A program slice-based code defect detection method

Abstract

The present application relates to the technical field of program defect detection, and particularly relates to a code defect detection method based on program slicing.A code defect detection method based on program slicing, comprising the following steps: generating a sensitive variable list, a correlation list of function calls and function declarations, and a variable correlation set of sensitive variables; extracting semantic dependency information in the code, and corresponding supplementing to ordinary nodes, function declaration nodes and function call nodes, establishing a control flow variable dependency graph of the program, establishing a control flow variable dependency graph of a cross function, step 5, traversing the control flow variable dependency graph of the cross function to perform slicing, taking variables in the sensitive variable list and variables in the variable correlation set of the sensitive variable as variables to be tracked in a new slicing stage, the present application takes variables in the set as variables to be tracked in a slicing stage to perform slicing, and performs semantic analysis and constraint checking on statements in the result, thereby improving the defect detection rate.

Description

Technical Field

[0001] This invention relates to the field of program defect detection technology, and more specifically to a code defect detection method based on program slicing. Background Technology

[0002] Currently, program defect detection is an important research topic in software security analysis and reasoning. Examining potential defects in code through semantic analysis, discovering defect patterns and rules based on code features, identifying potential problems based on the relationship between control flow and data flow, and judging whether program behavior meets expectations based on behavioral characteristics are effective directions for identifying program defects.

[0003] Program slicing aids in semantic segmentation, understanding relationships between code segments, and analyzing contextual information, thus improving program comprehension and reducing computational complexity. By leveraging program scalability, program slicing can identify and extract key statements that are affected by variables or influence variables up to fixed points, and eliminate noise statements according to slicing rules for flexible program understanding. Since the sliced ​​program and the source program have semantically consistent execution results, preprocessing the input program using slicing techniques makes it easier to obtain data flow and control flow trajectories, and the efficiency of sliced ​​program analysis is often superior to traditional program analysis.

[0004] Extracting program feature information for code defect analysis and applying system dependencies to program slice analysis are currently hot topics and challenges in program understanding. Despite multi-faceted explorations, a common problem is that traditional semantic logic understanding methods have certain limitations. The semantics and environment of the program, code dependencies and contextual information, and sensitive information need to be considered as references for obtaining correct program semantic understanding. For example, Chen et al. (Chen Q, Cheng K, Zheng Y, et al. Function-level data dependence graph and its application instatic vulnerability analysis[J]. Journal of Software, 2020, 31(11):3421-3435.) Stores variable context and semantic information in a function-level data dependency graph (FDDG) with functions as nodes, clearly and intuitively showing data flow dependencies and improving parameter backtracking efficiency. However, its graph granularity is relatively coarse, ignoring instruction set information and the specific implementation inside the function, and is not suitable for scenarios such as program slicing and pointer analysis. On the other hand, many methods for forming program slices based on semantic segmentation for program understanding have limitations in slicing rules. Either incomplete slicing methods affect the correctness of defect detection results and the slicing accuracy is low, or the scale of the related dependency graph traversed during slicing is large, and the slicing process lacks corresponding control and constraint mechanisms. Ahmadi et al. (Ahmadi M, Farkhani RM, Williams R, et al. Finding bugs using your own code: detecting functionally-similar yet inconsistent code[C] / / Proc of the 30th USENIX Security Symposium, Online:USENIX, 2021, (pp.2025-2040.) proposes a machine learning-based code defect detection method involving code snippets with similar functions but inconsistent forms. By comparing the similarity and differences between code snippets, it can discover various defects such as the lack of checks for unsafe type conversions. However, it is not suitable for large systems (such as the Linux kernel) and it loses some valuable snippets. The slicing rules are incomplete and the slicing granularity is too coarse, resulting in poor detection performance. Summary of the Invention

[0005] The purpose of this invention is to improve a code defect detection method based on program slicing that accelerates the drawing and slicing speed and improves the accuracy of defect detection.

