WO2017128952A1 - 堆栈的保护方法及装置 - Google Patents

堆栈的保护方法及装置 Download PDF

Info

Publication number
WO2017128952A1
WO2017128952A1 PCT/CN2017/070868 CN2017070868W WO2017128952A1 WO 2017128952 A1 WO2017128952 A1 WO 2017128952A1 CN 2017070868 W CN2017070868 W CN 2017070868W WO 2017128952 A1 WO2017128952 A1 WO 2017128952A1
Authority
WO
WIPO (PCT)
Prior art keywords
stack
value
function
entities
entity
Prior art date
Application number
PCT/CN2017/070868
Other languages
English (en)
French (fr)
Inventor
刘雪峰
缪红保
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017128952A1 publication Critical patent/WO2017128952A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/36—Preventing errors by testing or debugging software
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/36—Preventing errors by testing or debugging software
    • G06F11/3604—Software analysis for verifying properties of programs
    • G06F11/3612—Software analysis for verifying properties of programs by runtime analysis

Definitions

  • the present invention relates to the field of computers, and in particular to a method and apparatus for protecting a stack.
  • the stack used by the program to run during the execution of the executable is an important resource. If the stack overflows, it will cause unpredictable and irreversible running exceptions. Therefore, the protection and detection technology of the stack is very important.
  • Dynamic detection is a method of stack overflow or early warning of overflow detection during the running of the program.
  • the stack size detection used for the maximum depth of the program has been directly and accurately determined.
  • the detection is lagging; and this detection can only solve the overflow part of the discovered fault, and there may be some undetectable parts that are not executed in the program.
  • Overflow hazard not an integrity check.
  • the invention patent of the application number: 200710003510.4 provides a method for dynamically detecting whether a stack is destroyed, and the method adopted is: inserting a pile in a function by a compiler, The stub function backs up the stack frame to the top of the stack, and determines whether the current stack frame is consistent in the pop function, thereby determining whether the task stack is destroyed.
  • static stack detection static detection mainly refers to the program is not detected before the deployment is run, so that no actual program deployment environment, only ordinary computers can be detected.
  • Common checks can be compiled with some compile options, but generally only at the function level, and not all compilers support; or use the massif subfunction like the Valgrind tool for stack analysis, but the focus is still on the stack memory footprint
  • stackAnalyzer the only commercially available analysis tool, stackAnalyzer, is the only one that can accurately analyze stack overflow.
  • This software is a commercial product that requires payment. The price is high, and its principle and accuracy cannot be estimated. There is not much application and guidance value.
  • the embodiment of the invention provides a method and a device for protecting a stack, so as to at least solve the detection lag caused by dynamic stack detection in the related art, and the analysis using static stack detection is a problem in stack memory occupation.
  • a method for protecting a stack including: obtaining an executable file a maximum stack value occupied by each function, wherein the executable file is configured with a plurality of threads, each thread having one or more entities for running the stack; and calculating the maximum stack value a maximum stack calculation value occupied by one or more entities; obtaining symbols for identifying the one or more entities, and respectively acquiring configuration values of the one or more entity stack configurations according to the symbols; When the configuration value is smaller than the calculated value, a comparison result of the configuration value and the calculated value is output.
  • the obtaining the maximum stack value occupied by each function in the executable file comprises: acquiring an assembly source corresponding to the executable file; scanning the assembly source to obtain an occupation of each function in the executable file. The maximum stack value.
  • calculating, according to the maximum stack value, a maximum stack calculation value respectively occupied by the one or more entities includes: searching for a calling relationship between the function and a sub-function in the executable file, and Constructing a function call tree according to the call relationship; traversing the function call tree respectively obtains a maximum stack calculation value occupied by the one or more entities on the function call tree.
  • obtaining a symbol for identifying the one or more entities includes: acquiring a symbol corresponding to the one or more entity definitions from a symbol table of the executable file; acquiring respectively according to the symbol
  • the configuration value of the one or more entity stack configurations includes: extracting a field size occupied by the symbol, and finding an entity corresponding to the field size according to the field size; extracting a configuration value of a stack configuration of the found entity .
  • a read-only memory area is configured between the plurality of the entities.
  • a protection device for a stack comprising: an obtaining module configured to obtain a maximum stack value occupied by each function in an executable file, wherein the executable file is configured with a plurality of threads, each thread having one or more entities for running the stack; a computing module configured to calculate a maximum stack calculation value occupied by the one or more entities according to the maximum stack value; a module, configured to obtain a symbol for identifying the one or more entities, and respectively obtain configuration values of the one or more entity stack configurations according to the symbols; and output modules configured to be smaller than the configured value When the value is calculated, a comparison result of the configuration value and the calculated value is output.
  • the obtaining module includes: a first acquiring unit, configured to acquire an assembly source corresponding to the executable file; and a scanning unit configured to scan the assembly source to obtain each function in the executable file The maximum stack value.
  • the calculating module includes: a first processing unit, configured to search a calling relationship between the function and the sub function in the executable file, and construct a function calling tree according to the calling relationship; traversing the unit, The method of traversing the function call tree respectively obtains a maximum stack calculation value occupied by the one or more entities on the function call tree.
  • the processing module includes: a second obtaining unit, configured to obtain a symbol corresponding to the one or more entity definitions from a symbol table of the executable file; and a second processing unit configured to extract The size of the field occupied by the symbol, and the entity corresponding to the size of the field is found according to the size of the field; and the extracting unit is configured to extract a configuration value of a stack configuration of the found entity.
  • a read-only memory area is configured between the plurality of the entities.
  • a storage medium is also provided.
  • the storage medium is arranged to store program code for performing the following steps:
  • Obtaining a maximum stack value occupied by each function in the executable file wherein the executable file is configured with multiple threads, and each thread has one or more entities for running the stack; according to the maximum stack Numerically calculating a maximum stack calculation value respectively occupied by the one or more entities; acquiring symbols for identifying the one or more entities, and respectively acquiring configurations of the one or more entity stack configurations according to the symbols a value; when the configuration value is less than the calculated value, outputting a comparison result of the configuration value and the calculated value.
  • the storage medium is further arranged to store program code for performing the following steps:
  • the storage medium is further arranged to store program code for performing the following steps:
  • the storage medium is further arranged to store program code for performing the following steps:
  • Obtaining a symbol for identifying the one or more entities includes: obtaining a symbol corresponding to the one or more entity definitions from a symbol table of the executable file;
  • Obtaining the configuration values of the one or more entity stack configurations according to the symbols includes: extracting a field size occupied by the symbols, and searching for an entity corresponding to the field size according to the field size; extracting the found The configuration value of the entity's stack configuration.
  • the maximum stack value occupied by each function in the executable file is obtained, and the maximum stack value is used to calculate the maximum stack calculation value occupied by one or more entities, and one or more
  • the configuration value of multiple entity stack configurations is compared to the calculated value and the configuration value to confirm whether there is an overflow risk. If the configuration value is less than the calculated value, the comparison result between the configured value and the calculated value is output, thereby solving the dynamics in the related art.
  • Stack detection leads to detection lag, while analysis using static stack detection is a problem in stack memory usage, which facilitates the detection of stack overflow.
  • FIG. 1 is a flow chart of a method of protecting a stack in accordance with an embodiment of the present invention
  • FIG. 2 is a block diagram showing the structure of a protection device for a stack according to an embodiment of the present invention
  • FIG. 3 is a block diagram 1 of an optional structure of a protection device for a stack according to an embodiment of the present invention
