Java null pointer dereference detection method based on static analysis

Abstract

The invention discloses a Java null pointer de-reference detection method based on static analysis, which realizes more accurate null pointer anomaly detection through combination of a hierarchical analysis framework and reachability verification. A to-be-detected target program is processed, and an intermediate representation IR and an intra-process control flow graph CFG are obtained; null value data flow analysis and alias analysis in the process are carried out based on the IR and the CFG, and a corresponding data flow result is generated; executing flow insensitive pointer analysis according to a data flow result, dynamically constructing a pointer flow graph of a Java program, spreading null values on the graph, and synchronously generating an interprocess control flow graph; potential null variables are extracted from the PFG, dereferencing statements related to the variables are collected, and a statement sequence which conforms to null value propagation of a control flow is searched on an ICFG graph in combination with a CFL-Reach algorithm; and for different code modes, for different types of statement sequences, performing reachability verification by adopting a rule-driven solver, and outputting a defect detection report.

Description

Technical Field

[0001] The present invention relates to a method for detecting potential null pointer dereferences in Java programs through static analysis technology, belonging to the technical fields of software engineering and program static analysis technology. Background Art

[0002] In Java program development, null pointer dereference (NullPointerException, NPE) defects are typical problems that cause system crashes and runtime exceptions. According to the public data of the CVE vulnerability database in 2023, more than 12% of Java production environment crashes are caused by NPEs, and the repair cost increases exponentially with the expansion of software scale. Currently, the detection techniques for NPE defects are mainly divided into two categories: dynamic testing and static analysis methods, but both have certain technical bottlenecks.

[0003] Dynamic testing methods (such as the JUnit framework) trigger potential exceptions by constructing test cases. Although they can achieve a zero false positive rate in detection, their effectiveness is limited by the integrity of test cases, and the false negative rate is relatively high. At the same time, dynamic testing can only locate the trigger point of the exception and cannot reverse-track the cross-method propagation path of null values. Developers need to manually analyze and locate through limited error messages. In addition, frequently executing full-scale tests in a continuous integration scenario requires a large amount of time, seriously restricting the efficiency of agile development.

[0004] Although static analysis technology can predict defects through code structure analysis, traditional tools all have certain limitations: Annotation-based type checking (such as Checker Framework, NullAway) infers the type of variables through intra-procedural type inference using annotations and can complete the check at the compilation stage. However, the cost is that such tools can only detect some relatively simple examples and rely on developers to add annotations to the project, resulting in a high transformation cost for old projects. Tools based on intra-procedural data flow analysis (such as SpotBugs) perform defect pattern matching through data flow analysis. Such tools do not require annotations, but their intra-procedural analysis methods lead to limited cross-method tracking capabilities and insufficient support for some Java features such as arrays, collections, fields, etc. Existing solutions also have shortcomings in the interpretability of the null value propagation path and cannot provide developers with a visual path for defect tracing. Summary of the Invention

[0005] Object of the Invention: Aiming at the problems and deficiencies in the prior art, the present invention provides a method for detecting Java null pointer dereferences based on static analysis. This method innovatively combines data flow analysis, context-sensitive pointer analysis, and value tracking of CFL reachability, breaking through the limitations of traditional tools in terms of the accuracy and breadth of path tracking and support for complex language features.

[0006] Technical solution: A method for detecting Java null pointer dereference based on static analysis, the method comprising the following steps: S1. Process the target program to be detected to obtain the IR and CFG for static analysis.

[0007] S2. Based on the IR and CFG, trace the in-procedure propagation path of null variables through in-procedure data flow analysis, and generate the data flow result of non-null variables by combining alias analysis.

[0008] S3. Perform flow-insensitive pointer analysis according to the data flow result, dynamically construct the pointer flow graph (PFG) of the Java program, propagate the null value on the graph, and synchronously generate the inter-procedure control flow graph (ICFG).

[0009] S4. Feasible path search: Extract potential null variables from the pointer flow graph, collect the dereference statements related to these null variables, and combine the CFL-Reachability algorithm to search for the statement sequence of null value propagation that conforms to the control flow on the inter-procedure control flow graph.

[0010] S5. For the statement sequences of different code patterns output by S4, perform reachability verification using rule-driven path constraint solving to generate a null pointer defect detection report.