[0006] The technical solutions for achieving the above objectives include the following:

[0007] A code defect detection method based on program slicing includes the following steps: Step 1, record the sensitive variable operations involved in the program, generate a sensitive variable list, a function call and function declaration association list, and a variable association set of sensitive variables. The variable association set indicates the associated line number and associated object. The structure of the sensitive variable list is: [sensitive variable, operation line number]. If the sensitive variable list is empty, the method terminates. If the sensitive variable list is not empty, step 2 is executed. Step 2: Create regular nodes, function declaration nodes, and function call nodes corresponding to the statements, extract semantic dependency information from the code, and supplement them accordingly into the regular nodes, function declaration nodes, and function call nodes. Among them, a regular node represents a statement operation, a function declaration node represents a function declaration operation, and a function call node represents a function call operation; Step 3: Add sequential control edges, conditional selection edges, or loop logic edges according to the statement control execution logic to establish the program's control flow variable dependency graph, and add the completed program control flow variable dependency graph to the program control flow variable dependency graph set; Step 4: Based on the association list of function calls and function declarations obtained in Step 1, find the declaration line number corresponding to the function, build the control flow variable dependency graph of the cross function starting from the declaration line number, add it to the control flow variable dependency graph set of the cross function, and execute Step 5. Step 5: Treat each parameter and return value of the cross function as a variable to be tracked during the slicing phase. Traverse the control flow variable dependency graph of the cross function to perform slicing. During slicing, the relevant slicing constraint rules should be satisfied. After slicing, the slicing results of the parameters and return values ​​are stored incrementally. At the same time, the slice contour is mapped to the subset of slicing results of the declared nodes of the control flow variable dependency graph of the cross function. The slice constraint rules are proposed based on the program's data dependency type and control structure type. The data dependency types include input dependency, output dependency, definition-use dependency, parameter passing dependency, and return value dependency. Input dependency means that for node 2, which directly or indirectly governs node 1, if a variable is used in the statement corresponding to node 1, the statement corresponding to node 2 also uses that variable. Output dependency means that for node 2, which directly or indirectly governs node 1, if a variable is defined in the statement corresponding to node 1, the statement corresponding to node 2 also defines that variable. Definition-use dependency means that for node 2, which directly or indirectly governs node 1, if a variable is defined in the statement corresponding to node 1, the statement corresponding to node 2 uses that variable. Parameter passing dependency means that for a function calling node, if parameters need to be passed to execute the function, the calling node has a passing dependency on the actual and formal parameters of the corresponding declaration node. Return value dependency means that if the right side of an assignment statement is a function call and the left side is a variable to be assigned, the calling node has a function return value assignment dependency. The output dependency slicing rule is that if statement 1 (corresponding to node 1) and statement 2 (corresponding to node 2) satisfy the output dependency, then the line numbers of the statements stored in the corresponding nodes of both should be stored in the slice outline. The input dependency slicing rule is that if statements 1 and 2 satisfy the input dependency, then the line numbers of the statements stored in the corresponding nodes of both should be stored in the slice outline. The definition of dependency slicing rules is as follows: if statements 1 and 2 satisfy the defined dependency usage, then the line numbers of the statements stored in the corresponding nodes of both statements will be stored in the slice outline. The parameter passing slicing rule is as follows: if a function call statement passes actual arguments to a function, meaning the function call statement and its corresponding function declaration statement satisfy parameter passing dependency, then the corresponding parameter slice is used as a sub-slice of the final slicing result and stored in the final slice outline. The return value passing slicing rule is as follows: if the left side of the assignment statement is a variable and the right side is a function call, that is, the assignment statement and the return value statement satisfy return value dependency, then the corresponding return value slice is used as a sub-slice of the final slicing result and stored in the final slice outline. The control structure types include sequential execution structures, conditional judgment structures, and loop judgment structures. The relevant slicing rules are as follows. Skip reduction rule: Node 1 executes sequentially to Node 2, Node 2 executes to Node 3. If the statement corresponding to Node 1 belongs to the slice profile, and Node 2 has no data dependency with variables, then the slice profile skips Node 2 and calculates the data dependency of Node 3. Conditional judgment rule: If a conditional judgment statement uses variables from the slicing criteria, the conditional judgment statement will not be added to the slice temporarily. When the execution statement in the conditional branch uses or defines variables, the line numbers of the statements stored in the corresponding nodes of the conditional judgment statement and the branch execution statement will be added to the slice outline. Loop condition rule: If the loop condition statement uses variables from the slicing criteria, the loop condition statement will not be added to the slice immediately. When variables are used or defined in the loop body, the line numbers of the statements stored in the corresponding nodes of the loop condition statement and the statements executed within the loop body will be added to the slice outline. Preserving control structure rules: If the statement is an unconditional jump or other statement representing a control structure, such as a break statement, else statement, or return statement, in order to ensure the semantic integrity of the slice control structure, the statement line number stored in the corresponding node is added to the slice outline. Step 6: Using the variables in the sensitive variable list obtained in Step 1 and the variables in the variable association set of the sensitive variable as the variables to be tracked in the new slicing stage, traverse the program control flow variable dependency graph obtained in Step 3 according to the relevant data dependencies, find the statements that affect the variable, and save the slicing results. The slicing should also meet the slicing constraint rules described in Step 5. When encountering a function call node while traversing the program control flow dependency graph for slicing, extract the slicing outline of the parameters or return values ​​saved in the declaration node of the control flow variable dependency graph of the cross function according to the parameter passing dependency and return value dependency relationship, and add it as a sub-slice to the final slicing result. Step 7: Using the defect constraints provided by the defect feature library, perform a correctness check on the statements in the slice results of each sensitive variable obtained in Step 6 to determine whether the statement operations conform to the constraints. If not, report the error status. The defect feature library includes operational constraints on relevant sensitive variables, such as the correct pairing of memory allocation and deallocation functions, boundary checks for array or pointer index elements, and conditions for integer overflow in operations such as modulo.