  • FIG. 4 is a block diagram 2 of an optional structure of a protection device for a stack according to an embodiment of the present invention
  • FIG. 5 is a block diagram 3 of an optional structure of a protection device for a stack according to an embodiment of the present invention.
  • FIG. 6 is a structural diagram of an own scheduling entity according to an alternative embodiment of the present invention.
  • FIG. 7 is a block diagram of a data structure of an own scheduling entity according to an alternative embodiment of the present invention.
  • FIG. 8 is a schematic diagram of a stack structure in accordance with an alternative embodiment of the present invention.
  • FIG. 9 is a flowchart of a method for operating an own scheduling entity according to an alternative embodiment of the present invention.
  • FIG. 10 is a flow diagram of a static stack detecting apparatus in accordance with an alternative embodiment of the present invention.
  • This embodiment adopts the executable file according to the executable program. (Executable and Linking Format, referred to as ELF) to obtain the corresponding assembly source code, scan assembly source code analysis to calculate the maximum stack occupancy of each function; in addition, in the design of the own scheduling entity from the ELF file symbol table scan to obtain each own scheduling The stack configuration value of the entity calculates the stack occupancy value of the maximum depth of the own scheduling entity according to the calling path from the entry. Then compare the stack configuration value of each own scheduling entity with the corresponding maximum stack occupancy calculation value. If the configuration value is less than the count value, there is an overflow risk, and the information of the overflow risk is output, thereby implementing a stack overflow for the own scheduling entity. Detection.
  • ELF Executable and Linking Format
  • FIG. 1 is a flowchart of a method for protecting a stack according to an embodiment of the present invention. As shown in FIG. 1, the process includes the following steps:
  • Step S102 Obtain a maximum stack value occupied by each function in the executable file, where multiple threads are configured in the executable file, and one or more entities for running the stack are hung under each thread;
  • Step S104 Calculate a maximum stack calculation value occupied by one or more entities according to the maximum stack value
  • Step S106 Acquire symbols for identifying one or more entities, and respectively acquire configuration values of one or more entity stack configurations according to the symbols;
  • Step S108 When the configuration value is less than the calculated value, the comparison result of the configuration value and the calculated value is output.
  • the maximum stack value occupied by each function in the executable file is obtained, and the maximum stack value is calculated by the maximum stack value.
  • a configuration value of one or more physical stack configurations can be obtained, and the calculated value and the configuration value are compared to confirm whether there is an overflow risk. If the configuration value is smaller than the calculated value, the output configuration value is compared with the calculated value, thereby
  • the related art adopts dynamic stack detection to cause detection lag, and the analysis using static stack detection is a problem in stack memory occupation, thereby conveniently and quickly detecting stack overflow.
  • Step S102-1 acquiring an assembly source corresponding to the executable file
  • Step S102-2 Scan the assembly source to obtain the maximum stack value occupied by each function in the executable file.
  • step S102-1 and step S102-2 in a specific application scenario, first, the objdump of each central processing unit (CPU) system is used to obtain the corresponding assembly source code from the executable ELF file, and study
  • CPU system X86 ⁇ ARM ⁇ PPC ⁇ MIPS, etc.
  • Step S104-1 searching for a calling relationship between a function and a sub-function in the executable file, and constructing a function calling tree according to the calling relationship;
  • Step S104-2 Traversing the function call tree respectively obtains the maximum stack calculation value occupied by one or more entities on the function call tree.
  • the function sub-function call relationship (including the function pointer, the recursion, and the ordinary sub-function) may be searched according to a function call instruction such as a call in the function. Corresponding recognition), and construct a function sub-function tree, and then traverse the function call tree from each Job entry function, accumulate and sort out the maximum stack calculation value of each Job call number, which is the calculated Job maximum. The stack occupies the calculated value.
  • the manner of obtaining the symbol corresponding to one or more entity definitions may be obtained from the symbol table of the executable file. symbol;
  • the method may be implemented by extracting the field size occupied by the symbols and searching for the field size according to the field size.
  • the entity corresponding to the field size extracts the configuration value of the stack configuration of the found entity.
  • the data structure of the entity may be used to define a global array symbol for each process entity, for example, named g_atJobRegTbl[], find the g_atJobRegTbl symbol in the symbol table and extract the occupied size field of the symbol in the ELF scan, and verify that the field is an integer multiple of the entity data structure in this embodiment, then the symbol is determined to be an entity.
  • the registry symbol and then extract the entity stack size field of each entity one by one, that is, get the stack configuration value of the corresponding entity.
  • a read-only memory area is configured between multiple entities in this embodiment, and the read-only memory area is used to reduce the mutual influence of stack overflow.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk,
  • the optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.
  • a protection device for the stack is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and will not be described again.
  • the term “module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • the device includes: an obtaining module 22 configured to obtain a maximum stack value occupied by each function in an executable file, where The execution file is configured with multiple threads, one or more entities for running the stack are hung under each thread; the calculation module 24 is coupled with the acquisition module 22 and configured to calculate one or more entities according to the maximum stack value.
  • the module 28 is coupled to the processing module 26 and configured to output a comparison result between the configured value and the calculated value when the configured value is less than the calculated value.
  • the obtaining module 22 includes: a first obtaining unit 32 configured to acquire an assembly source corresponding to an executable file;
  • the scanning unit 34 is coupled to the first obtaining unit 32 and configured to scan the assembly source to obtain the maximum stack value occupied by each function in the executable file.
  • the calculation module 24 includes: a first processing unit 42 configured to find functions and sub-functions in an executable file. Inter-call relationship, and constructor call tree according to the call relationship; traversal unit 44, coupled with the first processing unit 42, is set to traverse the function call tree to obtain the maximum stack calculation occupied by one or more entities on the function call tree respectively value.
  • FIG. 5 is a block diagram 3 of an optional structure of a protection device for a stack according to an embodiment of the present invention.
  • the processing module 26 includes: a second obtaining unit 52 configured to obtain from a symbol table of an executable file. One or more entities define corresponding symbols; the second processing unit 54 is coupled to the second obtaining unit 52, configured to extract the field size occupied by the symbols, and find an entity corresponding to the field size according to the field size; the extracting unit 56 And coupled to the second processing unit 54, configured to extract a configuration value of a stack configuration of the found entity.
  • a read-only memory area is configured between multiple entities involved in this embodiment.
  • each of the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the modules are located in multiple In the processor.
  • Executable program execution clues are mainly in the thread context.
  • the thread has its own running stack. When the function call is too deep or the local variable is too large, the allocated stack will be overflowed and an exception will be generated. Based on this optional implementation.
  • the example provides a self-owned scheduling entity stack protection method and a stack detecting device thereof, and designs a batch of scheduling management threads in the program, and also has its own scheduling entity under the management threads (corresponding to the above-mentioned in the embodiment) Entity), each entity is allocated a piece of heap memory, used as the running stack of the own scheduling entity, the stack size of each entity can specify the configuration.
  • the read-only memory area isolation protection is set between the own scheduling entities to reduce the mutual impact of stack overflow.
  • the function call stack after the entry of the own scheduling entity is designed to run on the heap memory allocated in this alternative embodiment.
  • the context of the home scheduling management thread is saved, and the stack is switched to its own.
  • the scheduling entity runs, and after the running of the own scheduling entity is completed, the scheduling management thread context is restored, and the scheduling management thread is switched back to run.
  • the detection process of the static stack detecting device is: obtaining the corresponding assembly source according to the executable program file ELF, scanning the assembly source code to calculate the maximum stack occupancy of each function, and constructing the relationship according to the instruction such as call.