[0011] In the step S1, the open-source framework Tai-e is used to process the target program code to be detected, and the three-address code IR and the control flow graph CFG for static analysis results are obtained.

[0012] Preferably, the in-procedure data flow analysis in the step S2 specifically includes: S21. Run in-procedure alias analysis. Specifically, use the representation form of the alias graph to model a certain must-alias situation of variables. The nodes on the graph contain variables that must be aliases of each other, and the directed edges represent expressions of a certain field. For example, the directed edge f: a -> b means that the variable contained in b must be an alias of a.f.

[0013] S22. Use the alias analysis result generated by S21 to run in-procedure non-null variable data flow analysis. Utilize the information provided by conditional judgment statements and assignment statements to calculate the set of variables that must be non-null on each statement.

[0014] Preferably, the dynamic construction of the pointer flow graph in the step S3 specifically includes: S31. For the part related to user code in the IR, use a type context-sensitive and flow-insensitive pointer analysis algorithm to construct a points-to flow graph (PFG) and a method call graph for each statement.

[0015] S32. Also pass null in the program as a mock object into the PFG, and based on the non-null value information generated in S2 and the information of relevant annotations (such as @Nonnull, @Nullable), add null filters to some nodes and edges in the PFG.

[0016] Preferably, the application of the CFL-Reachability algorithm in step S4 includes: starting from the statements that may throw NPE exceptions, performing backward search on the ICFG to find the propagation link of null values, and marking the method call edges as left parentheses with labels i: (and the return edges as right parentheses i:). The parenthesis sequence of the valid path satisfies the parenthesis matching condition, and the propagation paths that do not match the cross-procedural context are excluded.

[0017] Preferably, the constraint verification in step S5 includes: according to the propagated statement sequence generated in S4, identifying the path constraints in the sequence and attempting to solve the constraints. Filter out the sequences for which the constraints cannot hold, and output the remaining sequences as defect reports.

[0018] A Java null pointer dereference detection system based on static analysis, aiming at the problems of inaccurate cross-procedural data flow tracking and insufficient path-sensitive constraint modeling in traditional static analysis tools, resulting in high false negative and false positive rates. Through the combination of a hierarchical analysis framework and reachability verification, more accurate null pointer exception detection is achieved. The system includes the following modules: Multi-level intermediate representation generation module: used to process the target program to be detected, and obtain the intermediate representation IR and the intra-procedural control flow graph CFG; Intra-procedural data flow analysis module: used to perform intra-procedural null value data flow analysis and alias analysis based on IR and CFG, and generate corresponding data flow results; Pointer flow graph dynamic construction module: used to perform flow-insensitive pointer analysis according to the data flow results, dynamically construct the pointer flow graph (PFG) of the Java program, propagate null values on the graph, and synchronously generate the inter-procedural control flow graph (ICFG); Feasible path search module: used to extract potential null value variables from the PFG, collect the dereference statements related to these variables, and combine the CFL-Reachability algorithm to search for the statement sequence of null value propagation that conforms to the control flow on the ICFG graph; Heuristic constraint verification module: for different code patterns and different types of statement sequences, use a rule-driven solver to perform reachability verification and output a defect detection report.

[0019] A computer device, which includes a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the steps of the Java null pointer dereference detection method based on static analysis as described above are implemented.

[0020] A computer-readable storage medium stores a computer program for executing the Java null pointer dereference detection method based on static analysis as described above.

[0021] Advantageous effects: Compared with the existing technical solutions, the present invention has the following advantages: 1) The present invention deeply combines flow-insensitive pointer analysis and data flow analysis techniques for the first time, can efficiently transfer null values across methods, and can effectively discover cross-method null pointer dereference problems.

[0022] 2) The present invention uses CFL-Reachability to verify the null value propagation path contextually, effectively reducing the false positive rate of interprocedural defect detection.

[0023] 3) The present invention partially verifies the path constraints of null value propagation, and for the detected defect results, can give a complete null value propagation link, which helps to improve the verification efficiency of developers. Description of the Drawings

[0024] Figure 1 is the flowchart of the method of the embodiment of the present invention. Detailed Embodiments

[0025] The following further clarifies the present invention in conjunction with specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and not to limit the scope of the present invention. After reading the present invention, various equivalent forms of modification of the present invention by those skilled in the art fall within the scope defined by the appended claims of this application.

