A path traversal-based code verification method, device, medium and equipment

Abstract

The application discloses a code verification method and device based on path traversal, a medium and equipment. The method finds all paths from the program entrance to the target statement with a path length not exceeding K in a control flow graph through a loop body step decomposition manner, and forms a path set. Then, the paths are traversed, and reachability verification is performed on the traversed paths. When the paths are subjected to reachability verification, array variables are simplified into array elements through expression simplification calculation, and operations related to the array variables are expanded into SMT constraint expressions related to the array elements in combination with variable constraint replacement, so that the SMT constraint solving can process variables related to arrays, the complexity of the SMT constraint solving is reduced, the solving and analysis of unreachable path segments are avoided, and the analysis efficiency is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of software security and software verification. BACKGROUND

[0002] Patent document CN 105808429 A discloses a bounded reachability verification method for linear constraint code. The technical solution recorded in the document has the following defects:

[0003] First, it cannot process arrays and can only verify simple programs without arrays;

[0004] Second, the SMT constraint has a constraint variable confusion problem. To solve this confusion problem, the technical solution needs to solve the unreachable path segment;

[0005] Third, it is inefficient, needs to solve the unreachable path segment, and then analyzes based on the unreachable path segment. The steps are complex, and it takes too long to solve the unreachable path segment. SUMMARY

[0006] The problem to be solved by the present application is the defects of code reachability verification in the prior art.

[0007] To solve the above problems, the present application adopts the following solutions:

[0008] According to the code verification method based on path traversal of the present application, the following steps are included:

[0009] Step S1: obtaining source code and target statements; the target statements are code statements in the source code;

[0010] Step S2: converting the source code into a control flow graph;

[0011] Step S3: finding all paths in the control flow graph from the program entry to the target statements with a path length not exceeding K by means of loop body step-by-step decomposition, and composing a path set;

[0012] Step S4: traversing the paths in the path set one by one, and performing reachability verification on the traversed paths; if the current path is reachable, the verification is ended; if the current path is not reachable, the next path in the path set is verified for reachability until all paths in the path set are verified for reachability;

[0013] In the step S4, the verification of the path includes the following steps:

[0014] Step S41: sequentially traversing each path node of the current path, and extracting expressions about program variables in sequence according to the source code corresponding to the current path node to compose a first expression queue;

[0015] Step S42: according to the order of the first expression queue, the expression is calculated to obtain the second expression queue according to the expression of the assignment statement before the current expression;

[0016] Step S43: the irrelevant expression in the second expression queue is removed by analyzing the scope of the program variable to obtain the third expression sequence: if the target statement is outside the scope of the program variable, the expression corresponding to the program variable in the second expression queue is removed; if there is no referenced expression between the assignment statements of the program variable, the assignment statement before the program variable is deleted;

[0017] Step S44: according to the number sequence of the program variable assignment operation and the element offset of the array variable, the constraint variable is constructed, and the program variable of each expression in the third expression queue is replaced into the constraint variable to form the corresponding SMT constraint expression, which constitutes the SMT constraint code;

[0018] Step S45: the SMT constraint solver is used to solve the SMT constraint code, and if the SMT constraint code has a solution, it means that the current path is reachable, otherwise it means that the current path is not reachable.

[0019] According to the code verification device based on path traversal, the device comprises the following modules:

[0020] Module M1 is used for obtaining source code and a target statement; the target statement is a code statement in the source code;

[0021] Module M2 is used for converting the source code into a control flow graph;

[0022] Module M3 is used for finding all paths from a program entry to the target statement in the control flow graph by means of step-by-step decomposition of a loop body, so as to form a path set, and the length of each path is not more than K;

[0023] Module M4 is used for traversing the paths in the path set one by one, and verifying the reachability of the traversed path; if the current path is reachable, the verification is ended; if the current path is not reachable, the next path in the path set is verified, until all the paths in the path set are verified;

[0024] In the module M4, the verification of the path comprises the following modules:

[0025] Module M41 is used for sequentially traversing each path node of the current path, and extracting expressions about program variables in sequence according to the source code corresponding to the current path node to form a first expression queue;

[0026] Module M42 is configured to: according to the order of the first expression queue, simplifying the expression according to the expression of the assignment statement before the current expression to obtain a second expression queue;