  • the function sub-function calls the relation tree; in the design of the self-contained entity, it should consider how to obtain the stack configuration value of each own scheduling entity and the information of the own scheduling entity entry from the ELF file symbol table scan.
  • the stack occupancy value of the maximum depth of the own scheduling entity is calculated according to the calling path where the entry starts. Then compare the stack configuration value of each own scheduling entity with the corresponding maximum stack occupancy calculation value.
  • the optional embodiment implements stack overflow detection for the self-owned scheduling entity, and provides effective information for the code stack hidden danger and improved optimization.
  • the optional embodiment partially isolates the program part of the real service code operation; at the same time, by providing the static stack detection device, after the program version is compiled and generated, the detection device can be directly used to obtain the stack of the service code.
  • the detection device can be directly used to obtain the stack of the service code.
  • business coders can adjust the stack configuration according to the relevant output information before the product is released and can focus on optimizing some functions that occupy a large stack.
  • FIG. 6 is a diagram of an architecture of an own scheduling entity according to an alternative embodiment of the present invention.
  • an executable program execution thread is mainly in a thread context, and a batch of management management threads (such as ScheA ⁇ ScheB) are designed in the program. Under these management threads, the design in this alternative embodiment hangs its own scheduling entity (referred to as a Job in this alternative embodiment).
  • management management threads such as ScheA ⁇ ScheB
  • the entity data structure includes: a self-owned scheduling entity stack configuration value, an own scheduling entity entry, and an own scheduling entity stack.
  • FIG. 8 is a schematic diagram of a stack structure according to an alternative embodiment of the present invention.
  • the left side is a process address space of an executable program, and the address is from low to high, .text, .data, .bss, and heap.
  • Stack and other parts where the heap memory heap is allocated from low to high, the program runs the stack stack from high to low, and the operating system thread uses the stack of the stack portion.
  • the optional embodiment defines a Job configuration table global variable according to the data structure as shown in FIG. 8.
  • Each Job stack size can be configured.
  • the optional embodiment can be based on each The Job Stack Size configuration value allocates a chunk of memory from the heap and is used as the Job Run Stack.
  • the function entry of the job, the bottom pointer of the stack, the top pointer of the stack, etc. are all assigned at initialization time.
  • this alternative embodiment can extract this information from the ELF file analysis to aid in stack detection analysis.
  • protection page is added between the jobs for protection, and an exception is triggered when a stack overflow or other out of bounds occurs.
  • Small memory devices have memory footprint issues and should be designed as optional.
  • FIG. 9 is a flowchart of a method for operating an own scheduling entity according to an alternative embodiment of the present invention. As shown in FIG. 9, the steps of the method include:
  • Step S902 The scheduling task is pushed onto the stack and the important register data is stored
  • Step S904 The stack pointer points to the address of the Job stack to be run
  • Step S906 Run the Job
  • Step S908 the stack pointer points back to the task stack address
  • Step S910 popping the stack and writing back the important register data.
  • the schedule management thread context When running to a Job entry, the schedule management thread context is saved, the stack is switched to the own scheduling entity, that is, the Job is running, and the running completion switching is returned to the scheduling management thread. Therefore, the size of the business code stack is in the current Job's own stack portion, which does not affect the stack of the main and dispatch management threads, and acts as an isolation.
  • the detecting device detecting process includes:
  • Step S1002 Acquire an assembly source code
  • the objdump of each CPU system is used to obtain the corresponding assembly source code from the executable ELF file;
  • Step S1004 Calculate a maximum stack occupation of each function
  • the scan function assembles the instruction, analyzes whether the stack is occupied according to the characteristics of the instruction, and performs an accumulation calculation.
  • the func_stack_size size is the calculated value of each function stack in the method:
  • Push_ebp REG_SIZE// The first is to increase the value when the push command is used
  • Add_stack Assembly uses the "add negative sp" to allocate the calculation of the local variable space
  • Cur_stack xxx//Search for sub xxx for the first time, extract xxx when esp, only count once;
  • Pop_stack Each REG_SIZE accumulates //pop, popl, popa, popad and other related instructions, and does not exceed (REG_NUM*REG_SIZE+REG_SIZE).
  • Step S1006 Scan each line of each function to compile the source code, and analyze the exact stack occupancy size of each function according to the characteristics of each CPU system;
  • Step S1008 constructor call tree
  • the function sub-function call relationship (including function pointer, recursion and ordinary sub-function are identified accordingly), and the function sub-function tree is constructed, and the function starting at the job entry is calculated. Used when calling the maximum depth.
  • Step S1010 Acquire a job stack configuration value and a calculated value
  • the encoding uses the structure of FIG. 7 to define a global array symbol for each process's Job entity, such as g_atJobRegTbl[], and finds the g_atJobRegTbl symbol from the symbol table during ELF scanning and compares the extracted occupied symbols.
  • the size field verify that the field is an integer multiple of the data structure of Figure 7, it can be judged that the symbol is a Job registry symbol, and then extract the Job stack size field of each Job one by one, that is, obtain the stack configuration value of the corresponding Job;
  • the function call tree is traversed from each Job entry function, and the maximum stack calculation value of each Job call number is accumulated and sorted, which is the calculated maximum stack occupation calculation value of the Job. Comparing each Job stack configuration value with the calculated value indicates that there is a stack overflow risk when there is a Job configuration value less than the corresponding calculated value.
  • the processing of the function pointer the assembly can not know which callback function is used specifically, select the largest one of the callback function path;
  • Recursive processing The number of recursions cannot be recognized in the assembly.
  • This alternative embodiment provides that each recursive function is calculated M times by default in the first detection, and the recursive functions are all output to the recursive function statistics file. If the user needs a more accurate calculation of the number of times, the number of times to be calculated is configured according to the characteristics of each recursive function to the configuration file, and then the detection program reads the number of times of each recursive function of the configuration file for the next detection;
  • Step S1012 information output
  • Step S1014 running the detecting device
  • the program version is compiled and generated, the actual running environment is not required to be deployed, and the detection process and the program to be tested can be directly used to execute the detection process steps described above, and the stack overflow risk risk of the output service code is output after the detection is completed, and Based on the input information, you can easily see how to adjust the stack configuration and which function code is the key optimization method.
  • the service code running stack is safely isolated, and the detection device detection process provided by the alternative embodiment can be fully automated, and stack-related faults can be corrected in the product iteration process. Greatly reduce product development costs and operational risks.
  • Embodiments of the present invention also provide a storage medium.
  • the foregoing storage medium may be configured to store program code for performing the following steps:
  • S1 Get the maximum stack value occupied by each function in the executable file, wherein the executable file is configured with multiple threads, and each thread has one or more entities for running the stack;
  • S2 Calculate the maximum stack calculation value occupied by one or more entities according to the maximum stack value
  • S3 obtaining a symbol for identifying one or more entities, and respectively acquiring configuration values of one or more entity stack configurations according to the symbol;
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • the maximum stack value occupied by each function in the executable file is obtained, and the maximum stack value is used to calculate the maximum stack calculation value occupied by one or more entities, and one or more
  • the configuration value of multiple entity stack configurations is compared to the calculated value and the configuration value to confirm whether there is an overflow risk. If the configuration value is less than the calculated value, the comparison result between the configured value and the calculated value is output, thereby solving the dynamics in the related art.
  • Stack detection leads to detection lag, while analysis using static stack detection is a problem in stack memory usage, which facilitates the detection of stack overflow.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Quality & Reliability (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Stored Programmes (AREA)

