Method for analyzing memory security in C code by using data stream analysis algorithm

Abstract

The invention provides a method for analyzing memory security in a C code by using a data stream analysis algorithm. Defining an instruction into a formalized instruction set, and performing the following operations: statically analyzing a code demand and adding a mark to a pointer; codes are converted into an abstract syntax tree, type checking is carried out on each instruction, and related pointer permission transfer or borrowing statements are modified at the same time, so that the related pointer permission transfer or borrowing statements are distinguished in static single assignment; performing linearization on the abstract syntax tree to obtain a control flow graph in a static single assignment form, and performing data flow analysis to obtain a result of a convergent permission mapping table; and iterating the stabilized result by using a data flow analysis algorithm, and checking whether a memory security problem exists or not by using an error checking function. The method has the advantages that based on a series of common instructions related to the memory in the C language, the formalized instruction set is defined, a series of memory error detection methods are defined, and memory safety detection is facilitated.

Description

technical field [0001] The invention relates to the fields of data flow analysis algorithm and static analysis tool development, in particular to a method for analyzing the memory safety in C code by using the data flow analysis algorithm. Background technique [0002] Modern programming languages ​​have two ways to recover the memory space on the heap: one is that the user explicitly calls the memory recovery function in the code to release the memory manually; the other is to introduce an automatic garbage collection mechanism. The core of Rust memory management is through ownership, which stipulates that each block of memory on the heap has only one ownership owner at the same time. Rust uses static analysis to accurately analyze the scope of each variable. When the scope of the ownership owner After the end, the memory space on the heap will be automatically released; while C needs to manually solve the application and release of the memory space on the heap, which is li...

AI Technical Summary

Problems solved by technology

The core of Rust memory management is through ownership, which stipulates that each block of memory on the heap has only one ownership owner at the same time. Rust uses static analysis to accurately analyze the scope of each variable. When the scope of the ownership owner After the end, the memory space on the heap will be automatically released; while C needs to manually solve the application and release of the memory space on the heap, which is likely to cause many memory safety problems

[0003] Rust is relatively better than C in terms of memory safety, but most of the Linux kernel code is written in C and will not be changed to Rust in a short time