指针在C程序中应用广泛,指针引用错误多发且危害严重.目前代表性的检测工具由于使用方便性和检测精度不足以及难以处理大规模程序等原因,并不能满足实用需求.文中提出一种新型的错误检测方法,该方法基于域敏感、流敏感和上下文敏感的传播引擎,通过定义错误属性格、在源程序中对错误属性格值进行计算和传播来完成错误检测.在开放源码编译器Open64中实现了其原型系统Propagator.以空指针引用错误检测为实例研究内容,使用Apache、OpenSSH、gzip等应用领域广泛的典型应用为实验用例.与Saturn、Splint和Clang-SA进行对比,Propagator的平均检测时间仅为12s,误报率平均仅为13%,远低于对比工具,且没有发现漏报已知错误.上述结果表明,Propagator既提高了检测精度又保证了可扩展性,具有很好的实用前景.
Pointers are widely used in C programs, pointer dereference faults are dangerous while they occur frequently. Many tools are designed to detect this kind of faults, but the state-of-art tools cannot meet the practical needs due to inconvenient usage, low detection accuracy and poor scalability. This paper presents a detection approach which is based on flow-sensitive, field-sensitive and context-sensitive propagation engine. The approach successfully lowers the user burden, improves detection accuracy and scalability. The core concept of the approach is fault attribute lattice. The lattice values are computed and propagated through the source code to detect the faults which were characterized via the fault attribute lattice. A prototype system named Propa- gator based on Open64 compiler has been implemented. Using null-pointer dereference fault detection as one case study, the comparison experiments with Saturn, Splint and Clang-SA on applications such as Apache, OpenSSH, gzip etc. are done. The results show that Propagator uses only 12 seconds on average to finish the fault checking and the false positive rate of Propagator is only 13% on average. Furthermore, Propagator do not report known false negatives. that Propagator not only improves the scalability but also achieves the high detection thus indicates our approach can be used in practical. It is clear accuracy, thus indicates our approach can be used in practical.