Abstract

本发明提供了一种堆栈的保护方法及装置，其中，该方法包括：获取可执行文件中每个函数占用的最大堆栈数值，其中，可执行文件中配置有多个线程，每个线程下挂有一个或多个用于运行堆栈的实体；依据最大堆栈数值计算出一个或多个实体分别占用的最大堆栈计算值；获取用于标识一个或多个实体的符号，并依据符号分别获取一个或多个实体堆栈配置的配置值；在配置值小于计算值时，输出配置值与计算值的比较结果。通过本发明，解决了相关技术中采用动态堆栈检测导致检测滞后，而采用静态堆栈检测的分析是在堆栈内存占用方面的问题，从而方便快捷的实现了对堆栈溢出的检测。

Description

堆栈的保护方法及装置 技术领域
本发明涉及计算机领域，具体而言，涉及一种堆栈的保护方法及装置。
背景技术
在可执行程序运行过程中，程序运行所使用的堆栈是一种很重要的资源，如果堆栈溢出，将会带来不可预期、无法挽回的运行异常。因此，对堆栈的保护和检测技术就显得相当重要。
目前，在堆栈检测方面，相关技术中采用以下两种方式进行堆栈检测：
1、动态堆栈检测：动态检测是在程序运行过程中采取一定的手段进行堆栈溢出或者即将溢出预警检测，对程序已经运行到的最大深度所用的堆栈大小检测是直接准确的。但如果一旦发现了溢出，往往需要更换新的程序版本进行解决，即检测是滞后的；并且这种检测只能解决被发现故障的溢出部分，还可能存在程序里没有执行到的一些不能发现的溢出隐患，不是完整性检查。
例如，申请号为：200710003510.4的发明专利《一种检测堆栈帧破坏的方法》提供了一种动态检测堆栈是否被破坏的方法，其采用的手段是：通过编译器在函数中插桩，在入桩函数将堆栈帧备份到栈顶，在出桩函数中判断当前堆栈帧是否一致，从而判定任务堆栈是否被破坏。类似的动态检测方案：最大的问题就是滞后，即版本已经正式环境运行产生溢出了才能知道存在溢出。
2、静态堆栈检测：静态检测主要指程序还没有部署运行时就提前对其进行检测，这样无需实际程序部署环境，只需要普通的电脑就能进行检测。常见的检查手段：可以在编译使用一些编译选项检查，但一般是只是函数级别，并且不是所有编译器都支持；或者使用类似Valgrind工具的massif子功能进行堆栈分析，但其重点还是在堆栈内存占用方面，对堆栈溢出帮助甚微；唯一可能可以准确分析堆栈溢出的是一款商用分析工具stackAnalyzer。这款软件是一个需要付费的商用产品，价格较高，无法对其原理、准确性等进行估用，没有太多应用和指导价值。
针对相关技术中采用动态堆栈检测导致检测滞后，而采用静态堆栈检测的分析是在堆栈内存占用方面的问题，目前尚未存在有效的解决方案。
发明内容
本发明实施例提供了一种堆栈的保护方法及装置，以至少解决相关技术中采用动态堆栈检测导致检测滞后，而采用静态堆栈检测的分析是在堆栈内存占用方面的问题。
根据本发明实施例的一个方面，提供了一种堆栈的保护方法，包括：获取可执行文件中 每个函数占用的最大堆栈数值，其中，所述可执行文件中配置有多个线程，每个线程下挂有一个或多个用于运行堆栈的实体；依据所述最大堆栈数值计算出所述一个或多个实体分别占用的最大堆栈计算值；获取用于标识所述一个或多个实体的符号，并依据所述符号分别获取所述一个或多个实体堆栈配置的配置值；在所述配置值小于所述计算值时，输出所述配置值与所述计算值的比较结果。
可选地，所述获取可执行文件中每个函数占用的最大堆栈数值包括：获取与所述可执行文件对应的汇编源码；扫描所述汇编源码得到所述可执行文件中每个函数占用的所述最大堆栈数值。
可选地，所述依据所述最大堆栈数值计算出所述一个或多个实体分别占用的最大堆栈计算值包括：查找所述可执行文件中所述函数与子函数之间的调用关系，并依据所述调用关系构造函数调用树；遍历所述函数调用树分别得到所述一个或多个实体在所述函数调用树上占用的最大堆栈计算值。
可选地，获取用于标识所述一个或多个实体的符号包括：从所述可执行文件的符号表中获取与所述一个或多个实体定义对应的符号；依据所述符号分别获取所述一个或多个实体堆栈配置的配置值包括：提取所述符号占用的字段大小，并依据所述字段大小查找到与所述字段大小对应的实体；提取查找到的实体的堆栈配置的配置值。
可选地，多个所述实体之间配置有只读内存区域。
根据本发明实施例的另一个方面，提供了一种堆栈的保护装置，包括：获取模块，设置为获取可执行文件中每个函数占用的最大堆栈数值，其中，所述可执行文件中配置有多个线程，每个线程下挂有一个或多个用于运行堆栈的实体；计算模块，设置为依据所述最大堆栈数值计算出所述一个或多个实体分别占用的最大堆栈计算值；处理模块，设置为获取用于标识所述一个或多个实体的符号，并依据所述符号分别获取所述一个或多个实体堆栈配置的配置值；输出模块，设置为在所述配置值小于所述计算值时，输出所述配置值与所述计算值的比较结果。
可选地，所述获取模块包括：第一获取单元，设置为获取与所述可执行文件对应的汇编源码；扫描单元，设置为扫描所述汇编源码得到所述可执行文件中每个函数占用的所述最大堆栈数值。
可选地，所述计算模块包括：第一处理单元，设置为查找所述可执行文件中所述函数与子函数之间的调用关系，并依据所述调用关系构造函数调用树；遍历单元，设置为遍历所述函数调用树分别得到所述一个或多个实体在所述函数调用树上占用的最大堆栈计算值。
可选地，所述处理模块包括：第二获取单元，设置为从所述可执行文件的符号表中获取与所述一个或多个实体定义对应的符号；第二处理单元，设置为提取所述符号占用的字段大小，并依据所述字段大小查找到与所述字段大小对应的实体；提取单元，设置为提取查找到的实体的堆栈配置的配置值。
可选地，多个所述实体之间配置有只读内存区域。
根据本发明的又一个实施例，还提供了一种存储介质。该存储介质设置为存储用于执行以下步骤的程序代码：
获取可执行文件中每个函数占用的最大堆栈数值，其中，所述可执行文件中配置有多个线程，每个线程下挂有一个或多个用于运行堆栈的实体；依据所述最大堆栈数值计算出所述一个或多个实体分别占用的最大堆栈计算值；获取用于标识所述一个或多个实体的符号，并依据所述符号分别获取所述一个或多个实体堆栈配置的配置值；在所述配置值小于所述计算值时，输出所述配置值与所述计算值的比较结果。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：
获取与所述可执行文件对应的汇编源码；扫描所述汇编源码得到所述可执行文件中每个函数占用的所述最大堆栈数值。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：
查找所述可执行文件中所述函数与子函数之间的调用关系，并依据所述调用关系构造函数调用树；遍历所述函数调用树分别得到所述一个或多个实体在所述函数调用树上占用的最大堆栈计算值。
可选地，存储介质还设置为存储用于执行以下步骤的程序代码：
获取用于标识所述一个或多个实体的符号包括：从所述可执行文件的符号表中获取与所述一个或多个实体定义对应的符号；
依据所述符号分别获取所述一个或多个实体堆栈配置的配置值包括：提取所述符号占用的字段大小，并依据所述字段大小查找到与所述字段大小对应的实体；提取查找到的实体的堆栈配置的配置值。
在本发明实施例中，采用获取可执行文件中每个函数占用的最大堆栈数值，进而以及该最大堆栈数值计算出一个或多个实体分别占用的最大堆栈计算值，此外还能获取到一个或多个实体堆栈配置的配置值，通过比较该计算值和配置值，确认是否存在溢出风险，如果配置值小于计算值，则输出配置值与计算值的比较结果，从而解决了相关技术中采用动态堆栈检测导致检测滞后，而采用静态堆栈检测的分析是在堆栈内存占用方面的问题，从而方便快捷的实现了对堆栈溢出的检测。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是根据本发明实施例的堆栈的保护方法的流程图；
图2是根据本发明实施例的堆栈的保护装置的结构框图；
图3是根据本发明实施例的堆栈的保护装置的可选结构框图一；
图4是根据本发明实施例的堆栈的保护装置的可选结构框图二；
图5是根据本发明实施例的堆栈的保护装置的可选结构框图三；
图6是根据本发明可选实施例的自有调度实体架构图；
图7是根据本发明可选实施例的自有调度实体数据结构框图；
图8是根据本发明可选实施例的堆栈结构示意图；
图9是根据本发明可选实施例的自有调度实体运行方法的流程图；
图10是根据本发明可选实施例的静态堆栈检测装置流程示意图。
具体实施方式