[0008] Furthermore, the structure of the ordinary node mentioned in step 2 is: [line number, definition set, usage set, type]. The line number indicates the position of the program where the statement operation occurs; the definition set indicates the set of new or redefined variables defined by this code statement; the usage set indicates the set of variables used by this code statement; and the type indicates the statement type, including conditional statements, loop statements, variable definition statements, addition assignment statements, pointer behavior operation statements, buffer behavior operation statements, operating system function call statements, etc. The structure of the function declaration node in step 2 is: [declaration line number, function name, formal parameters, return value, slice result subset]. The declaration line number indicates the position of the statement declaring the function in the program; the function name indicates the name of the function; the formal parameters indicate the formal parameters defined by the function; the slice result subset indicates the slice result set of the function's parameters and return value, which is associated with the slices of the same function's parameters and return value in the total slice list of all functions' parameters and return values, with the structure [<formal parameters, {statement 1 line number, statement 2 line number…}>, <return value, {statement 1 line number, statement 2 line number…}>]. The structure of the function call node in step 2 is: [call line number, declaration line number, actual parameters, definition set]. The call line number indicates the position of the statement that calls the function each time, to distinguish the slices involved in calling the same function with different parameters or calling the same function with the same parameters on different lines; the declaration line number indicates the position of the statement that declares the function, which is consistent with the declaration line number of the corresponding function declaration node; the actual parameters indicate the actual parameters passed to the function call; the definition set indicates the set of new variables or redefined variables defined by the statement, generally the variables assigned by the function return.

[0009] Furthermore, the structure of the control flow variable dependency graph mentioned in step 3 is: [entry node, set of ordinary nodes, set of function declaration nodes, set of function call nodes, set of control flow connection edges]. The connection edge structure in the control flow connection edge set is: <node 1 line number, type, node 2 line number>, where type represents the execution logic from node 1 to node 2.

[0010] Furthermore, the linear logic includes sequential execution, branch edges for statements that are true, branch edges for statements that are false, the start edge of loop execution, and the end edge of loop execution.

