Function pointer pointing analysis method, device and system based on continuation passing

Abstract

The application discloses a function pointer pointing analysis method, device and system based on continuation transmission, which comprises the following steps: selecting a point of interest function pointer, and initializing a related continuation transmission list and a pointing set; starting from a statement where the point of interest function pointer is located, performing intraprocedural analysis on a program in the direction opposite to a control flow, saving intraprocedural analysis results by using a function abstract, and updating the continuation transmission list and the pointing set according to the function abstract; if interprocedural action information is encountered, performing intraprocedural analysis on a function affected based on an influence generated by the interprocedural action information, returning to a direct predecessor of a statement where the interprocedural action information appears after the analysis is finished, and continuing to perform intraprocedural analysis; and when it is judged that the continuation transmission is in a termination state based on the continuation transmission list, outputting a corresponding pointing set. The application saves interprocedural action information of a program by using the characteristics of continuation transmission, takes out the information to return to intraprocedural calculation to obtain a result when needed, and improves the accuracy of pointer analysis.

Description

Technical Field

[0001] This invention belongs to the field of program analysis, specifically relating to a method, apparatus, and system for function pointer pointing analysis based on continuation passing. Background Technology

[0002] Continuation is a programming concept that refers to "what to do next." Through continuation, the program state can be saved and restored; that is, the current running state can be saved at any point in time, and when rollback is needed, it can return to a previously saved running state, thus achieving non-local control flow and complex program flow control. Continuation Passing Style (CPS) is a programming style in which functions explicitly pass the control flow of computation to the next computation step to be executed, rather than relying on the function's return value. Continuation Passing Style uses the concept of continuation to achieve explicit passing of computation control flow. The difference between Continuation Passing Style control flow and ordinary style control flow is that it does not return a value, but instead becomes a long chain of continuations.

[0003] Pointer analysis, also known as pointer analysis or alias analysis, determines the memory locations that pointer variables in a program can point to at runtime. Pointer analysis is a fundamental and crucial technique in program analysis, serving as a method for other techniques. Therefore, the accuracy of pointer analysis directly impacts the accuracy of these analytical results. For example, code defect detection is a vital part of program analysis, and memory leaks are a common code defect. Detecting memory leaks requires analyzing whether the address space of a pointer is correctly released after use, and pointer analysis provides this information. If the pointer analysis results are not precise enough, false positives may occur in the corresponding defect detection results; therefore, the accuracy of pointer analysis is paramount. Summary of the Invention

[0004] To address the aforementioned problems, this invention proposes a function pointer pointing analysis method, apparatus, and system based on continuation passing. By utilizing the characteristics of continuation passing, it saves information about the actions between program processes, retrieves the information when needed, returns it to the process to calculate the result, and greatly improves the accuracy of pointer analysis.

[0005] To achieve the above-mentioned technical objectives and effects, the present invention is implemented through the following technical solution:

[0006] In a first aspect, the present invention provides a function pointer pointing analysis method based on continuation passing, comprising:

[0007] Select the function pointer for the point of interest, and initialize the relevant continuation pass list and pointer set;

[0008] Starting from the statement where the point of interest function pointer is located, perform intra-procedural analysis on the program in the opposite direction of control flow. Save the intra-procedural analysis results using function summary, and update the continuation pass list and pointer set according to the function summary. During intra-procedural analysis, if inter-procedural interaction information is encountered, perform intra-procedural analysis on the affected functions based on the influence of the inter-procedural interaction information, according to the global variable influence rules or formal parameter influence rules. After the analysis is completed, return to the direct predecessor of the statement where the inter-procedural interaction information appears, and continue intra-procedural analysis.

[0009] When it is determined that the continuation of transmission is in a terminated state based on the continuation transmission list, the corresponding pointer set is output as the pointer information of the interest point function pointer.

[0010] Optionally, the method further includes the following step before selecting the interest point function pointer:

[0011] 1.1) Based on the program code to be analyzed, generate a program call graph and a control flow graph;

[0012] 1.2) Based on the program call graph and control flow graph, save the predecessor node of each statement and the parent function of each function in the program code to be analyzed;

[0013] 1.3) Construct a function signature table of all function names in the program to be analyzed. The functions in the function signature table need to have type signatures.

[0014] 1.4) Construct symbolic parameters, wherein the symbolic parameters are in the form of Where A is the function signature and x is the parameter; when x > 0, parameter x represents the x-th parameter of function A; when x < 0, parameter x represents the -x-th global variable in the global variable table;

[0015] 1.5) Construct the following data structures: Abstract state S, where each element is a quintuple (L, RS, AQ, AQC, PT); Function digest Sum, where each element is a quadruple (FN, AQ, AQC, PT); Sleep set T, where each element is a quintuple (L, RS, AQ, AQC, PT); Pointer set PTS, containing only PT elements; Continuation pass list CPS, in the form of (CHC, CH) tuples, used to express the characteristics of inter-process information transfer, where FN represents the function signature, L represents the line number, RS represents the alias set, AQ represents the symbolic parameter queue, AQC represents the symbolic parameter cache, PT represents the pointer set, CH represents the data channel, and CHC represents the channel cache.

[0016] 1.6) Construct a global variable table to store all global variables in the program to be analyzed.

