage unit 12. Then, the restoring unit 13 reads the command statement list from the command statement list storage unit 12, restores an executable program, and stores it in the restored program storage unit 14. Then, the symbolic execution unit 15 reads the program from the restoration program storage unit 14 and executes it symbolically. Therefore, the program analysis apparatus 1 can symbolically execute a program obtained by program slicing.

  In the embodiment, the branch setting unit 16 creates fixed selection information and passes it to the branch control unit 17. When the symbolic execution unit 15 performs symbolic execution, the branch control unit 17 uses the unique selection information to perform symbolic execution. Control execution branching. Therefore, the program analysis apparatus 1 can prevent a path that does not pass through the slicing base point 3 from being extracted by symbolic execution.

  In the embodiment, the branch control unit 17 selects a branch included in the fixed selection information when the true / false value of the condition of the conditional branch statement is indefinite and a plurality of branches can be selected in symbolic execution. . In addition, the branch control unit 17 performs symbolic execution when the true / false value of the condition of the conditional branch statement is definite and the branch selected based on the true / false value is the same as the branch included in the fixed selection information. Selects a branch included in the fixed selection information. Further, the branch control unit 17, in the symbolic execution, when the truth value of the condition of the conditional branch statement is fixed, and the branch selected based on the truth value is different from the branch included in the fixed selection information, Instructs the symbolic execution unit 15 to backtrack. Therefore, the branch control unit 17 can control the symbolic execution so that a path that does not pass through the slicing base point 3 is not extracted.

  In the embodiment, when the slicing base point 3 is included in any branch of the conditional branch statement inside the nested conditional branch statement, the branch setting unit 16 recursively calls and fixes the fixed branch analysis process. Create selection information. Therefore, the program analysis apparatus 1 can prevent a path that does not pass the slicing base point 3 from being extracted by symbolic execution even for the program 2 in which the conditional branch statement has a nested structure.

  Further, in the embodiment, the restoration unit 13 determines whether there is a command statement that is valid for the branch of the conditional branch statement, and inserts a dummy command statement when there is no command statement that is valid for the branch of the conditional branch statement Thus, a program that can be executed symbolically can be restored.

  In addition, although the program analysis apparatus 1 was demonstrated in the Example, the program analysis program which has the same function can be obtained by implement | achieving the structure which the program analysis apparatus 1 has with software. A computer that executes the program analysis program will be described.

  FIG. 20 is a diagram illustrating a hardware configuration of a computer that executes the program analysis program according to the embodiment. As shown in FIG. 20, the computer 50 includes a main memory 51, a CPU (Central Processing Unit) 52, a LAN (Local Area Network) interface 53, and an HDD (Hard Disk Drive) 54. The computer 50 includes a super IO (Input Output) 55, a DVI (Digital Visual Interface) 56, and an ODD (Optical Disk Drive) 57.

  The main memory 51 is a memory for storing a program and a program execution result. The CPU 52 is a central processing unit that reads a program from the main memory 51 and executes it. The CPU 52 includes a chip set having a memory controller.

  The LAN interface 53 is an interface for connecting the computer 50 to another computer via a LAN. The HDD 54 is a disk device that stores programs and data, and the super IO 55 is an interface for connecting an input device such as a mouse or a keyboard. The DVI 56 is an interface for connecting a liquid crystal display device, and the ODD 57 is a device for reading / writing a DVD.

  The LAN interface 53 is connected to the CPU 52 by PCI Express (PCIe), and the HDD 54 and ODD 57 are connected to the CPU 52 by SATA (Serial Advanced Technology Attachment). The super IO 55 is connected to the CPU 52 by LPC (Low Pin Count).

  The program analysis program executed in the computer 50 is stored in the DVD, read from the DVD by the ODD 57, and installed in the computer 50. Alternatively, the program analysis program is stored in a database or the like of another computer system connected via the LAN interface 53, read from these databases, and installed in the computer 50. The installed program analysis program is stored in the HDD 54, read into the main memory 51, and executed by the CPU 52.

  In the embodiment, the case where the program 2 described in COBOL is targeted has been described. However, the present invention is not limited to this, and the case where the program described in another programming language is targeted. Can be applied similarly.

DESCRIPTION OF SYMBOLS 1 Program analyzer 2,91,92 Program 3 Slicing origin 4 Logic table 11 Slicing part 12 Command sentence list memory | storage part 13 Restoration part 14 Restoration program memory | storage part 15 Symbolic execution part 16 Branch setting part 17 Branch control part 50 Computer 51 Main memory 52 CPU
53 LAN interface 54 HDD
55 Super IO
56 DVI
57 ODD
93 Target program

Claims (7)

A slicing unit that extracts a statement that affects a slicing base point that specifies a statement and a variable in a program and creates a statement list;
A restoring unit that restores a program that can be symbolically executed using the statement list created by the slicing unit;
A program analysis apparatus comprising: a symbolic execution unit that symbolically executes the program restored by the restoration unit and outputs a logic table. It is determined whether or not the slicing base point is included in any branch of a conditional branch sentence. If included in any branch, the slicing base point is created as fixed selection information including information regarding the conditional branch sentence and the branch. A fixed selection information creation unit;
A branch control unit that controls a branch of symbolic execution based on the fixed selection information created by the fixed selection information creation unit when the program restored by the restoration unit is executed by the symbolic execution unit; The program analysis apparatus according to claim 1, further comprising:   In the symbolic execution, the branch control unit selects a branch included in the fixed selection information when the truth value of the condition of the conditional branch statement is indefinite and multiple branches can be selected, and the conditional branch When the true / false value of the sentence condition is definite and the branch selected based on the true / false value is the same as the branch included in the fixed selection information, the branch included in the fixed selection information is selected. When the true / false value of the condition of the conditional branch statement is definite and the branch selected based on the true / false value is different from the branch included in the fixed selection information, the symbolic execution unit is backtracked. The program analysis apparatus according to claim 2, wherein The fixed selection information creation unit, when the instruction statement specified by the slicing base point is included in any branch of the conditional branch statement inside the nested conditional branch statement, the outer and inner conditional branch statements Create fixed selection information including information about branching
4. The program analysis apparatus according to claim 2, wherein the branch control unit controls a plurality of branches of symbolic execution based on fixed selection information including information related to branching for the outer and inner conditional branch statements. .   The restoration unit determines whether there is a valid command statement for the branch of the conditional branch statement, and if there is no valid command statement for the branch of the conditional branch statement, symbolic execution is performed by inserting a dummy command statement. The program analysis apparatus according to claim 1, wherein a possible program is restored. Computer
Create a statement list by extracting statements that affect the slicing base point that specifies the statements and variables in the program,
Restore the program that can be executed symbolically using the created statement list,
A program analysis method characterized by executing a process of symbolically executing a restored program and outputting a logic table. On the computer,
Create a statement list by extracting statements that affect the slicing base point that specifies the statements and variables in the program,
Restore the program that can be executed symbolically using the created statement list,
A program analysis program characterized by executing a process of outputting a logic table by executing symbolically the restored program.

Images