[0011] This invention utilizes the execution logic order provided by the control flow to construct a control flow variable dependency graph corresponding to programs and functions based on nodes that store semantic dependency information. It clearly distinguishes control dependency paths and data transfer operations, and precisely defines the dependencies between variables by limiting the granularity of dependency association information stored within nodes to variables. By mapping the slice result sets of parameters and return values ​​of each function stored in the total slice list of parameters and return values ​​to the slice result subsets in the function declaration nodes, it reduces the number of times duplicate nodes and parameter dependency edges are established, significantly reducing the number of nodes and connecting edges in the dependency graph, thus decreasing the graph size and optimizing the inter-process slicing effect. By describing relevant dependencies and specifying slicing rules, the method can effectively extract statements affecting sensitive variables based on dependency semantics and flexible rules. By obtaining the variable association set of sensitive variables and slicing the variables in the set as variables to be tracked in the slicing stage, it eliminates dependency gaps caused by indirect dependency characteristics, generates relevant slicing results, and performs semantic analysis and constraint checks on the statements in the results, improving the defect detection rate. Attached Figure Description

[0012] Figure 1 This is a schematic diagram illustrating a code defect detection process based on program slicing, as shown in the embodiment. Figure 2 Example diagram of the process of obtaining the associated set for variables; Figure 3 Example diagram of the process of constructing the control flow variable dependency graph for the program and cross functions; Figure 4 This is an example diagram of the program slicing process for variable x. Detailed Implementation

[0013] The present invention will be described in detail below with reference to the embodiments and related drawings.

[0014] See Figure 1 In the diagram, numbers 1, 2...7 represent step numbers. The arrow outside the dashed box on the left represents the method's input: the code of the program under test. The arrow below the dashed box on the right represents the method's output: the slice outline of sensitive variables. The two dashed boxes contain the main content of the method; the main stages and rules of the method include: obtaining the variable association set, constructing the control flow variable dependency graph of the program and cross functions, slice constraint rules, slice stages, and the slice outline of parameters and return values.