[0026] Since the present invention belongs to a static analysis method for Java code, the following introduces the specific implementation method in conjunction with Java code examples.

[0027] Line 1, public static Object mayReturnObject(boolean ok) { / / This method may return an object Line 2, if(ok) Line 3, return new Object(); Line 4, return null; Line 5,} Line 6, void foo() { Line 7, Object o = mayReturnObject(true); / / The parameter is true and o is not null Line 8, o.toString(); Line 9, Object o2 = mayReturnObject(false); / / The parameter is false and o2 is null Line 10, if(o2 != null) { Line 11, o2.toString(); Line 12, use(o2) Line 13,} Line 14, Object o3 = o2; Line 15, o3.toString(); / / Unsafe dereference statement Line 16,} Line 17, void use(Object o) { Line 18, o.toString() Line 19,} A Java null pointer dereference detection method based on static analysis, including: In step S1 during the processing of the target program code, the open-source framework Tai-e is used to process the program code to obtain the three-address IR and control flow graph CFG for static analysis.

[0028] The intra-procedural non-null data flow analysis in step S2 aims to first use the local information within the procedure to pre-exclude some safe dereference statements. After calculating the non-null information for the foo() method, since the null check information for variable o2 on line 10 is utilized, the analysis can calculate that o2 must be non-null when the program execution reaches line 11. Therefore, this dereference statement can be safely excluded.

[0029] The pointer analysis in step S3 aims to construct a pointer flow graph and restrict the propagation of null values on the pointer flow graph, specifically including S31. For the part of the IR related to the user code, an Andersen-style pointer analysis method is used to construct the pointer flow graph For the example code, in step S32, using the non-null information generated in S2, a null value filter is added at the non-null propagation points on the pointer flow graph. According to the known information, we know that the actual parameter in line 12 must be non-null. Therefore, a null filter can be added to the PFG edge from the actual parameter o2 to the formal parameter o, and this dereference statement can be directly and safely excluded.

[0030] For the example code, according to the established PFG, the null value on line 4 flows into pointers o and o3 without restriction, and thus the dereference statements on lines 8 and 15 are listed as objects that need further verification.

[0031] For the example code, step S4 satisfies the search for feasible paths that meet the control flow constraints, and filters feasible paths based on the flow-insensitive pointer analysis results. The analysis starts from two dereference statements respectively, and reversely searches on the ICFG generated in S3 to the place where the null value is generated, generating two propagation statement sequences 4, 7, 8 and 4, 9, 14, 15.

[0032] For the example code, step S5 further verifies whether the statement sequences generated in step S4 meet the path constraints. For the sequence 4, 7, 8, the analysis identifies that statement 4 is executed if and only if the variable ok is false. According to the provided sequence, it can be traced that ok is true at this time, and statement 8 is excluded. Similarly, it is calculated that statement 15 may be true, so finally only the statement sequence 4, 9, 14, 15 is output as the final report.

[0033] A Java null pointer dereference detection system based on static analysis includes the following modules: Multi-level intermediate representation generation module: used to process the target program to be detected, and obtain the intermediate representation IR and the intra-procedural control flow graph CFG; Intra-procedural data flow analysis module: used to perform intra-procedural null value data flow analysis and alias analysis based on IR and CFG, and generate corresponding data flow results; Pointer flow graph dynamic construction module: used to perform flow-insensitive pointer analysis according to the data flow results, dynamically construct the pointer flow graph (PFG) of the Java program, propagate the null value on the graph, and synchronously generate the inter-procedural control flow graph (ICFG); Feasible path search module: used to extract potential null value variables from the PFG, collect the dereference statements related to these variables, and combine the CFL-Reachability algorithm to search for the statement sequence of null value propagation that meets the control flow on the ICFG graph; Heuristic constraint verification module: For different code patterns and different types of statement sequences, use a rule-driven solver to perform reachability verification and output a defect detection report.

[0034] Obviously, those skilled in the art should understand that each step of the method of the embodiments of the present invention described above can be implemented by a general-purpose computing device. They can be concentrated on a single computing device or distributed on a network composed of multiple computing devices. Optionally, they can be implemented with program codes executable by the computing device. Thus, they can be stored in a storage device and executed by the computing device. And in some cases, the steps shown or described can be executed in a sequence different from that here, or they can be separately fabricated into individual integrated circuit modules, or multiple modules or steps among them can be fabricated into a single integrated circuit module to be implemented. In this way, the embodiments of the present invention are not limited to any specific combination of hardware and software.

