Automatic detection and correction method for array out-of-bound errors

Abstract

The invention provides an automatic detection and correction method for array out-of-bound errors. The automatic detection and correction method comprises the following steps of selecting source codes to be transformed; utilizing a compiler to generate a symbol table and an abstract syntax tree of the source codes; traversing the abstract syntax tree, constructing a pointer dependence graph and carrying out transformation calculation on the source codes; carrying out replacement on partial source codes needing to be replaced in the source codes; writing into initial parts of the transformed source codes according to function definition generated by an array out-of-bound detection strategy and an array out-of-bound correction strategy; using the original compiler to compile the transformed source codes; deploying generated executable files to a target system for operation, automatically detecting and correcting the array out-of-bound errors, and accurately reporting the positions of the source codes corresponding to the errors. The automatic detection and correction method provided by the invention has the advantages that the error positioning function is more accurate, the efficiency and the performance in operation are better, and the error correction function in operation is more automated.

Description

technical field [0001] The invention relates to the technical field of computer software testing and correction, in particular to an automatic detection and correction method for an array out-of-bounds error. Background technique [0002] Buffer overflow is a very dangerous software vulnerability and widely exists in various application software. Buffer overflow vulnerabilities may lead to abnormal software behavior, memory access errors or system crashes, and can also be used by hackers to attack valuable software systems. Currently, the buffer overflow problem has become the main cause of software vulnerabilities. For example, according to the statistics of the US-CERT vulnerability database, 11 of the 20 most serious vulnerabilities are caused by buffer overflows. Especially for those embedded control software used to control safety-critical industrial systems (for example, flight control software, high-speed train control software, nuclear power plant control software,...

AI Technical Summary

Problems solved by technology

However, the shortcomings of this technology are as follows: 1. Since the computational complexity of model checking technology itself is PSPACE complete, its inherent state explosion problem makes it difficult to directly apply this technology to large-scale software. Verification, such as software with more than 10,000 lines of code; 2. Since the model verification technology usually verifies the design model abstracted from the software system, rather than the entire source code, it cannot be guaranteed that the actual implementation of the software is correct, that is, it cannot be guaranteed source code correctness

However, the disadvantages of this technology are: 1. Since the source code is not directly faced, it is impossible to accurately locate the source code location that causes the error; 2. Due to the inaccurate error location, it creates obstacles for software development, debugging and correction

However, the shortcomings of this technology are: 1. Due to the interpretation and execution of the software by the virtual machine, the software running load is too large, so that the software efficiency and performance are significantly reduced; 2. For embedded safety-critical industrial control systems, due to High real-time and limited memory resources, such efficiency and performance degradation are often unacceptable, so this method is not practical

However, the shortcomings of this technology are: 1. When the source code scale is large or the function is relatively complex, the programmer may not be able to accurately locate the location of the error in the source code, so that the source code cannot be corrected; 2. When the software It has been deployed on the target platform, and the array out-of-bounds access error that occurs during actual operation cannot be corrected by this method, so it may cause software failure, system failure or hacker attack

Images