[0015] A code defect detection method based on program slicing includes the following steps: Step 1, record the sensitive variable operations involved in the program, generate a sensitive variable list, a function call and function declaration association list, and a variable association set of sensitive variables. The variable association set indicates the associated line number and associated object. The structure of the sensitive variable list is: [sensitive variable, operation line number]. If the sensitive variable list is empty, the method terminates. If the sensitive variable list is not empty, step 2 is executed. Step 2: Create regular nodes, function declaration nodes, and function call nodes corresponding to the statements, extract semantic dependency information from the code, and supplement them accordingly into the regular nodes, function declaration nodes, and function call nodes. Among them, a regular node represents a statement operation, a function declaration node represents a function declaration operation, and a function call node represents a function call operation; Step 3: Add sequential control edges, conditional selection edges, or loop logic edges according to the statement control execution logic to establish the program's control flow variable dependency graph, and add the completed program control flow variable dependency graph to the program control flow variable dependency graph set; Step 4: Based on the association list of function calls and function declarations obtained in Step 1, find the declaration line number corresponding to the function, build the control flow variable dependency graph of the cross function starting from the declaration line number, add it to the control flow variable dependency graph set of the cross function, and execute Step 5. Step 5: Treat each parameter and return value of the cross function as a variable to be tracked during the slicing phase. Traverse the control flow variable dependency graph of the cross function to perform slicing. During slicing, the relevant slicing constraint rules should be satisfied. After slicing, the slicing results of the parameters and return values ​​are stored incrementally. At the same time, the slice contour is mapped to the subset of slicing results of the declared nodes of the control flow variable dependency graph of the cross function. The slice constraint rules are proposed based on the program's data dependency type and control structure type. The data dependency types include input dependency, output dependency, definition-use dependency, parameter passing dependency, and return value dependency. Input dependency means that for node 2, which directly or indirectly governs node 1, if a variable is used in the statement corresponding to node 1, the statement corresponding to node 2 also uses that variable. Output dependency means that for node 2, which directly or indirectly governs node 1, if a variable is defined in the statement corresponding to node 1, the statement corresponding to node 2 also defines that variable. Definition-use dependency means that for node 2, which directly or indirectly governs node 1, if a variable is defined in the statement corresponding to node 1, the statement corresponding to node 2 uses that variable. Parameter passing dependency means that for a function calling node, if parameters need to be passed to execute the function, the calling node has a passing dependency on the actual and formal parameters of the corresponding declaration node. Return value dependency means that if the right side of an assignment statement is a function call and the left side is a variable to be assigned, the calling node has a function return value assignment dependency. The output dependency slicing rule is that if statement 1 (corresponding to node 1) and statement 2 (corresponding to node 2) satisfy the output dependency, then the line numbers of the statements stored in the corresponding nodes of both should be stored in the slice outline. The input dependency slicing rule is that if statements 1 and 2 satisfy the input dependency, then the line numbers of the statements stored in the corresponding nodes of both should be stored in the slice outline. The definition of dependency slicing rules is as follows: if statements 1 and 2 satisfy the defined dependency usage, then the line numbers of the statements stored in the corresponding nodes of both statements will be stored in the slice outline. The parameter passing slicing rule is as follows: if a function call statement passes actual arguments to a function, meaning the function call statement and its corresponding function declaration statement satisfy parameter passing dependency, then the corresponding parameter slice is used as a sub-slice of the final slicing result and stored in the final slice outline. The return value passing slicing rule is as follows: if the left side of the assignment statement is a variable and the right side is a function call, that is, the assignment statement and the return value statement satisfy return value dependency, then the corresponding return value slice is used as a sub-slice of the final slicing result and stored in the final slice outline. The control structure types include sequential execution structures, conditional judgment structures, and loop judgment structures. The relevant slicing rules are as follows. Skip reduction rule: Node 1 executes sequentially to Node 2, Node 2 executes to Node 3. If the statement corresponding to Node 1 belongs to the slice profile, and Node 2 has no data dependency with variables, then the slice profile skips Node 2 and calculates the data dependency of Node 3. Conditional judgment rule: If a conditional judgment statement uses variables from the slicing criteria, the conditional judgment statement will not be added to the slice temporarily. When the execution statement in the conditional branch uses or defines variables, the line numbers of the statements stored in the corresponding nodes of the conditional judgment statement and the branch execution statement will be added to the slice outline. Loop condition rule: If the loop condition statement uses variables from the slicing criteria, the loop condition statement will not be added to the slice immediately. When variables are used or defined in the loop body, the line numbers of the statements stored in the corresponding nodes of the loop condition statement and the statements executed within the loop body will be added to the slice outline. Preserving control structure rules: If the statement is an unconditional jump or other statement representing a control structure, such as a break statement, else statement, or return statement, in order to ensure the semantic integrity of the slice control structure, the statement line number stored in the corresponding node is added to the slice outline. Step 6: Using the variables in the sensitive variable list obtained in Step 1 and the variables in the variable association set of the sensitive variable as the variables to be tracked in the new slicing stage, traverse the program control flow variable dependency graph obtained in Step 3 according to the relevant data dependencies, find the statements that affect the variable, and save the slicing results. The slicing should also meet the slicing constraint rules described in Step 5. When encountering a function call node while traversing the program control flow dependency graph for slicing, extract the slicing outline of the parameters or return values ​​saved in the declaration node of the control flow variable dependency graph of the cross function according to the parameter passing dependency and return value dependency relationship, and add it as a sub-slice to the final slicing result. Step 7: Using the defect constraints provided by the defect feature library, perform correctness checks on the statements in the slice results of each sensitive variable obtained in Step 6, and detect execution errors. The defect feature library includes operational constraints on relevant sensitive variables, such as the correct pairing of memory allocation and deallocation functions, boundary checks for array or pointer index elements, and conditions for integer overflow caused by modulo instructions, etc.