[0017] Optionally, the step of selecting the interest point function pointer and initializing the relevant continuation pass list and pointer set includes the following steps:

[0018] First, scan the program to find the line number of all function pointers, the signature of the function pointer, and the signature of the function to which it belongs, and organize them into a triplet and store them in the interest table;

[0019] 2.1) Generate points of interest (f, l, r), where f represents the function signature, l represents the line number of the function pointer, and r represents the signature of the function pointer;

[0020] 2.2) Initialize the pointer to the set PTS to be empty. The function flag F = f is initialized to indicate that the function being analyzed is f;

[0021] The abstract state S is initialized based on the points of interest. The initialization function cache (FC) is empty, and the continuation pass list (CPS) is empty.

[0022] Optionally, the method for obtaining the pointer information of the interest point function includes the following steps:

[0023] 3) Initialize the dormant set T as an empty set.

[0024] 4) Traverse the abstract state S, where the elements are represented by (L, RS, AQ, AQC, PT), and add the elements of the set that satisfy the condition L = 0 to the dormant set T;

[0025] 5) Traverse the abstract state S, where the elements are represented by (L, RS, AQ, AQC, PT), and delete all set elements that satisfy the condition L = 0;

[0026] 6) If the abstract state S is not an empty set, then first initialize the new abstract state S′ as an empty set. Initialize the analyzed path set WL as an empty set. Then, randomly select one element (L, RS, AQ, AQC, PT) from the old abstract state S. Next, read the direct predecessor set of the statement corresponding to L. If it has not been analyzed, add it to the WL set. Iterate through the statements corresponding to the direct predecessor set, generate new iteration quantities according to the preset iteration generation rules, and add them to the new abstract state S′. Finally, continue to select elements from the old abstract state S until the old abstract state S is an empty set, and return to step 4 with the new abstract state S′.

[0027] 7) First, initialize the function summary to an empty set, then iterate through the dormant set T, where elements are represented by (L, RS, AQ, AQC, PT), where AQ... ′=extend(AQ,AQC), where the function extend(AQ,AQC) appends multiple values ​​from another sequence AQC to the end of the list AQ at once, and finally adds the element (F,AQ′,PT) to the function digest Sum, where F is the function label;

[0028] 8) Traverse the function summary Sum obtained in step 7), where the elements are represented by (FN, AQ, PT) to satisfy the condition. The PT corresponding to the element in the set is added to the set PTS;

[0029] 9) Traverse the function summary Sum, where elements are represented by (FN, AQ, PT), and those satisfying the condition... All elements of the set are deleted;

[0030] 10) Update the continuation pass list CPS, CHC = CHC∪Sum, CPS = (CHC, CH);

[0031] 11) Determine if the function cache FC is an empty set. If the function cache FC is not an empty set, proceed to step 12); if the function cache FC is an empty set, proceed to step 13).

[0032] 12) Retrieve a function cache (CR, CE, X, AQ, PT) from the function cache FC, update the function flag F = CR, indicating that the function CR is currently being analyzed; calculate the abstract state S according to whether the function CE is RET, where RET indicates that the function is in a return state;

[0033] 13) If the CH element in the continuation pass list CPS is not an empty set, then the continuation pass is in a backtracking state, and proceed directly to step 15);

[0034] 15) Continue the pass list CPS = (CHC, CH), take a digest (FN, AQ, PT) from CH in order, dequeue a symbolic parameter A(x) = Pop(AQ) from the symbolic parameter queue AQ, the dequeued symbolic parameter queue is AQ″, and determine whether A is equal to FN. If A = FN, then proceed to step 16; if A ≠ FN, then proceed to step 17.

[0035] 16) Calculate the function cache (FC) based on the downlink data stream generation rules, and generate the set of parent functions CR = {F1, F2, ..., F...} for function A. m}, where F1, F2, ..., F m As the parent function of function A, generate a function cache FC = {(F1,A,x,AQ″,PT),(F2,A,x,AQ″,PT),…,(F n ,A,x,AQ″,PT)},Return to step 11);

[0036] 17) Calculate the function cache FC according to the uplink data stream generation rules, generate function cache FC = {(A,RET,x,AQ″,PT)}, and return to step 11).

[0037] Optionally, step 5) further includes: if it is determined whether the abstract state S is an empty set, if the abstract state S is an empty set, then proceed to step 7) to update the function summary;

[0038] Step 6) also includes:

[0039] If the direct predecessor of the statement corresponding to L has been analyzed, then it is not necessary to analyze it again. Continue to extract elements from the old abstract state S until the old abstract state S is an empty set, and return to step 4 with the new abstract state S′.

[0040] Optionally, step 13) further includes:

[0041] If the CH element is an empty set, then the continuation of the pass is in a non-backtracking state, and proceed to step 14);

[0042] 14) If the CHC elements in the continuation propagation list CPS are empty, then the continuation propagation is in a terminated state, and the algorithm terminates; otherwise, if the CHC elements are not empty, then the continuation propagation is in a non-terminated state, and the continuation propagation list CPS is updated, CH = CHC. CPS = (CHC, CH), proceed to step 15).