本实施例技术方案的功能概述：在相关技术中当函数调用过深或局部变量过大等情况导致占用堆栈过多时分配的堆栈会被溢出，产生异常，本实施例采用了根据可执行程序文件(Executable and Linking Format，简称为ELF)获得对应的汇编源码，扫描汇编源码分析计算出每个函数最大堆栈占用；另外，在自有调度实体设计时从ELF文件符号表扫描获得每个自有调度实体的堆栈配置值，根据入口开始的调用路径计算出自有调度实体最大深度的堆栈占用值。然后比较各个自有调度实体的堆栈配置值与对应最大堆栈占用计算值，如果配置值小于计数值，则存在溢出风险，并输出该溢出风险的信息，从而实现了对自有调度实体的堆栈溢出检测。
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
在本实施例中提供了一种堆栈的保护方法，图1是根据本发明实施例的堆栈的保护方法的流程图，如图1所示，该流程包括如下步骤：
步骤S102：获取可执行文件中每个函数占用的最大堆栈数值，其中，可执行文件中配置有多个线程，每个线程下挂有一个或多个用于运行堆栈的实体；
步骤S104：依据最大堆栈数值计算出一个或多个实体分别占用的最大堆栈计算值；
步骤S106：获取用于标识一个或多个实体的符号，并依据符号分别获取一个或多个实体堆栈配置的配置值；
步骤S108：在配置值小于计算值时，输出配置值与计算值的比较结果。
通过上述步骤S102至步骤S108可知，在本实施例中采用获取可执行文件中每个函数占用的最大堆栈数值，进而以及该最大堆栈数值计算出一个或多个实体分别占用的最大堆栈计算值，此外还能获取到一个或多个实体堆栈配置的配置值，通过比较该计算值和配置值，确认是否存在溢出风险，如果配置值小于计算值，则输出配置值与计算值的比较结果，从而解决了相关技术中采用动态堆栈检测导致检测滞后，而采用静态堆栈检测的分析是在堆栈内存占用方面的问题，从而方便快捷的实现了对堆栈溢出的检测。
对于本实施例中步骤S102中涉及到的获取可执行文件中每个函数占用的最大堆栈数值的方式，在本实施例的可选实施方式中，可以通过如下方式来实现：
步骤S102-1：获取与可执行文件对应的汇编源码；
步骤S102-2：扫描汇编源码得到可执行文件中每个函数占用的最大堆栈数值。
对于上述步骤S102-1和步骤S102-2，在具体应用场景中可以是：首先利用各中央处理器(Central Processing Unit，简称为CPU)体系的objdump从可执行ELF文件获取对应的汇编源码，研究各CPU体系(X86\ARM\PPC\MIPS等)汇编源码及堆栈结构特点，分析每个函数在其CPU体系上的准确堆栈占用方式，也就是说，扫描每个函数的每一行汇编源码，并根据每个CPU体系特点分析出每个函数准确的堆栈占用大小，从而得到每个函数占用最大堆栈数值。
对于本实施例中步骤S104中涉及到的依据最大堆栈数值计算出一个或多个实体分别占用的最大堆栈计算值的方式，在本实施例的可选实施方式中，可以通过如下方式来实现：
步骤S104-1：查找可执行文件中函数与子函数之间的调用关系，并依据调用关系构造函数调用树；
步骤S104-2：遍历函数调用树分别得到一个或多个实体在函数调用树上占用的最大堆栈计算值。
对于上述步骤S104-1和步骤S104-2在本实施的具体应用场景中可以是：根据函数里的call等函数调用指令，搜寻出函数子函数调用关系(包括函数指针、递归和普通子函数都进行相应的识别)，并构建函数子函数树，进而从每个Job入口函数开始遍历函数调用树，累加、排序出每个Job调用数上最大栈计算值，该值即为计算出的Job最大堆栈占用计算值。
对于本实施例中步骤S106中涉及到的获取用于标识一个或多个实体的符号的方式，可以通过如下方式来实现：从可执行文件的符号表中获取与一个或多个实体定义对应的符号；
而对于本实施例中步骤S106中涉及到的依据符号分别获取一个或多个实体堆栈配置的配置值的方式，可以通过如下方式来实现：提取符号占用的字段大小，并依据字段大小查找到与字段大小对应的实体；提取查找到的实体的堆栈配置的配置值。
而对于本实施例步骤S106中涉及到的方式，在本实施例的具体应用场景中可以是：编码时利用实体的数据结构为每个进程的实体定义一个全局数组符号，比如命名为 g_atJobRegTbl[]，在ELF的扫描时从符号表里找到g_atJobRegTbl符号并提取出的该符号的占用的大小字段，校验该字段是本实施例中实体数据结构整数倍，则可判断该符号是实体注册表符号，然后逐一提取每个实体的实体堆栈大小字段，即获取到了对应实体的堆栈配置值。
此外，需要说明的是，本实施例中的多个实体之间配置有只读内存区域，该只读内存区域用于降低堆栈溢出的相互影响。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。
在本实施例中还提供了一种堆栈的保护装置，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图2是根据本发明实施例的堆栈的保护装置的结构框图，如图2所示，该装置包括：获取模块22，设置为获取可执行文件中每个函数占用的最大堆栈数值，其中，可执行文件中配置有多个线程，每个线程下挂有一个或多个用于运行堆栈的实体；计算模块24，与获取模块22耦合连接，设置为依据最大堆栈数值计算出一个或多个实体分别占用的最大堆栈计算值；处理模块26，与计算模块24耦合连接，设置为获取用于标识一个或多个实体的符号，并依据符号分别获取一个或多个实体堆栈配置的配置值；输出模块28，与处理模块26耦合连接，设置为在配置值小于计算值时，输出配置值与计算值的比较结果。
图3是根据本发明实施例的堆栈的保护装置的可选结构框图一，如图3所示，该获取模块22包括：第一获取单元32，设置为获取与可执行文件对应的汇编源码；扫描单元34，与第一获取单元32耦合连接，设置为扫描汇编源码得到可执行文件中每个函数占用的最大堆栈数值。
图4是根据本发明实施例的堆栈的保护装置的可选结构框图二，如图4所示，该计算模块24包括：第一处理单元42，设置为查找可执行文件中函数与子函数之间的调用关系，并依据调用关系构造函数调用树；遍历单元44，与第一处理单元42耦合连接，设置为遍历函数调用树分别得到一个或多个实体在函数调用树上占用的最大堆栈计算值。
图5是根据本发明实施例的堆栈的保护装置的可选结构框图三，如图5所示，该处理模块26包括：第二获取单元52，设置为从可执行文件的符号表中获取与一个或多个实体定义对应的符号；第二处理单元54，与第二获取单元52耦合连接，设置为提取符号占用的字段大小，并依据字段大小查找到与字段大小对应的实体；提取单元56，与第二处理单元54耦合连接，设置为提取查找到的实体的堆栈配置的配置值。
可选地，本实施例中涉及到的多个实体之间配置有只读内存区域。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述模块分别位于多个处理器中。
下面结合本发明的可选实施例对本发明进行举例说明；
可执行程序执行线索主要在线程上下文，线程有自己的运行堆栈，当函数调用过深或局部变量过大等情况导致占用堆栈过多时分配的堆栈会被溢出，产生异常；基于此本可选实施例提供了一种自有调度实体堆栈保护方法及其堆栈检测装置，在程序中设计一批调度管理线程，在这些管理线程下还下挂有自有调度实体(对应于本实施例中上述的实体)，给每个实体分配一段堆内存，用作该自有调度实体运行堆栈，每个实体的堆栈大小可指定配置。同时，在自有调度实体间设置只读内存区域隔离保护，降低堆栈溢出的相互影响。自有调度实体入口之后的函数调用堆栈都设计在本可选实施例中分配的堆内存上运行，当运行到某自有调度实体入口时，保存其归属调度管理线程上下文，堆栈切换到自有调度实体运行，自有调度实体运行完成后，恢复调度管理线程上下文，切换回调度管理线程运行。
此外，本可选实施例中静态堆栈检测装置的检测流程为：根据可执行程序文件ELF获得对应的汇编源码，扫描汇编源码分析计算出每个函数最大堆栈占用，同时根据call等指令调用关系构建函数子函数调用关系树；在自有调度实体设计时应考虑如何能从ELF文件符号表扫描获得每个自有调度实体的堆栈配置值、自有调度实体入口等信息。根据入口开始的调用路径计算出自有调度实体最大深度的堆栈占用值。然后比较各个自有调度实体的堆栈配置值与对应最大堆栈占用计算值，如果配置值小于计数值，则存在溢出风险，对存在溢出风险的自有调度实体信息和其他有用信息输出到一些指定文件。从而本可选实施例实现了对自有调度实体的堆栈溢出检测，对代码堆栈隐患和改进优化提供了有效信息。
