基于指向与数值抽象的带指针算术程序的分析方法

带指针算术的程序往往包含数组越界、缓冲区溢出等运行时错误。单纯的指针分析技术和数值分析技术都无法有效处理指针算术。为了将指针分析与数值分析相结合,首先提出一种新的指针内存模型,然后基于该模型设计了一个刻画指针指向关系和指针偏移量的抽象域。最后在抽象解释框架下,设计并实现了一个面向带指针算术C程序的静态分析工具原型PAA。实验结果表明,PAA能够有效地分析指针程序的指向关系和数值性质,并能够在效率和精度间取得合理的权衡。

Analysis of Programs with Pointer Arithmetic by Combining Points-to and Numerical Abstractions

ions YIN Bang-hu CHEN Li-qian WANG Ji (National Laboratory for Parallel and Distributed Processing,School of Computer Science, National University of Defense Technology,Changsha 410073,China) Abstract Programs with pointer arithmetic often involve runtime errors such as array out of bound,buffer overflow,etc.Pure pointer analysis and pure numerical analysis cannot deal with pointer arithmetic.To combine pointer analysis and numerical analysis,we proposed a new pointer memory model.On this basis,we presented an abstract domain to capture points-to and offset information of pointers.Finally,under the framework of abstract interpretation,we implemented a static analyzer prototype named PAA for analyzing C programs with pointer arithmetic.Experimental results show that PAA can analyze points-to and numerical properties of programs with pointer arithmetic effectively.More-over,PAA can achieve a reasonable trade-off between efficiency and accuracy.