[0043] Optionally, the preset iterative generation rules include:

[0044] 6.1) For program statements of the form R=N, the line number is k;

[0045] 6.2) If the set of direct predecessor statements is empty, then the newly generated iteration variable is (0, RS, AQ, AQC, PT);

[0046] 6.3) For a function declaration statement with function signature A, iterate through the formal parameters to determine if parameter R satisfies the condition R∈RS; assuming the x-th formal parameter satisfies the above condition, calculate AQC' = append(AQC, A(x)), then the newly generated iteration quantity is (0, RS, AQ, AQC', PT); if none of the formal parameters R satisfy the condition R∈RS, then, if Assuming the x-th variable r in the global variable table ∈ (RS∩GS), and calculating AQC'=append(AQC,A(-x)), then the newly generated iteration quantity is (0,RS,AQ,AQC′,PT); if there is no variable r that satisfies the above condition, then the newly generated iteration quantity is (0,RS,AQ,AQC,PT).

[0047] 6.4) For a function call statement, if the current statement line number is k, then... Assuming the x-th variable r∈(RS∩GS) in the global variable table, if we calculate AQC'=append(AQC,A(-x)), then the newly generated iteration quantity is (k,RS,AQ,AQC′,PT); if there is no variable r that satisfies the above condition, then the newly generated iteration quantity is (k,RS,AQ,AQC,PT).

[0048] Optionally, calculating the abstract state S based on whether the function CE is RET includes:

[0049] Step 12.1) If CE ≠ RET, it means that the function CE is a non-return type. Calculate the abstract state according to the generation rules affected by formal parameters. By linearly traversing the function CR, calculate the set K = {k1, k2, ..., k} of the line numbers of the function CE call point statements. n}, calculate abstract state Where R i Indicates the kth i The Xth actual parameter of the line statement, return to step 3);

[0050] If CE = RET, it means that function CE is a return type. The abstract state is calculated according to the generation rules of global variable influence. The function CR is linearly traversed to calculate the set of statement line numbers K = {k1, k2, ..., k} returned by function CR. n}, calculate abstract state Among them G i This represents the -Xth global variable name in the global variable table; return to step 3).

[0051] Secondly, the present invention provides a function pointer pointing analysis device based on continuation passing, comprising:

[0052] The initialization module is used to select the function pointer of the point of interest and initialize the relevant continuation pass list and pointer set. The analysis module is used to perform intra-procedural analysis of the program from the statement where the function pointer of the point of interest is located, in the opposite direction of the control flow, save the intra-procedural analysis results using function summary, and update the continuation pass list and pointer set according to the function summary. When performing intra-procedural analysis, if inter-procedural interaction information is encountered, the function affected by the inter-procedural interaction information is analyzed intra-procedurally according to the global variable influence rule or formal parameter influence rule. After the analysis is completed, the module returns to the direct predecessor of the statement where the inter-procedural interaction information appears and continues the intra-procedural analysis.

[0053] The output module is used to output the corresponding pointer set as the pointer information of the interest point function pointer when it is determined that the continuation is terminated based on the continuation transmission list.

[0054] Thirdly, the present invention provides a function pointer pointing analysis system based on continuation passing, including a storage medium and a processor;

[0055] The storage medium is used to store instructions;

[0056] The processor is configured to operate according to the instructions to perform the method according to any one of the first aspects.

[0057] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0058] This invention utilizes the characteristic of continuation propagation to preserve information between program processes. When needed, this information is retrieved and returned to the calculation result within the process to obtain the final pointer information. Traditional pointer analysis often only considers unidirectional information transfer between processes (such as information transfer from actual parameters to formal parameters, or only considers the impact of function side effects on pointers). However, this continuation chain can achieve bidirectional information flow analysis, thereby improving the accuracy of function pointer analysis.

[0059] This invention incorporates two pruning operations during the iteration process: pruning abstract states and pruning function summaries. These operations remove states that meet the conditions (i.e., are unrelated to the interest pointer), thereby reducing the search space and improving the performance of function pointer analysis.

[0060] This invention incorporates type system technology, including function type determination and function parameter type determination. Function type determination generates different function caches based on different function types to determine the upstream and downstream information flows. Function parameter type determination is used to determine whether the influence is from formal parameters or global variables, thereby improving the accuracy and reliability of inter-procedural pointer analysis. Attached Figure Description

[0061] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly described below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort, wherein:

[0062] Figure 1 This is a flowchart illustrating the function pointer pointing analysis method according to an embodiment of the present invention.

[0063] Figure 2 This is a flowchart illustrating the updating of an abstract state according to an embodiment of the present invention. Detailed Implementation

[0064] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0065] Furthermore, if the embodiments of this invention involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by this invention.

[0066] Example 1

[0067] like Figure 1 The diagram shown is a general flowchart of the function pointer pointing analysis method based on continuation passing in an embodiment of the present invention. It is applicable to function pointer pointing analysis methods based on continuation passing, and the analysis method includes the following steps:

[0068] Select the function pointer for the point of interest, and initialize the relevant continuation pass list and pointer set;

[0069] Starting from the statement where the point of interest function pointer is located, perform intra-procedural analysis on the program in the opposite direction of control flow. Save the intra-procedural analysis results using function summary, and update the continuation pass list and pointer set according to the function summary. During intra-procedural analysis, if inter-procedural interaction information is encountered, perform intra-procedural analysis on the affected functions based on the influence of the inter-procedural interaction information, according to the global variable influence rules or formal parameter influence rules. After the analysis is completed, return to the direct predecessor of the statement where the inter-procedural interaction information appears, and continue intra-procedural analysis.

[0070] When it is determined that the continuation of transmission is in a terminated state based on the continuation transmission list, the corresponding pointer set is output as the pointer information of the interest point function pointer.