[0016] Figures 2 to 4 This is an example diagram illustrating the application of the method described in the embodiment to perform defect detection on a certain program.

[0017] Figure 2 The diagram shows the process of obtaining the variable association set, which is as follows: 1. It is found that the member pointer p of the structure instance t1 is assigned to the member of t2. Then, t2 and t1 are added to each other's variable association set. The association set of t1 at this time is [(5,t2)]. 2. When the member pointer p of the parameter structure pf of the invokefun2 function is assigned to the new pointer x, pf and x should be added to each other's variable association set respectively. At this time, the association set of x is [(8, pf)].

[0018] Figure 3 The diagram shows the process of constructing the control flow variable dependency graph. The analysis process is as follows: 1. Take statement 1 as the entry node of the program's control flow variable dependency graph, and then construct node 1, node 2 and node 3 according to the node definition; and connect the sequential execution edges from node 1 to node 2 and from node 2 to node 3 in sequence; 2. Statement 4 is a multiplication assignment statement, which constructs node 4. The node stores information as [line number: 4, definition set: z, usage set: x, y, type: multiplication assignment]. Statements 3 to 4 are executed in sequence, so the sequential execution edge connecting node 3 to node 4 is formed. 3. Statement 5 is a conditional statement. Node 5 is constructed, and the node stores the information as [line number: 5, definition set: empty, usage set: x, y, type: conditional statement]; 4. Statement 6 is a function call statement, and the node storage information is [call line number: 6, declaration line number: 12, actual parameter: x, definition set: m]; 5. Create the relevant nodes corresponding to statements 7 to 11 in sequence, and connect the relevant control edges to complete the construction of the program's control flow variable dependency graph; 6. Based on the function call and function declaration association list, find the declaration line number 12 corresponding to the function MethodInvoke. Statement 12 is the function declaration statement, and the node storage information is [declaration line number: 12, function name: MethodInvoke, formal parameter: para, return value: backvalue, slice result subset]; 7. Create the nodes corresponding to statements 13 to 17 in sequence and connect them with control edges. When the loop condition of statements 14 to 16 is executed, connect the loop start edge and the loop end edge. The control flow variable dependency graph of the cross function MethodInvoke is completed.

[0019] Figure 4 The diagram shows the process of slicing variable x in the program, and the process of extracting the slice outline is as follows: 1. Use the parameter para of the cross function MethodInvoke as the variable to be tracked in the slicing phase, traverse the control flow variable dependency graph of the cross function to perform slicing, and add the line number of statement 12 to the slice outline of variable para. 2. Statement 13 has no dependency on the variable para. According to the skip reduction rule, statement 13 is skipped, and statement 14 is accessed. 3. According to the parameter passing slicing rules, nodes 12 and 14 satisfy the parameter passing dependency. The statement line number stored in node 14 is added to the slice outline. The same applies to other nodes. 4. After the cross function parameter slicing is completed, the slicing result of para is added to the total slicing list of parameters and return values, and associated with the slicing result subset of node 12; 5. Treat variable x as the new variable to be tracked in the slice phase, traverse the program control flow variable dependency graph, and add the line number of the program entry node statement 1 to the slice outline of variable x. 6. If the definition set of node 2 contains the slicing criterion variable x, then add the statement line number stored in node 2 to the slicing outline of x; 7. According to the definition of the dependency slicing rule, nodes 3 and 2 satisfy the definition of dependency slicing. Add the statement line number stored in node 3 to the slice outline of variable x. 8. According to the input dependency slicing rules, add the statement line numbers stored in nodes 4 and 5 to the slice outline of variable x; 9. When traversing to the statement node on line 6, it is found to be a function call node. Based on the function name MethodInvoke, the declaration line number 12 corresponding to the function MethodInvoke in the function call and function declaration association list is searched. The slice profile of para in the slice result subset of the cross function control flow variable dependency graph declaration node 12 is extracted and added to the slice profile of x. 10. Traverse node 7, and according to relevant rules and dependencies, add the line numbers of statements stored in nodes 9 and 10 to the slice outline to complete the extraction of the slice outline.