[0027] Module M43 is configured to: by analyzing the scope of the program variable, eliminating irrelevant expressions in the second expression queue to obtain a third expression sequence: if the target statement is outside the scope of the program variable, the expression corresponding to the program variable is eliminated in the second expression queue; if there is no referenced expression between the assignment statements of the program variable, the assignment statement before the program variable is deleted;

[0028] Module M44 is configured to: according to the number sequence of the program variable assignment operation and the element offset of the array variable, constructing a constraint variable, replacing the program variable of each expression in the third expression queue with the constraint variable to form a corresponding SMT constraint expression, and composing an SMT constraint code;

[0029] Module M45 is configured to: by the SMT constraint solver, performing SMT constraint solving on the SMT constraint code, if the SMT constraint code has a solution, it indicates that the current path is reachable, otherwise it indicates that the current path is unreachable.

[0030] According to the medium of the application; the medium stores a set of program instructions that can be read by a machine; when the set of program instructions stored in the medium is read and executed by the machine, the above-mentioned code verification method based on path traversal can be realized.

[0031] According to the device of the application; the device includes a processor and a memory; the memory stores a set of program instructions; when the set of program instructions stored in the memory is loaded and executed by the processor, the above-mentioned code verification method based on path traversal can be realized.

[0032] The technical effects of the application are as follows:

[0033] By simplifying and eliminating irrelevant expressions, the complexity of the SMT constraint code is reduced, thereby reducing the complexity of the SMT constraint solving;

[0034] By simplifying the expression, the array variable is simplified into an array element, and the constraint replacement of the variable is combined, so that the operation related to the array variable is expanded into an SMT constraint expression related to the array element, so that the SMT constraint solving can process the array related variable;

[0035] By replacing the constraint of the expression variable, the SMT constraint expression is flattened, and the SMT constraint can express more information about the source code program, so that the solving of the unreachable path segment is avoided. BRIEF DESCRIPTION OF DRAWINGS

[0036] Figure 1 is the core step flow chart of the embodiment of the present application.

[0037] Figure 2 is the control flow chart of the source program code of the example of the present application.

[0038] Figure 3 is the structural schematic diagram of the device embodiment of the present application. Embodiment

[0039] The present application will be further described in detail below with reference to the accompanying drawings.

[0040] The present embodiment relates to a device, in particular an electronic device, referring to Figure 3 at least comprising a connected processor 100 and a memory 200. The processor 100 is usually a general-purpose computer processor capable of executing computer program instructions, and the memory 200 is usually a medium that can store without loss after power-off, including but not limited to a magnetic disk, a magnetic tape, a flash memory, etc. The medium is also the aforementioned medium of the present application. The memory 200 is usually used to store a set of computer program instructions and data. The processor 100 realizes its corresponding automation function by loading the program instruction set stored in the memory 200. In the present embodiment, the processor 100 realizes the path traversal-based code verification method of the present application by loading and executing the program instruction set stored in the memory 200. The path traversal-based code verification method of the present application comprises the following steps: a data receiving step, a control flow chart construction step, a path construction step, and a path reachability analysis step.

[0041] The data receiving step, that is, the acquisition of the source code and the target statement in the aforementioned step S1. This step indicates that the input of the present application is the source code and the target statement. How to acquire the source code and the target statement and the specific form adopted are not within the scope of discussion of the present application, and will not be described here. In addition, the source code here can be program code in any language, such as C, C++, Java, Phython, Go, etc. The target statement is the code statement at a specified position in the source code, which can usually be represented by a line number. The following is an example of C language code, which is used as an illustration of the subsequent analysis and processing process of the present embodiment:

[0042] 01 extern void abort(void)

[0043] 02 extern void __VERIFIER_assert(int cond) { if(!cond) { ERROR:abort();}};

[0044] 03 extern int __VERIFIER_nondet_int(void); 04

[0046] 05 #define N 5

[0047] 06 int main() {

[0048] 07 int a[N];

[0049] 08 int index= 0;

[0050] 09 for (int i=0;i<N;i++) {

[0051] 10 a[i] = i + 1;