[0071] The following is combined Figures 1-2 The present invention provides a detailed description of the function pointer pointing analysis method in the embodiments of the present invention, and a specific implementation method thereof.

[0072] Step 1) Program preprocessing, which specifically includes the following:

[0073] Step 1.1) Based on the program code to be analyzed, generate the program call graph and control flow graph;

[0074] Step 1.2) Based on the program call graph and control flow graph, save the predecessor node of each statement and the parent function of each function. At this point, all control statements are lost, leaving only assignment statements and function call statements.

[0075] Step 1.3) Construct a function signature table FS containing all function names in the program to be analyzed. To ensure the uniqueness of function names, all functions in the function signature table FS must include a type signature;

[0076] Step 1.4) Construct symbolic parameters, the form of which is: Where A is the function signature and x is the parameter; when x>0, parameter x represents the x-th parameter in function A; when x<0, parameter x represents the -x-th global variable in the global variable table.

[0077] Step 1.5) Construct the following data structure:

[0078] An abstract state S has elements in the form of a quintuple (L, RS, AQ, AQC, PT).

[0079] The function summary Sum has the element form of a quadruple (FN, AQ, AQC, PT);

[0080] A dormant set T, where each element is a quintuple (L, RS, AQ, AQC, PT), is used to temporarily store elements that need to be pruned in the abstract state;

[0081] Pointer to set PTS, used to store the pointer information of function pointers;

[0082] The continuation pass list (CPS) is in the form of a (CHC,CH) tuple, used to express the characteristics of inter-process information transfer.

[0083] In these sets, FN represents the function signature, L represents the line number (the line number L at the program entry point is denoted as 0), RS represents the alias set, AQ represents the symbolic parameter queue, AQC represents the symbolic parameter cache, PT represents the pointer set, CH represents the data channel, and CHC represents the channel cache.

[0084] Step 1.6) Construct a global variable table to store all global variables in the program to be analyzed.

[0085] The example programs selected in this embodiment, as well as the extracted data and control information, are shown in Tables 1, 2, and 3.

[0086] Table 1 foo function

[0087]

[0088] Table 2 Bar function

[0089]

[0090] Table 3 qux function

[0091]

[0092] Step 2) Initialize the analyzer, which includes:

[0093] Generate points of interest.

[0094] First, the program scans to find the line number of all function pointers, the signature of each function pointer, and the signature of the function to which it belongs, and organizes these into triplets, storing them in the interest table. Then, an interest point (f, l, r) is generated, where f represents the signature of the function to which it belongs, l represents the line number of the function pointer, and r represents the signature of the function pointer.

[0095] Initialize the pointer to the set PTS to be empty.

[0096] The function flag F = f is initialized to indicate that the function being analyzed is f;

[0097] The abstract state S is initialized based on the points of interest.

[0098] The initialization function cache (FC) is empty, and the continuation pass list (CPS) is empty.

[0099] In this embodiment, the function signature set FS is {method1,method2,method3,method4,method5,method6,foo,bar,qux}; the global function pointer variable set GS is {G}, meaning the current example program has only one global variable G. The pointer p to the statement on line 9 of the foo function is chosen to illustrate the method proposed in this invention in detail; therefore, the point of interest is (foo,9,p). At this point, the function label F = foo, and the abstract state...

[0100] Step 3) Initialize the dormant set T as an empty set.

[0101] Step 4) Update the dormant set T. Iterate through the abstract state S, where the elements are represented by (L, RS, AQ, AQC, PT), and add the elements that satisfy the condition L = 0 to the dormant set T.

[0102] In this embodiment, when analyzing the foo function, the result of the first round of sleep set calculation is...

[0103] The results of the second round of dormant set calculations

[0104] The results of the third round of dormant set calculations

[0105] The results of the fourth round of dormant set calculations are as follows:

[0106]

[0107] The results of the fifth round of dormant set calculations are as follows:

[0108]

[0109] The results of the sixth round of dormant set calculations are as follows:

[0110]

[0111]

[0112] Step 5) Prune the abstract state S. Iterate through the abstract state S, where elements are represented by (L, RS, AQ, AQC, PT), and delete all set elements that satisfy the condition L = 0. Determine if the abstract state S is empty. If it is, proceed to step 7 to update the function summary; otherwise, proceed to step 6 to update the abstract state.

[0113] In this embodiment, the result of pruning in round 0 (i.e., the initial state defined before the start of analysis) when analyzing the foo function is:

[0114] The results after the first round of pruning were:

[0115] The results after the second round of pruning are:

[0116]

[0117] The results after the third round of pruning are:

[0118]

[0119] The results after the fourth round of pruning are:

[0120]

[0121] The results after the fifth round of pruning are:

[0122]

[0123] The results after the 6th round of pruning are: Therefore, proceed to the function summary generation step.

[0124] Step 6) Update the abstract state. First, initialize the new abstract state S' as an empty set. Initialize the analyzed path set WL to be empty. Next, randomly select one element (L, RS, AQ, AQC, PT) from the old abstract state S. Then, read the direct predecessor set of the statement corresponding to L. If it has not been analyzed, add it to the WL set. Iterate through the statements corresponding to the direct predecessor set, generate new iteration quantities according to the preset iteration generation rules, and add them to the new abstract state S'. Finally, continue to select elements from the old abstract state S until the old abstract state S is empty, and return to step 4 with the new abstract state S'. If the direct predecessor of statement L has been analyzed, it does not need to be analyzed again. Continue to select elements from the old abstract state S until the old abstract state S is empty, and return to step 4 with the new abstract state S'.