可见，本可选实施例把真正业务编码运行的程序部分进行了隔离保护；同时，通过提供的静态堆栈检测装置，在程序版本编译生成后，直接使用该检测装置即可得到业务代码存在的堆栈溢出风险隐患，业务编码者则可根据相关输出信息在产品发布前就能合理调整堆栈配置并能有针对性的重点优化一些堆栈占用较大的函数等。
下面结合附图说明本可选实施例所采用的实施方法：
图6是根据本发明可选实施例的自有调度实体架构图，如图6所示，可执行程序执行线索主要在线程上下文，在程序中设计一批管理管理线程(如ScheA\ScheB)，在这些管理线程下，本可选实施例中的设计下挂有自有调度实体(在本可选实施例中称之为Job)。
图7是根据本发明可选实施例的自有调度实体数据结构框图，如图7所示，该实体数据结构包括：自有调度实体堆栈配置值、自有调度实体入口、自有调度实体栈顶指针、自有调度实体栈底指针、自有调度实体归属调度管理线程栈顶指针等；其中，a、堆栈配置值，自有调度实体入口在静态堆栈检测装置的ELF扫描时会用到；b、自有调度实体栈顶指针、自有调 度实体栈底指针、自有调度实体归属调度管理线程栈顶指针等在堆栈运行切换时使用到。
图8是根据本发明可选实施例的堆栈结构示意图，如图8所示，左边是一个可执行程序的进程地址空间，地址从低到高分别为.text，.data，.bss，heap，stack等部分；其中，堆内存heap从低往高分配，程序运行堆栈stack从高往低走，操作系统线程使用stack部分的堆栈。
在一个可执行程序进程中本可选实施例根据形如图8的数据结构定义一个Job配置表全局变量，每个Job堆栈大小可指定配置，上电初始化时，本可选实施例可以根据每个Job堆栈大小配置值从heap里分配一段堆内存，用作该Job运行堆栈。Job的函数入口，栈底指针，栈顶指针等都在初始化时进行了赋值。在后面堆栈检测装置，本可选实施例可以从ELF文件分析时提取出来这些信息帮助堆栈检测分析。
需要说明的是，Job间增加保护页进行保护，当发生栈溢出或其他越界时触发异常。小内存设备会存在内存占用问题，应设计为可选配。
图9是根据本发明可选实施例的自有调度实体运行方法的流程图，如图9所示，该方法的步骤包括：
步骤S902：调度任务压栈并存重要寄存器数据；
步骤S904：堆栈指针指向待运行Job堆栈地址；
步骤S906：运行Job；
步骤S908：堆栈指针指回任务堆栈地址；
步骤S910：出栈并写回重要寄存器数据。
当运行到某Job入口时，保存调度管理线程上下文，堆栈切换到自有调度实体即Job运行，运行完成切换回归属调度管理线程。因此，业务代码堆栈占用大小都在当前Job自己的堆栈部分，不会对main、调度管理线程的堆栈产生影响，起到了隔离作用。
图10是根据本发明可选实施例的静态堆栈检测装置流程示意图，如图10所示，该检测装置检测流程的步骤包括：
步骤S1002：获取汇编源码；
其中，利用各CPU体系的objdump从可执行ELF文件获取对应的汇编源码；
步骤S1004：计算每个函数最大堆栈占用；
其中，研究各CPU体系(X86\ARM\PPC\MIPS等)汇编源码及堆栈结构特点，分析每个函数在其CPU体系上的准确堆栈占用方法。也就是说，扫描函数汇编指令，根据指令特点分析是否占用堆栈，并进行累加计算。
以X86\X86_64体系函数最大栈计算方法为例，根据X86汇编源码指令分析和栈帧结构，提供了下计算方法：
#if(_CPU_TYPE＝＝_CPU_X86)
#define ASM_FLAG"elf32-i386"
#define REG_SIZE 4
#define REG_NUM 8
#define ESP"esp"
#elif(_CPU_TYPE＝＝_CPU_X86_64)
#define REG_SIZE 8
#define REG_NUM 12
#define ESP"rsp"
#endif
func_stack_size大小即方法中的每个函数栈的计算值：
func_stack_size＝push_ebp+push_ret+add_stack+cur_stack+pop_stack
说明：
push_ebp＝REG_SIZE//第一条是push指令时增加该值；
push_ret＝REG_SIZE//有子函数调用的计1次，只计1次；
add_stack＝汇编使用“add负数sp”分配局部变量空间的计算；
cur_stack＝xxx//第一次搜索到sub xxx，esp时提取出xxx，只计算一次；
pop_stack＝每次REG_SIZE累加//pop，popl，popa，popad等相关指令时累加，不超过(REG_NUM*REG_SIZE+REG_SIZE)。
步骤S1006：扫描每个函数的每一行汇编源码，并根据每个CPU体系特点分析出每个函数准确的堆栈占用大小；
其中，PPC\MIPS等CPU如果强制使用了-mlongcall支持了长跳转指令，仅仅根据静态汇编无法准确分析是函数指针还是普通子函数调用，因此在待分析的ELF文件编译时应去掉类似的编译选项提高准确性。
步骤S1008：构造函数调用树；
其中，根据函数里的call等函数调用指令，搜寻出函数子函数调用关系(包括函数指针、递归和普通子函数都进行相应的识别)，并构建函数子函数树，在计算Job入口开始的函数调用最大深度时使用。
步骤S1010：获取Job堆栈配置值和计算值；
其中，编码时利用图7结构为每个进程的Job实体定义一个全局数组符号，比如命名为g_atJobRegTbl[]，在ELF的扫描时从符号表里找到g_atJobRegTbl符号并比较提取出的该符号的占用的大小字段，校验该字段是图7数据结构整数倍，则可判断该符号是Job注册表符号，然后逐一提取每个Job的Job堆栈大小字段，即获取到了对应Job的堆栈配置值；同时，从每个Job入口函数开始遍历函数调用树，累加、排序出每个Job调用数上最大栈计算值，该值即为计算出的Job最大堆栈占用计算值。比较每个Job堆栈配置值和计算值，当存在Job配置值小于对应的计算值时说明存在堆栈溢出风险。
其中，a、对函数指针的处理：汇编里不能知道具体使用了哪个回调函数，选取回调函数路径里最大的一个；
b、对递归的处理：汇编里不能识别出递归的次数，本可选实施例提供了在第一次检测时每个递归函数默认计算M次，并把递归函数都输出到递归函数统计文件。如果用户需要更准确的次数计算，根据每个递归函数的特点配置需要计算的次数到配置文件，再执行下一次检测时检测程序会读取该配置文件的各个递归函数的次数进行计算；
步骤S1012：、信息输出；
其中，当存在比较的Job配置值小于对应的计算值时说明存在堆栈溢出风险，把他输出到指定文件供分析；同时还可以对所有函数堆栈占用进行排序、递归函数、函数指针等分析，也输出到指定文件，输出的这些信息可为溢出风险处理提供有效的改进参考数据。
步骤S1014：运行检测装置；
其中，当程序版本编译生成后，无需实际程序部署运行环境，直接使用检测装置和待检测版本程序分析即可执行前面描述的检测流程步骤，检测完成后输出业务代码存在的堆栈溢出风险隐患，并能根据输入信息很简单的查看到如何调整堆栈配置和以及哪些函数代码是需要重点优化的方法。
由本可选实施例可知，把业务代码运行堆栈进行了安全隔离，且本可选实施例提供的检测装置检测过程可以做到完全自动化，以及产品迭代过程中堆栈相关的故障能够第一时间得到纠正，极大的降低了产品开发成本和运行风险。
本发明的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
S1：获取可执行文件中每个函数占用的最大堆栈数值，其中，可执行文件中配置有多个线程，每个线程下挂有一个或多个用于运行堆栈的实体；
S2：依据最大堆栈数值计算出一个或多个实体分别占用的最大堆栈计算值；
S3：获取用于标识一个或多个实体的符号，并依据符号分别获取一个或多个实体堆栈配置的配置值；
S4：在配置值小于计算值时，输出配置值与计算值的比较结果。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
在本发明实施例中，采用获取可执行文件中每个函数占用的最大堆栈数值，进而以及该最大堆栈数值计算出一个或多个实体分别占用的最大堆栈计算值，此外还能获取到一个或多个实体堆栈配置的配置值，通过比较该计算值和配置值，确认是否存在溢出风险，如果配置值小于计算值，则输出配置值与计算值的比较结果，从而解决了相关技术中采用动态堆栈检测导致检测滞后，而采用静态堆栈检测的分析是在堆栈内存占用方面的问题，从而方便快捷的实现了对堆栈溢出的检测。