Claims

1. A Java null pointer dereference detection method based on static analysis, characterized in that The method includes the following steps: S1. Process the target program to be detected to obtain IR and CFG for static analysis; S2. Based on IR and CFG, trace the in-procedure propagation path of null variables through in-procedure data flow analysis, and generate the data flow result of non-null variables by combining alias analysis; S3. Perform flow-insensitive pointer analysis according to the data flow result, dynamically construct the pointer flow graph of the Java program, propagate the null value on the graph, and synchronously generate the inter-procedure control flow graph; S4. Feasible path search: Extract potential null variables from the pointer flow graph, collect the dereference statements related to these null variables, and combine the CFL-Reachability algorithm to search for the statement sequence of null value propagation that conforms to the control flow on the inter-procedure control flow graph; S5. For the statement sequences of different code patterns, perform reachability verification using rule-driven path constraint solving to generate a null pointer defect detection report.

2. The method for detecting Java null pointer dereference based on static analysis according to claim 1, wherein In step S1, the open-source framework Tai-e is used to process the target program code to be detected to obtain the three-address code IR and the control flow graph CFG for static analysis results.

3. The method for detecting Java null pointer dereference based on static analysis according to claim 1, characterized in that, The in-procedure data flow analysis in step S2 specifically includes: S21. Run in-procedure alias analysis; Model a certain aliasing situation of variables in the form of an alias graph. The nodes on the graph contain variables that are aliased to each other, and the directed edges represent expressions of a certain field; S22. Run in-procedure non-null variable data flow analysis; Use the information provided by conditional judgment statements and assignment statements to calculate the set of variables that must be non-null on each statement for each statement.

4. The method for detecting Java null pointer dereference based on static analysis according to claim 1, wherein The dynamic construction of the pointer flow graph in step S3 specifically includes: S31. For the part of IR related to user code, use a type context-sensitive and flow-insensitive pointer analysis algorithm to construct a points-to flow graph and a method call graph for Statements; S32. Also pass null in the program as a mock object into the PFG, and based on the non-null value information generated in S2 and the information of relevant annotations, add null filters to some nodes and edges in the PFG.

5. The method for detecting Java null pointer dereference based on static analysis according to claim 1, wherein The application of the CFL-Reachability algorithm in step S4 includes: Starting from the statement that may throw an NPE exception, perform backward search on the ICFG to find the propagation link of the null value, and mark the method call edge as a left parenthesis i: with a label. The parenthesis sequence of the valid path satisfies the parenthesis matching condition, and the propagation paths that do not match the cross-procedure context are excluded.

6. The method for detecting Java null pointer dereference based on static analysis according to claim 1, characterized in that, The constraint verification in step S5 includes identifying the path constraints in the sequence according to the propagated statement sequence and attempting to solve the constraints; Filtering out the sequences for which the constraints cannot hold, and outputting the remaining sequences as defect reports.

7. A Java null pointer dereference detection system based on static analysis, characterized in that It includes the following modules: Multi-level intermediate representation generation module: Used to process the target program to be detected to obtain the intermediate representation IR and the in-procedure control flow graph CFG; In-procedure data flow analysis module: Used to perform in-procedure null data flow analysis and alias analysis based on IR and CFG to generate corresponding data flow results; Pointer Flow Graph Dynamic Construction Module: It is used to perform flow-insensitive pointer analysis according to the data flow result, dynamically construct the pointer flow graph of the Java program, propagate the null value on the graph, and synchronously generate the inter-procedural control flow graph; Feasible Path Search Module: It is used to extract potential null variables from the PFG, collect the dereference statements related to these variables, and combine with the CFL-Reachability algorithm to search for the statement sequence of null value propagation that conforms to the control flow on the ICFG graph; Heuristic Constraint Verification Module: For different code patterns and different types of statement sequences, a rule-driven solver is used to perform reachability verification and output a defect detection report.

8. A computer device, characterized in that: The computer device includes a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the Java null pointer dereference detection method based on static analysis according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for executing the Java null pointer dereference detection method based on static analysis according to claims 1-6.

Images