An Improved Method of Static Analysis Tool Based on Code Replacement and Regular Expression

Abstract

The present invention discloses a static analysis tool improvement method based on code substitution and a regular expression. A static analysis tool adopts a preprocessing module to preprocess a source code so as to generate an intermediate code; a grammar analysis module is adopted to perform grammar analysis on the intermediate code so as to finally obtain a bidirectional token link table; a defect mode matching module is adopted to compare the bidirectional token link table with a defect mode to find a matching part in the bidirectional token link table, and process the matching part to obtain a static analysis result; when the source code is preprocessed in the preprocessing module, (i=i+1)-1 is substituted for i++, i=i+1 is substituted for ++i, (i=i-1)+1 is substituted for i--, and i=i-1 is substituted for --i; and a regular expression is added in the defect mode matching module as follows: if(%var%=%num%), if(%any%&%any%), scanf(%str%,%var%), wherein %var%, %num%,%any%,%any%,%str% and %var% are all variables. The static analysis tool improvement method based on the code substitution and the regular expression provided by the present invention can improve the accuracy of an integer overflow problem, reduce a misreporting rate and reduce manual inspection costs.

Description

technical field [0001] The invention belongs to the technical field of computer programming, and in particular relates to a static analysis tool improvement method based on code replacement and regular expressions. Background technique [0002] The processing flow of the current static analysis tool can be divided into four parts: a preprocessing module, a syntax analysis module, a defect pattern matching module, and a defect pattern processing module. The source code in the project file or folder to be detected is first processed by a preprocessor to obtain an intermediate code that is easy to detect. The intermediate code is processed by the syntax analysis module to generate an abstract syntax tree. Then the defect pattern matching module matches the known defect patterns with the abstract syntax tree to detect the defects. The detected defects form a formatted output through the defect location and output module, and generate operation results according to user require...

AI Technical Summary

Problems solved by technology

[0008] Existing static analysis tools have deficiencies in detecting plastic overflow problems involving self-increment and self-decrement operations, and the false positive rate is high, resulting in some serious defects not being discovered in time, affecting the stability of the system

In addition, the current static analysis tools do not take into account such problems as possible wrong typing. This kind of problem is very common in daily programming and cannot be detected by the compiler, and it is not easy to check manually, so it is up to the static analysis tool. It is very necessary to realize the inspection of such problems