Claims (10)

  1. 一种堆栈的保护方法，包括：
    获取可执行文件中每个函数占用的最大堆栈数值，其中，所述可执行文件中配置有多个线程，每个线程下挂有一个或多个用于运行堆栈的实体；
    依据所述最大堆栈数值计算出所述一个或多个实体分别占用的最大堆栈计算值；
    获取用于标识所述一个或多个实体的符号，并依据所述符号分别获取所述一个或多个实体堆栈配置的配置值；
    在所述配置值小于所述计算值时，输出所述配置值与所述计算值的比较结果。
  2. 根据权利要求1所述的方法，其中，所述获取可执行文件中每个函数占用的最大堆栈数值包括：
    获取与所述可执行文件对应的汇编源码；
    扫描所述汇编源码得到所述可执行文件中每个函数占用的所述最大堆栈数值。
  3. 根据权利要求1所述的方法，其中，所述依据所述最大堆栈数值计算出所述一个或多个实体分别占用的最大堆栈计算值包括：
    查找所述可执行文件中所述函数与子函数之间的调用关系，并依据所述调用关系构造函数调用树；
    遍历所述函数调用树分别得到所述一个或多个实体在所述函数调用树上占用的最大堆栈计算值。
  4. 根据权利要求1所述的方法，其中，
    获取用于标识所述一个或多个实体的符号包括：从所述可执行文件的符号表中获取与所述一个或多个实体定义对应的符号；
    依据所述符号分别获取所述一个或多个实体堆栈配置的配置值包括：提取所述符号占用的字段大小，并依据所述字段大小查找到与所述字段大小对应的实体；提取查找到的实体的堆栈配置的配置值。
  5. 根据权利要求1至4任一项所述的方法，其中，多个所述实体之间配置有只读内存区域。
  6. 一种堆栈的保护装置，包括：
    获取模块，设置为获取可执行文件中每个函数占用的最大堆栈数值，其中，所述可执行文件中配置有多个线程，每个线程下挂有一个或多个用于运行堆栈的实体；
    计算模块，设置为依据所述最大堆栈数值计算出所述一个或多个实体分别占用的最大堆栈计算值；
    处理模块，设置为获取用于标识所述一个或多个实体的符号，并依据所述符号分别获取所述一个或多个实体堆栈配置的配置值；
    输出模块，设置为在所述配置值小于所述计算值时，输出所述配置值与所述计算值的比较结果。
  7. 根据权利要求6所述的装置，其中，所述获取模块包括：
    第一获取单元，设置为获取与所述可执行文件对应的汇编源码；
    扫描单元，设置为扫描所述汇编源码得到所述可执行文件中每个函数占用的所述最大堆栈数值。
  8. 根据权利要求6所述的装置，其中，所述计算模块包括：
    第一处理单元，设置为查找所述可执行文件中所述函数与子函数之间的调用关系，
    并依据所述调用关系构造函数调用树；
    遍历单元，设置为遍历所述函数调用树分别得到所述一个或多个实体在所述函数调用树上占用的最大堆栈计算值。
  9. 根据权利要求6所述的装置，其中，所述处理模块包括：
    第二获取单元，设置为从所述可执行文件的符号表中获取与所述一个或多个实体定义对应的符号；
    第二处理单元，设置为提取所述符号占用的字段大小，并依据所述字段大小查找到与所述字段大小对应的实体；
    提取单元，设置为提取查找到的实体的堆栈配置的配置值。
  10. 根据权利要求6至9任一项所述的装置，其中，多个所述实体之间配置有只读内存区域。
PCT/CN2017/070868 2016-01-28 2017-01-11 堆栈的保护方法及装置 WO2017128952A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610058946.2 2016-01-28
CN201610058946.2A CN107015904B (zh) 2016-01-28 2016-01-28 堆栈的保护方法及装置