[0125] In step 6, the purpose of introducing the analyzed path set WL is to improve the analysis efficiency of loop statements. Since this embodiment does not contain loop statements, the WL set may not be used.

[0126] See Figure 2 The preset iteration quantity generation rule includes the following:

[0127] Step 6.1) For program statements of the form R=N, the line number is k:

[0128] ① If pointer signature R satisfies the condition R∈RS, then pointer signature N satisfies the condition The newly generated iteration quantity is (k, RS∪N, AQ, AQC, PT);

[0129] ② If pointer signature R satisfies the condition R∈RS and pointer signature N satisfies the condition N∈FS, then the newly generated iteration quantity is:

[0130] ③ If the pointer signature R satisfies the condition The newly generated iteration quantity is (k, RS, AQ, AQC, PT).

[0131] Step 6.2) If the set of direct predecessor statements is empty, then the newly generated iteration variable is (0, RS, AQ, AQC, PT).

[0132] Step 6.3) For the function declaration statement, whose function signature is A, iterate through the formal parameters to determine whether parameter R satisfies the condition R∈RS. Assuming the x-th formal parameter satisfies the above condition, calculate AQC' = append(AQC, A(x)), then the newly generated iteration quantity is (0, RS, AQ, AQC', PT); if none of the formal parameters R satisfy the condition R∈RS, then if... Assuming the x-th variable r∈(RS∩GS) in the global variable table, if we calculate AQC'=append(AQC,A(-x)), then the newly generated iteration quantity is (0,RS,AQ,AQC′,PT); if there is no variable r that satisfies the above condition, then the newly generated iteration quantity is (0,RS,AQ,AQC,PT).

[0133] Step 6.4) For the function call statement, the current statement line number is k. If Assuming the x-th variable r∈(RS∩GS) in the global variable table, and calculating AQC'=append(AQC,A(-x)), then the newly generated iteration quantity is (k,RS,AQ,AQC′,PT); if there is no variable r that satisfies the above condition, then the newly generated iteration quantity is (k,RS,AQ,AQC,PT).

[0134] In this embodiment, the result of the first round of direct predecessor transformation when analyzing the foo function is:

[0135]

[0136] The result of the second round of direct precursor conversion is:

[0137]

[0138] The results of the third round of direct precursor conversion are:

[0139]

[0140] The result of the fourth round of direct precursor conversion is:

[0141]

[0142] The results of the fifth round of direct precursor conversion are:

[0143]

[0144] Step 7) Update the function summary Sum.

[0145] First, initialize the function digest Sum to an empty set. Next, iterate through the dormant set T, where the elements are represented by (L, RS, AQ, AQC, PT), where AQ...′ =extend(AQ,AQC), where the function extend(AQ,AQC) appends multiple values ​​from another sequence AQC to the end of the list AQ at once; finally, it adds the element (F,AQ′,PT) to the function digest Sum, where F is the function tag (i.e., the current function signature).

[0146] In this embodiment, when analyzing the foo function, the calculation result of Sum is:

[0147]

[0148] Step 8) Update the pointer to the set PTS.

[0149] Iterate through the function summary Sum obtained in step 7, where each element is represented by (FN, AQ, PT) to satisfy the condition. The elements of the set are mapped from PT to the set PTS.

[0150] In this embodiment, the PTS calculation result of the first round of analysis of the foo function is:

[0151] {method1,method2};

[0152] The PTS calculation result of the second round of analysis of the qux function is {method1,method2,method6};

[0153] The PTS calculation results for the third round of analysis of the bar function are:

[0154] {method1,method2,method4,method6};

[0155] The PTS calculation results for the fourth round of analysis of the foo function are:

[0156] {method1,method2,method3,method4,method6}.

[0157] Step 9) Pruning function summary Sum.

[0158] The function summary Sum is used to traverse the function, where the elements are represented by (FN, AQ, PT), and those that satisfy the condition... All elements of the set are deleted.

[0159] In this embodiment, the result after the first round of pruning is:

[0160]

[0161] The result after the second round of pruning is {(qux,{(foo(-1))},{method5})};

[0162] The result after the third round of pruning

[0163] The result after the fourth round of pruning

[0164] Step 10) Update the continuation pass list CPS, CHC = CHC∪Sum, CPS = (CHC, CH).

[0165] Step 11) Determine if the function cache FC is an empty set. If the function cache FC is not an empty set, proceed to step 12; if the function cache FC is an empty set, proceed to step 13.

[0166] Step 12) Retrieve a function cache (CR, CE, X, AQ, PT) from the function cache FC, and update the function flag F = CR, indicating that the function CR is currently being analyzed. Calculate the abstract state S of function CE based on whether it is in a return state (if CE = RET, then it is in a return state).

[0167] Furthermore, the abstract state S, calculated based on whether function CE is RET, includes the following sub-contents:

[0168] Step 12.1) If CE ≠ RET, it means that function CE is a non-return type. Calculate the abstract state according to the generation rules affected by formal parameters. Calculate the set K = {k1, k2, ..., k...} of the line numbers of the function CE call points by linearly traversing the function CR. n}, calculate abstract state

[0169] Where R i Indicates the kth i The Xth actual parameter of the line statement returns to step 3.