Claims

1. A code defect detection method based on program slicing, characterized in that, Includes the following steps: Step 1: Record the operations involving sensitive variables in the program, generate a list of sensitive variables, an association list of function calls and function declarations, and a variable association set of sensitive variables. The variable association set indicates the associated line number and associated object. The structure of the sensitive variable list is: [sensitive variable, operation line number]. If the sensitive variable list is empty, the method terminates. If the sensitive variable list is not empty, proceed to step 2. Step 2: Create ordinary nodes, function declaration nodes, and function call nodes corresponding to the statements, extract semantic dependency information from the code, and supplement them accordingly to the ordinary nodes, function declaration nodes, and function call nodes. Here, an ordinary node represents a statement operation, a function declaration node represents a function declaration operation, and a function call node represents a function call operation. Step 3: Add sequential control edges, conditional selection edges, or loop logic edges according to the statement control execution logic to establish the program's control flow variable dependency graph, and add the completed program control flow variable dependency graph to the program control flow variable dependency graph set; Step 4: Based on the association list of function calls and function declarations obtained in Step 1, find the declaration line number corresponding to the function, build the control flow variable dependency graph of the cross function starting from the declaration line number, add it to the control flow variable dependency graph set of the cross function, and execute Step 5. Step 5: Take each parameter and return value of the cross function as the variable to be tracked in the slicing stage, traverse the control flow variable dependency graph of the cross function to perform slicing, and the slicing constraint rules should be satisfied when slicing is performed. After slicing, the slicing results of parameters and return values ​​are stored in an incremental manner, and the slicing contour is mapped to the slicing result subset of the declaration node of the control flow variable dependency graph of the cross function. The slice constraint rules are proposed based on the program's data dependency type and control structure type; The data dependency types include input dependency, output dependency, definition and usage dependency, parameter passing dependency, and return value dependency. Input dependency means that for node 2, which directly or indirectly governs node 1, after the variable is used in the statement corresponding to node 1, the statement corresponding to node 2 also uses the variable. Output dependency means that for node 2, which directly or indirectly governs node 1, if a variable is defined in the statement corresponding to node 1, the statement corresponding to node 2 will also define that variable. The definition of dependency indicates that for node 2, which directly or indirectly governs node 1, the statement corresponding to node 2 uses the variable after the statement corresponding to node 1 defines the variable. Parameter passing dependency means that for a function calling node, if parameters need to be passed to execute the function, then the calling node has a passing dependency on the actual parameters and formal parameters of the corresponding declaration node. Return value dependency means that if the right side of an assignment statement is a function call and the left side is a variable to be assigned, then the calling node has a function return value assignment dependency. The output dependency slicing rule is that if statement 1 of corresponding node 1 and statement 2 of corresponding node 2 satisfy the output dependency, then the statement line numbers stored in the corresponding nodes are stored in the slice outline. The input dependency slicing rule is that if statement 1 and statement 2 satisfy the input dependency, then the statement line numbers stored in the corresponding nodes of the two statements are stored in the slice outline. The definition of using dependency slicing rules is as follows: if statement 1 and statement 2 satisfy the definition of using dependency, then the statement line numbers stored in the corresponding nodes of both will be stored in the slice outline. The parameter passing dependency slicing rule is that if a function call statement passes actual arguments to a function, that is, the function call statement and the corresponding function declaration statement satisfy the parameter passing dependency, then the corresponding parameter slice is used as a sub-slice of the final slicing result and stored in the final slice outline. The return value dependency slicing rule is that if the left side of the assignment statement is a variable and the right side is a function call, that is, the assignment statement and the return value statement satisfy the return value dependency, then the corresponding return value slice is used as a sub-slice of the final slicing result and stored in the final slice outline. The control structure types include sequential execution structures, conditional judgment structures, and loop judgment structures. The relevant slicing rules are as follows: Skip reduction rule: Node 1 is executed sequentially to reach Node 2, and Node 2 is executed to reach Node 3. If the statement corresponding to Node 1 belongs to the slice profile and Node 2 has no data dependency relationship with the variable, then the slice profile skips Node 2 and calculates the data dependency relationship of Node 3. Conditional judgment rule: If the conditional judgment statement uses variables in the slice criteria, the conditional judgment statement will not be added to the slice for the time being. When the execution statement in the conditional branch uses or defines variables, the statement line number stored in the corresponding node of the conditional judgment statement and the branch execution statement will be added to the slice outline. Loop condition rule: If the loop condition statement uses a variable in the slicing criteria, the loop condition statement will not be added to the slice for the time being. When the loop body execution statement uses or defines a variable, the statement line number stored in the corresponding node of the loop condition statement and the execution statement in the loop body will be added to the slice outline. Preserve control structure rules: If the statement is an unconditional jump or other statement representing a control structure, then add the statement line number stored in the node corresponding to the statement to the slice outline; Step 6: Using the variables in the sensitive variable list obtained in Step 1 and the variables in the variable association set of the sensitive variable as the variables to be tracked in the new slicing stage, traverse the program control flow variable dependency graph obtained in Step 3 according to the relevant data dependencies, find the statements that affect the variable, and save the slicing results. The slicing should also meet the slicing constraint rules described in Step 5. When encountering a function call node while traversing the program control flow dependency graph for slicing, extract the slicing outline of the parameters or return values ​​saved in the declaration node of the control flow variable dependency graph of the cross function according to the parameter passing dependency and return value dependency relationship, and add it as a sub-slice to the final slicing result. Step 7: Using the defect constraints provided by the defect feature library, perform a correctness check on the statements in the slice results of each sensitive variable obtained in Step 6 to determine whether the statement operation conforms to the constraints. If it does not conform, report the error status.