[0052] 11} 12

[0054] 13 int select_bit = __VERIFIER_nondet_int();

[0055] 14 if (select_bit<0)

[0056] 15 index = 0;

[0057] 16 else if (select_bit<N)

[0058] 17 index = N / 2;

[0059] 18 else

[0060] 19 index = N-1; 20

[0062] 21 if (a[index] % 3==0)

[0063] 22 __VERIFIER_assert(0); 23

[0065] 24 return 0;

[0066] 25}

[0067] The control flow graph construction step, i.e., the aforementioned step S2, converts the source code into a control flow graph. Taking the aforementioned example code as the source code as an example, the control flow graph converted is as shown in FIG. 2. Figure 2 Figure 2 ​In the example control flow graph, there are 11 nodes including nodes n0 to n10. The node n1->n1 constitutes a loop body. It should be noted that converting source code into a control flow graph is a technique familiar to those skilled in the art, and the specific implementation process and control flow graph structure will not be described herein.

[0068] The path construction step, i.e., the aforementioned step S3, finds all paths from the program entry to the target statement in the control flow graph with a path length of no more than K by means of loop body step-by-step decomposition, and forms a path set. In terms of loop body step-by-step decomposition, the loop body is looped once, twice, three times,..., and n times to construct relevant paths. For example, in the aforementioned example control flow graph, the loop body is looped once, and there are three paths from the program entry to the target statement, which are: Figure 2 Figure 2

[0069] n0->n1->n2->n3->n4->n9,

[0070] n0->n1->n2->n5->n6->n9,

[0071] n0->n1->n2->n7->n8->n9.

[0072] If the loop body is looped twice, there are three paths from the program entry to the target statement, which are:

[0073] n0->n1->n1->n2->n3->n4->n9,

[0074] n0->n1->n1->n2->n5->n6->n9,

[0075] n0->n1->n1->n2->n7->n8->n9.

[0076] Thus, under the limitation of a path length of no more than K, the loop body is assumed to be looped at most K-5 times. That is, if the loop body is looped K-5 times, a path from the program entry to the target statement with a path length of K can be obtained, which is:

[0077] n0->n1(K-5->n1)->n2->n3->n4->n9,

[0078] n0->n1(K-5->n1)->n2->n5->n6->n9, ​​

[0079] n0->n1(K-5->n1)->n2->n7->n8->n9.

[0080] Thus, the number of paths in the path set finally obtained by the above example is 3*K-15.

[0081] Here, K is used to avoid the situation of processing the loop body in an infinite loop. This indicates that the code verification method of the present application is a verification method with boundaries. Of course, if there is no loop body in the input source code, the number of paths in the path set obtained by the path construction step is generally independent of K. K can be a pre-set constant or configured by external input.

[0082] The path reachability analysis step, i.e. the aforementioned step S4, traverses the paths in the path set one by one, and performs reachability verification on the traversed path. If the current path is reachable, the verification ends. If the current path is not reachable, the next path in the path set is verified for reachability until all paths in the path set are verified for reachability. It should be noted that step S4 is a loop step, and the loop ends under two conditions: the first is that if a path is reachable, it means that the target statement is reachable within the limited path length K, and there is no need to verify subsequent paths, and the loop ends directly; the second is that if all paths are verified for reachability and are not reachable, it means that the target statement is not reachable within the limited path length K.

[0083] The reachability verification of the path in step S4 is implemented by solving the SMT constraint code through SMT. Specifically, referring to Figure 1 , including the following steps: expression extraction step, expression calculation and simplification step, expression irrelevant elimination step, expression variable replacement step and SMT constraint solving step.

[0084] The expression extraction step, i.e. the aforementioned step S41, sequentially traverses each path node of the current path, and extracts expressions about program variables in order according to the source code corresponding to the current path node, to form a first expression queue. Taking the path n0->n1->n1->n1->n1->n1->n2->n3->n4->n9 as an example, the first expression sequence of the example path is:

[0085] index=0; i=0; i<5; a[i]=i+1; i++; i<5; a[i]=i+1; i++; i<5; a[i]=i+1; i++; i<5; a[i]=i+1; i++; i<5; a[i]=i+1; i++; select_bit<0; index=0; (a[index] % 3)==0.