[0170] Step 12.2) If CE = RET, it indicates that function CE is a return type. Calculate the abstract state according to the generation rules affecting global variables. Calculate the set K = {k1, k2, ..., k...} of statement line numbers returned by function CR by linearly traversing the function CR. n}, calculate abstract state Among them G i This indicates the -Xth global variable name in the global variable table. Return to step 3.

[0171] Step 13) Determine if the continuation pass is in a backtracking state. If the CH element in the continuation pass list CPS is not an empty set, then the continuation pass is in a backtracking state, and proceed directly to step 15. Otherwise, if the CH element is an empty set, then the continuation pass is in a non-backtracking state, and proceed to step 14.

[0172] Step 14) Determine if the continuation pass is in a terminated state. If the CHC elements in the continuation pass list CPS are empty, then the continuation pass is in a terminated state, and the algorithm terminates; otherwise, if the CHC elements are not empty, then the continuation pass is in a non-terminated state, and the continuation pass list CPS is updated, CH = CHC. CPS = (CHC, CH), proceed to step 15.

[0173] In this embodiment, when the algorithm returns to the analysis of the foo function in its fourth round, the generated function summary... The computation result pointing to the set PTS was updated to {method1, method2, method3, method4, method6}. After step 9, the function summary was pruned to empty, i.e. Then at this time The algorithm terminated.

[0174] Step 15) Continue the pass list CPS = (CHC, CH), take a digest (FN, AQ, PT) from CH in order, dequeue a symbolic parameter A(x) = Pop(AQ) from the symbolic parameter queue AQ, the dequeued symbolic parameter queue is AQ″, and determine whether A is equal to FN. If A = FN, then proceed to step 16; if A ≠ FN, then proceed to step 17.

[0175] Step 16) Calculate the function cache based on the downlink data stream generation rules. The set of parent functions for generating function A is CR = {F1, F2, ..., F...}. m}, where F1, F2, ..., F m As the parent function of function A, generate a function cache FC = {(F1,A,x,AQ″,PT),(F2,A,x,AQ″,PT),…,(F n ,A,x,AQ″,PT)}, return to step 11.

[0176] Step 17) Calculate the function cache based on the uplink data stream generation rules. Generate the function cache FC = {(A,RET,x,AQ″,PT)}, and return to step 11.

[0177] In this embodiment, for element According to step 11.2, the bar function returns the statement line number set as {4}, generating the abstract state. Returning to step 3 to continue analysis, the resulting function summary (Sum) analysis result is...

[0178] Targeting elements The transformation, the parent function signature set is {qux}, according to step 12.1, the statement line number set is {4,6}, the actual parameter signatures read are p and G, and are input into the abstract state of the analysis module within the qux function procedure. The obtained function summary sum analysis results are

[0179] For the transformation of element (qux, {(foo(-1))}, {method5}), according to step 12.2), the obtained statement line number set is {11}, and the generated abstract state... Returning to step 3), the resulting function summary (sum) analysis result is...

[0180] Example 2

[0181] Based on the same inventive concept as in Embodiment 1, this embodiment of the invention provides a function pointer pointing analysis device based on continuation passing, comprising:

[0182] The initialization module is used to select the function pointer of the point of interest and initialize the relevant continuation pass list and pointer set. The analysis module is used to perform intra-procedural analysis of the program from the statement where the function pointer of the point of interest is located, in the opposite direction of the control flow, save the intra-procedural analysis results using function summary, and update the continuation pass list and pointer set according to the function summary. When performing intra-procedural analysis, if inter-procedural interaction information is encountered, the intra-procedural analysis of the affected functions is performed based on the influence of the inter-procedural interaction information, according to the global variable influence rules or formal parameter influence rules. After the analysis is completed, the module returns to the direct predecessor of the statement where the inter-procedural interaction information appears and continues the intra-procedural analysis.

[0183] The output module is used to output the corresponding pointer set as the pointer information of the interest point function pointer when it is determined that the continuation is terminated based on the continuation transmission list.

[0184] The rest are the same as in Example 1.

[0185] Example 3

[0186] Based on the same inventive concept as Embodiment 1, this embodiment of the invention provides a function pointer pointing analysis system based on continuation passing, including a storage medium and a processor;

[0187] The storage medium is used to store instructions;

[0188] The processor is configured to operate according to the instructions to execute the method according to any one of Embodiment 1.

[0189] The rest are the same as in Example 1.

[0190] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0191] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0192] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0193] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0194] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