2. The code defect detection method based on program slicing according to claim 1, characterized in that, The structure of the ordinary node mentioned in step 2 is: [line number, definition set, usage set, type]. The line number indicates the position of the statement operation in the program; the definition set indicates the set of new or redefined variables defined by the corresponding code statement; and the usage set indicates the set of variables used by the corresponding code statement. The type indicates the statement type, including conditional statements, loop statements, variable definition statements, addition assignment statements, pointer behavior operation statements, buffer behavior operation statements, and operating system function call statements; The structure of the function declaration node in step 2 is: [declaration line number, function name, formal parameters, return value, slice result subset]. The declaration line number indicates the position of the statement declaring the function in the program; the function name indicates the name of the function; the formal parameters indicate the formal parameters defined by the function; the slice result subset indicates the slice result set of the parameters and return values ​​in the function, which is associated with the slices of the same function in the total slice list of parameters and return values ​​of all functions, with the structure [<formal parameters, {statement 1 line number, statement 2 line number…}>, <return value, {statement 1 line number, statement 2 line number…}>]. The structure of the function call node in step 2 is: [call line number, declaration line number, actual parameters, definition set]. The call line number indicates the position of the statement that calls the function each time, to distinguish the slices involved in calling the same function with different parameters or calling the same function with the same parameters on different lines; the declaration line number indicates the position of the statement that declares the function, which is consistent with the declaration line number of the corresponding function declaration node; the actual parameters indicate the actual parameters passed to the function call; the definition set indicates the set of new variables or redefined variables defined by the statement, which are the variables assigned to the function return value.

3. The code defect detection method based on program slicing according to claim 1, characterized in that, The structure of the control flow variable dependency graph mentioned in step 3 is: [entry node, set of ordinary nodes, set of function declaration nodes, set of function call nodes, set of control flow connection edges]. The connection edge structure in the control flow connection edge set is: <node 1 line number, type, node 2 line number>, where type represents the execution logic from node 1 to node 2.

4. The code defect detection method based on program slicing according to claim 1, characterized in that, The execution logic includes sequential execution, branch edges for statements that are true, branch edges for statements that are false, the start edge of loop execution, and the end edge of loop execution.

Images