[0086] The expression simplification step, i.e. the aforementioned step S42, simplifies the expressions in the first expression queue to obtain a second expression queue according to the order of the first expression queue and the expressions of the assignment statements before the current expression. Specifically, if a variable in an expression is a specific value, the specific value is replaced by the variable. For example, in the first expression sequence of the example path, the expressions a[i]=i+1 and i++ are replaced by the specific values of i to obtain the corresponding expressions of the specific values. Thus, the second expression sequence of the example path is as follows:

[0087] index=0; i=0; i<5; a[0]=1; i=1; i<5; a[1]=2; i=2; i<5; a[2]=3; i=3; i<5; a[3]=4; i=4; i<5; a[4]=5; i=5; i<5; select_bit<0; index=0; (a[0] % 3)==0.

[0088] The expression irrelevant elimination step, i.e. the aforementioned step S43, eliminates the irrelevant expressions in the second expression queue to obtain a third expression sequence by analyzing the scope of the program variables: if the target statement is outside the scope of the program variables, the expression corresponding to the program variable is eliminated in the second expression queue; if there is no referenced expression between the assignment statements of the program variables, the assignment statement before the program variable is deleted. There are two situations that need to be eliminated: the first situation is that the target statement is within the scope of the program variables, for example, in the second expression sequence of the example path, node n9 is outside the scope of the program variable i, so the expression related to the program variable i needs to be deleted. The second situation is that if there is no referenced expression between the assignment statements of the program variables, for example, in the second expression sequence of the example path, index is not referenced between index=0 in the first expression and index=0 in the second-to-last expression, so the first expression index=0 is considered to be deleted. Thus, the third expression sequence of the example path is as follows:

[0089] a[0]=1; a[1]=2; a[2]=3; a[3]=4; a[4]=5; select_bit<0; index=0; (a[0] % 3)==0.

[0090] The expression variable replacement step, i.e., the aforementioned step S44, constructs a constraint variable according to the element offset of the array variable and the sequence number of the program variable assignment operation, replaces the program variable of each expression in the third expression queue with the constraint variable to form a corresponding SMT constraint expression, and composes the SMT constraint code. There are two cases here: the first is an array variable, such as a in a[1]=2, and the constraint variable constructed is a_1_0. In "a_1_0", a is the original array variable name, 1 is the element offset of the array variable, and 0 is the sequence number of the program variable assignment operation. The corresponding SMT constraint expression obtained after replacement is a_1_0=2. The second is a non-array variable, such as select_bit in select_bit<0>, and the constraint variable constructed is select_bit_0. In "select_bit_0", select_bit is the original variable name, and 0 is the sequence number of the program variable assignment operation. Thus, the SMT constraint expression corresponding to each expression of the third expression sequence of the example path is finally obtained as follows:

[0091] a_0_0==1; a_1_0==2; a_2_0==3; a_3_0==4; a_4_0==5; select_bit_0<0; index_0==0; (a_0_0 %3)==0.

[0092] The SMT constraint expression above is combined into the SMT constraint code as follows:

[0093] a_0_0==1 ∧ a_1_0==2 ∧ a_2_0==3 ∧ a_3_0==4 ∧ a_4_0==5 ∧ select_bit_0<0 ∧ index_0=0 ∧ (a_0_0 %3)==0.

[0094] It should be noted that the replacement rule of the constraint variable above also applies to structures. For example, a certain expression is as follows:

[0095] student[3].score[6]>90;

[0096] The SMT constraint expression of the program variable student[3].score[6] after the constraint variable is constructed by the above method is as follows:

[0097] student_3_score_6_x>90. Where "x" represents the sequence number of the assignment operation of the program variable student[3].score[6].

[0098] In addition, it is pointed out that the expression in the third expression queue is the expression under the corresponding program language, and different operator symbols are noted when converted into the SMT constraint expression. For example, the operator symbol of inequality is "<>" in a certain language, and the operator symbol corresponding to the inequality under the SMT constraint expression specification is needed. In addition, the assignment operator in the assignment statement in the third expression queue is uniformly corresponding to the equal operator under the SMT constraint expression specification.