[0195] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A method for analyzing function pointer pointers based on pass-through continuation, characterized in that, include: Select the function pointer for the point of interest, and initialize the relevant continuation pass list and pointer set; Starting from the statement where the point of interest function pointer is located, perform intra-procedural analysis on the program in the opposite direction of control flow. Save the intra-procedural analysis results using function summary, and update the continuation pass list and pointer set according to the function summary. During intra-procedural analysis, if inter-procedural interaction information is encountered, perform intra-procedural analysis on the affected functions based on the influence of the inter-procedural interaction information, according to the global variable influence rules or formal parameter influence rules. After the analysis is completed, return to the direct predecessor of the statement where the inter-procedural interaction information appears, and continue intra-procedural analysis. When it is determined that the continuation of transmission is in a terminated state based on the continuation transmission list, the corresponding pointer set is output as the pointer information of the interest point function pointer. The method for obtaining the pointer information of the interest point function includes the following steps: 3) Initialize the dormant set T as an empty set. ; 4) Traverse the abstract state S, where the elements are... This indicates that the conditions will be met. Add the elements of the collection to the hibernation collection ; 5) Traverse the abstract state S, where the elements are... This means deleting all items that meet the conditions. The elements of the set; 6) If the abstract state S is not an empty set, then first initialize the new abstract state. empty set Initialize the analyzed path set WL as an empty set, then proceed from the old abstract state. Randomly select 1 element Then, read the direct predecessor set of the statement corresponding to L. If it has not been analyzed, add it to the WL set. Iterate through the statements in the direct predecessor set, generate new iteration quantities according to the preset iteration generation rules, and add them to the new abstract state. Finally, continue from the old abstract state. Extract elements from the abstract state until the old abstract state is reached. For an empty set, with a new abstract state Return to step 4). 7) First, initialize the function digest to an empty set, then iterate through the dormant set. , where the elements are To indicate, , where the function Function to add to list Append another sequence at the end Multiple values ​​in the function summary are finally added. Add elements F is the function notation; 8) Iterate through the function summary Sum obtained in step 7), where the elements are represented by... To indicate, in order to satisfy the conditions The PT corresponding to the element in the set is added to the set PTS; 9) Iterate through the function summary Sum, where the elements are represented by... This indicates that the conditions will be met. All elements of the set are deleted; 10) Update the continuation pass list CPS. , ; 11) Determine if the function cache FC is an empty set. If the function cache FC is not an empty set, proceed to step 12); if the function cache FC is an empty set, proceed to step 13). 12) Retrieve a function cache (CR, CE, X, AQ, PT) from the function cache FC, update the function flag F=CR, indicating that the function CR is currently being analyzed; calculate the abstract state S according to whether the function CE is RET, where RET indicates that the function is in the return state; 13) If the CH elements in the continuation pass list CPS are not an empty set, then the continuation pass is in a backtracking state, and proceed directly to step 15). 15) Continuing Passing List Extract a digest sequentially from CH. From the symbolic parameter queue A symbolic parameter is dequeued. The dequeue of symbolic parameters is And determine whether A equals FN, if Then proceed to step 16; if Then proceed to step 17; 16) Calculate the function cache based on the downlink data stream generation rules. The set of parent functions of generating function A ,in Generate a function cache for the parent function of function A. (Return to step 11). 17) Calculate function cache based on the uplink data stream generation rules. Generate function cache (Return to step 11).

2. The function pointer pointing analysis method based on continuation passing according to claim 1, characterized in that: The process also includes the following steps before the step of selecting the interest point function pointer: 1.1) Based on the program code to be analyzed, generate a program call graph and a control flow graph; 1.2) Based on the program call graph and control flow graph, save the predecessor node of each statement and the parent function of each function in the program code to be analyzed; 1.3) Construct a function signature table of all function names in the program to be analyzed. The functions in the function signature table need to have type signatures. 1.4) Construct symbolic parameters, wherein the form of the symbolic parameters is as follows: ,in It is the function signature. It is a parameter; when At that time, parameters Represents the first... One parameter; when At that time, parameters Represents the -th variable in the global variable table One global variable; 1.5) Construct the following data structure: Abstract state Each element is in the form of a quintuple. Function Summary Each element is in the form of a quadruple. Hibernation Collection Each element is in the form of a quintuple. ; points to a set Contains only PT elements; continues the passing list ,for The binary form is used to express the characteristics of information transfer between processes, where FN represents the function signature, L represents the line number, and RS represents the alias set. Represents a queue of symbolic parameters. This indicates a symbolic parameter cache. Indicates a set to be pointed to. Indicates a data channel. Indicates channel buffer; 1.6) Construct a global variable table to store all global variables in the program to be analyzed.

3. The function pointer pointing analysis method based on continuation passing according to claim 2, characterized in that: The process of selecting the interest point function pointer and initializing the relevant continuation pass list and pointer set includes the following steps: First, scan the program to find the line number of all function pointers, the signature of the function pointer, and the signature of the function to which it belongs, and organize them into a triplet and store them in the interest table; 2.1) Generating points of interest ,in, This indicates the function signature. Indicates the line number where the function pointer is located. The signature representing the function pointer; 2.2) Initialize the pointer to the set empty set Initialization function flag , indicating that the function being analyzed is ; The abstract state S is initialized based on the points of interest. The initialization function cache is empty; the passed list continues. Empty.

4. The function pointer pointing analysis method based on continuation passing according to claim 1, characterized in that: Step 5) further includes: if it is determined whether the abstract state S is an empty set, if the abstract state S is an empty set, then proceed to step 7) to update the function summary; Step 6) further includes: If the direct predecessor of the statement corresponding to L has already been analyzed, then it is unnecessary to analyze it again; continue from the old abstract state. Extract elements from the abstract state until the old abstract state is reached. For an empty set, with a new abstract state Return to step 4).

5. The function pointer pointing analysis method based on continuation passing according to claim 1, characterized in that: Step 13) further includes: If the CH element is an empty set, then the continuation of the pass is in a non-backtracking state, and proceed to step 14). 14) If the CHC elements in the continuation propagation list CPS are empty, then the continuation propagation is in a terminated state, and the algorithm terminates; otherwise, if the CHC elements are not empty, then the continuation propagation is in a non-terminated state, and the continuation propagation list is updated. , Proceed to step 15).