Publications (1)

Publication Number Publication Date
WO2017128952A1 true WO2017128952A1 (zh) 2017-08-03

Family

ID=59397343

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/070868 WO2017128952A1 (zh) 2016-01-28 2017-01-11 堆栈的保护方法及装置

Country Status (2)

Country Link
CN (1) CN107015904B (zh)
WO (1) WO2017128952A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113312054A (zh) * 2021-05-27 2021-08-27 长沙海格北斗信息技术有限公司 针对嵌入式软件架构的软件栈消耗分析方法及分析装置

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107632936B (zh) * 2017-09-22 2020-08-18 迈普通信技术股份有限公司 堆栈保护方法及装置
CN110084042B (zh) * 2019-05-11 2021-07-30 佛山市微风科技有限公司 一种应用程序堆栈静态分析方法及系统
CN111061512B (zh) * 2019-12-06 2022-11-15 湖北文理学院 分支指令的处理方法、装置、设备和存储介质
CN111159051B (zh) * 2019-12-31 2023-07-04 北京天融信网络安全技术有限公司 死锁检测方法、装置、电子设备及可读存储介质
CN111273980B (zh) * 2020-01-14 2024-03-29 中国平安财产保险股份有限公司 界面线程可视化方法、装置、计算机设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101271408A (zh) * 2008-05-07 2008-09-24 浙江大学 在嵌入式系统中分析堆栈使用的方法
US20100131803A1 (en) * 2008-11-25 2010-05-27 Express Logic Computation of stack usage in embedded computing systems
CN101876923A (zh) * 2009-11-27 2010-11-03 中国科学院声学研究所 一种用于精确估计嵌入式系统中堆栈需求量的方法
CN102012833A (zh) * 2010-11-09 2011-04-13 北京神舟航天软件技术有限公司 基于编译过程中间结果的静态堆栈检测方法
CN102156630A (zh) * 2010-01-21 2011-08-17 微软公司 按线程按实例的数据存储

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080140979A1 (en) * 2006-12-12 2008-06-12 Kim Sang Cheol Method of allocating stack in multi-threaded sensor operating system environment
CN101833476B (zh) * 2010-05-28 2013-08-14 西安交通大学 基于cmp的推测多线程机制下的独立栈函数调用方法
CN104679645A (zh) * 2013-11-28 2015-06-03 中国航空工业集团公司航空动力控制系统研究所 一种栈空间余量实时检测方法
CN103745153B (zh) * 2013-12-30 2015-07-08 北京控制工程研究所 一种航天器软件空间使用安全性检查方法
CN103870244B (zh) * 2014-02-21 2017-01-11 北京神舟航天软件技术有限公司 一种sparc平台任务栈溢出检测算法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101271408A (zh) * 2008-05-07 2008-09-24 浙江大学 在嵌入式系统中分析堆栈使用的方法
US20100131803A1 (en) * 2008-11-25 2010-05-27 Express Logic Computation of stack usage in embedded computing systems
CN101876923A (zh) * 2009-11-27 2010-11-03 中国科学院声学研究所 一种用于精确估计嵌入式系统中堆栈需求量的方法
CN102156630A (zh) * 2010-01-21 2011-08-17 微软公司 按线程按实例的数据存储
CN102012833A (zh) * 2010-11-09 2011-04-13 北京神舟航天软件技术有限公司 基于编译过程中间结果的静态堆栈检测方法

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113312054A (zh) * 2021-05-27 2021-08-27 长沙海格北斗信息技术有限公司 针对嵌入式软件架构的软件栈消耗分析方法及分析装置

Also Published As

Publication number Publication date
CN107015904B (zh) 2022-04-19
CN107015904A (zh) 2017-08-04

Similar Documents

Publication Publication Date Title
WO2017128952A1 (zh) 堆栈的保护方法及装置
US8799878B2 (en) Multi level virtual function tables
US20130179863A1 (en) Bug variant detection using program analysis and pattern identification
CN106843840B (zh) 一种基于相似度分析的源代码版本演化注释复用方法
CN111104335B (zh) 一种基于多层次分析的c语言缺陷检测方法及装置
CN106547527B (zh) 一种JavaScript文件构建方法及装置
US20190220387A1 (en) Unexplored branch search in hybrid fuzz testing of software binaries
US8959646B2 (en) Automated detection and validation of sanitizers
CN103019787B (zh) 函数调用关系确定方法、热补丁升级方法及装置
CN104899147A (zh) 一种面向安全检查的代码静态分析方法
US20110320876A1 (en) Systems and methods for processing source code during debugging operations
CN110716866A (zh) 代码质量扫描方法、装置、计算机设备及存储介质
CN112579146A (zh) 接口变化的检测方法及装置
CN111240987B (zh) 移植程序检测方法、装置、电子设备及计算机可读存储介质
CN106201859A (zh) 一种回归测试方法及系统
CN108897678B (zh) 静态代码检测方法和静态代码检测系统、存储设备
CN102521135B (zh) 线性系统的测试方法和装置
US10114951B2 (en) Virus signature matching method and apparatus
KR101583932B1 (ko) 프로그램의 시그니처를 생성하는 시그니처 생성 장치 및 방법, 시그니처의 악성 코드를 검출하는 악성 코드 검출 장치 및 방법
US8516453B2 (en) Partition-based static analysis of computer software applications
CN111158665A (zh) 代码生成方法及装置、电子设备和存储介质
CN110244954A (zh) 一种应用程序的编译方法及设备
CN106528179B (zh) 一种Java类依赖关系的静态识别方法
US9032372B2 (en) Runtime environment and method for non-invasive monitoring of software applications
Lance et al. Bytecode-based Java program analysis

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17743567

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17743567

Country of ref document: EP

Kind code of ref document: A1