[0099] The SMT constraint solving step, that is, the aforementioned step S45, performs SMT constraint solving on the SMT constraint encoding through an SMT constraint solver. If the SMT constraint encoding has a solution, it indicates that the current path is reachable, otherwise, it indicates that the current path is unreachable. Inputting the SMT constraint encoding into the SMT constraint solver for solving is familiar to those skilled in the art, and the processing process will not be repeated here.

[0100] In addition, it is pointed out that the aforementioned module of the present application is a virtual device corresponding to the steps in the method, and will not be repeated here.

Claims

1. A code verification method based on path traversal, characterized in that, Includes the following steps: Step S1: Obtain the source code and target statements; the target statements are the code statements in the source code. Step S2: Convert the source code into a control flow graph; Step S3: By decomposing the loop body step by step, find all paths from the program entry point to the target statement whose length does not exceed K in the control flow graph, and form a path set; Step S4: Traverse each path in the path set and verify the reachability of each traversed path; If the current path is reachable, end the verification; if the current path is unreachable, perform reachability verification on the next path in the path set, until all paths in the path set have been verified as reachable. Step S4, verifying the path, includes the following steps: Step S41: Traverse each path node of the current path in order, and extract expressions about program variables in order according to the source code corresponding to the current path node to form the first expression queue. Step S42: Based on the order of the first expression queue, simplify the expression calculation according to the expression of the assignment statement preceding the current expression to obtain the second expression queue; Step S43: By analyzing the scope of program variables, irrelevant expressions in the second expression queue are eliminated to obtain the third expression sequence: If the target statement is outside the scope of the program variable, the expression corresponding to the program variable is eliminated from the second expression queue; If there is no referenced expression between the assignment statements of a program variable, then delete the assignment statement preceding the program variable. Step S44: Construct constraint variables based on the sequence number of program variable assignment operations and the element offset of array variables. Replace the program variables of each expression in the third expression queue with constraint variables to form the corresponding SMT constraint expressions and compose SMT constraint codes. Step S45: Solve the SMT constraint code using the SMT constraint solver. If a solution exists for the SMT constraint code, the current path is reachable; otherwise, the current path is unreachable.

2. A code verification device based on path traversal, characterized in that, Includes the following modules: Module M1 is used to: obtain source code and target statements; the target statements are code statements in the source code; Module M2 is used to: convert the source code into a control flow graph; Module M3 is used to: find all paths from the program entry point to the target statement with a length not exceeding K in the control flow graph by stepping through the loop body, and form a path set; Module M4 is used to: traverse the paths in the path set one by one and verify the reachability of the traversed paths; If the current path is reachable, end the verification; if the current path is unreachable, perform reachability verification on the next path in the path set, until all paths in the path set have been verified as reachable. The path verification in module M4 includes the following modules: Module M41 is used to: sequentially traverse each path node of the current path, extract expressions about program variables in sequence according to the source code corresponding to the current path node, and form the first expression queue. Module M42 is used to: simplify the expression calculation based on the expression of the assignment statement preceding the current expression according to the order of the first expression queue to obtain the second expression queue; Module M43 is used to: eliminate irrelevant expressions in the second expression queue by analyzing the scope of program variables to obtain the third expression sequence; if the target statement is outside the scope of the program variable, then the expression corresponding to the program variable is eliminated from the second expression queue. If there is no referenced expression between the assignment statements of a program variable, then delete the assignment statement preceding the program variable. Module M44 is used to: construct constraint variables based on the number of times the program variable is assigned and the element offset of the array variable; replace the program variables of each expression in the third expression queue with constraint variables to form the corresponding SMT constraint expression, and form SMT constraint code. Module M45 is used to: solve the SMT constraint code using the SMT constraint solver. If a solution exists for the SMT constraint code, it means that the current path is reachable; otherwise, it means that the current path is unreachable.

3. A medium; the medium storing a set of program instructions that can be read by a machine; characterized in that, When the program instruction set stored in the medium is read and executed by the machine, the code verification method based on path traversal as described in claim 1 can be implemented.

4. A device; the device comprising a processor and a memory; the memory storing a program instruction set; characterized in that, When the program instruction set stored in the memory is loaded and executed by the processor, the code verification method based on path traversal as described in claim 1 can be implemented.

Images