6. The function pointer pointing analysis method based on continuation passing according to claim 4, characterized in that: The preset iterative generation rules include: 6.1) Targeting The program statement is of the form k; 6.2) If the set of direct predecessor statements is empty, then the newly generated iteration variable is ; 6.3) For a function declaration statement with function signature A, then iterate through the formal parameters to determine the parameters. Does it meet the conditions? Assume the first If the formal parameters satisfy the above conditions, calculate... Then the newly generated iteration number is If the formal parameter R does not satisfy the condition At this time, if Assuming the first variable in the global variable table Variables ,calculate Then the newly generated iteration number is If no variable r satisfies the above conditions, then the newly generated iteration number is... ; 6.4) For a function call statement, if the current statement line number is k, then... Assuming the first variable in the global variable table Variables ,calculate Then the newly generated iteration number is If no variable r satisfies the above conditions, then the newly generated iteration number is... .

7. The function pointer pointing analysis method based on continuation passing according to claim 1, characterized in that: According to the function Is it Computing the abstract state S includes: Step 12.1) If , representing a function For non-return types, the abstract state is calculated based on the generation rules influenced by the formal parameters. This is achieved by linearly traversing the function CR and calculating the set of statement line numbers at the function CE call points. Calculate the abstract state ,in Indicates the first The first line of the statement One actual parameter, return to step 3); if , representing a function As the return type, the abstract state is calculated based on the generation rules influenced by global variables. This is achieved by linearly traversing the function CR, which returns a set of statement line numbers. Calculate the abstract state ,in Represents the first in the global variable table (Name a global variable and return to step 3).

8. A function pointer pointing analysis device based on continuation pass, characterized in that, include: The initialization module is used to select the function pointer of the point of interest and to initialize the relevant continuation pass list and pointer set; The analysis module is used to perform intra-procedural analysis of the program from the statement where the interest point function pointer is located, in the opposite direction of the control flow. It saves the intra-procedural analysis results using function summaries and updates the continuation pass list and pointer set based on the function summaries. When performing intra-procedural analysis, if inter-procedural interaction information is encountered, the module performs intra-procedural analysis on the affected functions based on the impact of the inter-procedural interaction information, according to the global variable influence rules or formal parameter influence rules. After the analysis is completed, it returns to the direct predecessor of the statement where the inter-procedural interaction information appears and continues the intra-procedural analysis. The output module is used to output the corresponding pointer set as the pointer information of the interest point function pointer when it is determined that the continuation is terminated based on the continuation transmission list. The method for obtaining the pointer information of the interest point function includes the following steps: 3) Initialize the dormant set T as an empty set. ; 4) Traverse the abstract state S, where the elements are... This indicates that the conditions will be met. Add the elements of the collection to the hibernation collection ; 5) Traverse the abstract state S, where the elements are... This means deleting all items that meet the conditions. The elements of the set; 6) If the abstract state S is not an empty set, then first initialize the new abstract state. empty set Initialize the analyzed path set WL as an empty set, then proceed from the old abstract state. Randomly select 1 element Then, read the direct predecessor set of the statement corresponding to L. If it has not been analyzed, add it to the WL set. Iterate through the statements in the direct predecessor set, generate new iteration quantities according to the preset iteration generation rules, and add them to the new abstract state. Finally, continue from the old abstract state. Extract elements from the abstract state until the old abstract state is reached. For an empty set, with a new abstract state Return to step 4). 7) First, initialize the function digest to an empty set, then iterate through the dormant set. , where the elements are To indicate, , where the function Function to add to list Append another sequence at the end Multiple values ​​in the function summary are finally added. Add elements F is the function notation; 8) Iterate through the function summary Sum obtained in step 7), where the elements are represented by... To indicate, in order to satisfy the conditions The PT corresponding to the element in the set is added to the set PTS; 9) Iterate through the function summary Sum, where the elements are represented by... This indicates that the conditions will be met. All elements of the set are deleted; 10) Update the continuation pass list CPS. , ; 11) Determine if the function cache FC is an empty set. If the function cache FC is not an empty set, proceed to step 12); if the function cache FC is an empty set, proceed to step 13). 12) Retrieve a function cache (CR, CE, X, AQ, PT) from the function cache FC, update the function flag F=CR, indicating that the function CR is currently being analyzed; calculate the abstract state S according to whether the function CE is RET, where RET indicates that the function is in the return state; 13) If the CH elements in the continuation pass list CPS are not an empty set, then the continuation pass is in a backtracking state, and proceed directly to step 15). 15) Continuing Passing List Extract a digest sequentially from CH. From the symbolic parameter queue A symbolic parameter is dequeued. The dequeue of symbolic parameters is And determine whether A equals FN, if Then proceed to step 16; if Then proceed to step 17; 16) Calculate the function cache based on the downlink data stream generation rules. The set of parent functions of generating function A ,in Generate a function cache for the parent function of function A. (Return to step 11). 17) Calculate function cache based on the uplink data stream generation rules. Generate function cache (Return to step 11).

9. A function pointer pointing analysis system based on continuation pass, characterized in that, Including storage media and processor; The storage medium is used to store instructions; The processor is configured to operate according to the instructions to perform the method according to any one of claims 1-7.

Images