Time-class memory security detection method and device and computing device cluster

Abstract

The invention discloses a time-class memory security detection method, which comprises the following steps of: obtaining a plurality of analysis units comprising a function or a function group on the basis of a source code; the plurality of analysis units comprise a first analysis unit and a second analysis unit, the first analysis unit comprises a function call statement used for calling the second analysis unit, and when the function call statement is analyzed, the state of the memory block pointed by the pointer in the analysis units is analyzed by utilizing summary information of the second analysis unit. Performing state analysis on the state of the memory block pointed by the pointer associated with the function call statement, wherein the summary information of the analysis unit is used for describing the memory state when the memory block pointed by the access pointer in the analysis unit enters and exits from the analysis unit; and generating summary information of the analysis unit according to the state analysis result corresponding to the analysis unit, and obtaining a detection result related to the time-class memory problem in the analysis unit. Therefore, the resource overhead and the false and missing report rate are reduced when the time-class memory problem is detected.

Description

Technical Field

[0001] The present application relates to the field of information technology (IT) technology, and in particular to a time-based memory security detection method, device and computing device cluster. Background Art

[0002] At present, a large part of the vulnerabilities resolved by operating systems or browsers every year are caused by memory safety issues. Memory safety issues can include time-related issues (such as memory leaks, use after free, repeated release, etc.). Time-related memory issues refer to memory safety issues caused by violations of security timing rules when performing memory operations, such as memory leaks, repeated releases, and use after free. In the industry-recognized common weakness enumeration (CWE) top problem analysis, the release and reuse problem (including repeated release problems) ranked 7th, and the memory leak problem ranked 36th. It can be seen that time-related memory issues are very important industry problems. However, program software with time-related memory issues, including network equipment, operating system kernels, browsers, audio and video processing, databases, etc., have been developed for decades. The software scale is huge and the security requirements are strong. This puts high demands on the resource overhead and false negative rate required for the detection of time-related memory issues. Therefore, when detecting time-related memory issues, how to reduce resource overhead and false negative rate is a technical problem that needs to be solved urgently. Summary of the invention

[0003] The present application provides a time-related memory security detection method, apparatus, computing device cluster, computer storage medium and computer product, which can reduce resource overhead and false alarm rate when detecting time-related memory problems.

[0004] In the first aspect, the present application provides a time-based memory safety detection method, including: based on source code, obtaining multiple analysis units, the analysis unit includes a function or a function group; performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein the multiple analysis units include a first analysis unit and a second analysis unit, the first analysis unit includes a function call statement, the function call statement is used to call the second analysis unit, when analyzing the function call statement, using the summary information of the second analysis unit, the state of the memory block pointed to by the pointer associated with the function call statement is analyzed, and the summary information of the analysis unit is used to describe the memory state of the memory block pointed to by the input and output pointers in the analysis unit when entering and exiting the analysis unit; according to the state analysis results corresponding to the analysis unit, the summary information of the analysis unit is generated, and the detection results related to the time-based memory problems in the analysis unit are obtained. Exemplarily, the input and output pointers can be pointers associated with formal parameters, global variables and return values. Exemplarily, the source code can be, but is not limited to, code written for developers.

[0005] In this way, when detecting time-related memory problems, the memory behaviors between different analysis units can be decoupled by dividing the source code, so that each analysis unit can be analyzed separately to see whether there are time-related memory problems, avoiding global analysis and reducing resource overhead. In addition, through the summary information of the analysis unit, there is a calling behavior between the analysis units, and when analyzing the caller, the summary information of the callee can be directly queried without analyzing the memory behavior inside the callee, reducing the analysis amount and improving the analysis efficiency. At the same time, during the detection process, the summary information can be used to analyze the memory behavior across analysis units, so that the memory behavior detection across analysis units can be realized, reducing the false alarm rate. In addition, the summary information of the analysis unit contains the status of the memory block corresponding to the pointer associated with the formal parameter, global variable and return value, which makes it possible to include all the information in the analysis unit that interacts with the outside, thereby reducing the loss between the summary information of the analysis unit and the actual memory behavior inside the analysis unit.

[0006] In a possible implementation, the state of the memory block pointed to by the pointer in the analysis unit is analyzed, including: iteratively analyzing the state of the memory block pointed to by the pointer in the analysis unit, wherein, in the current round of iteration, the summary information generated by the previous round of iteration is used to analyze the state of the memory block pointed to by the pointer in the analysis unit. Exemplarily, the current round of iteration can be the latest round of iteration. For example, if the latest round of iteration is the 5th round of iteration, the 5th round is the current round. In addition, if the current round is the i-th round, the previous round of the current round is the i-1th round.

[0007] According to the state analysis results corresponding to the state analysis, the summary information of the analysis unit is generated, and the detection results related to the time-related memory problems in the analysis unit are obtained, including: in the iteration process, according to the state analysis results obtained in the current round of iteration, the time-related memory problems existing in the analysis unit are identified, and the summary information of the analysis unit is updated; and, when the summary information of multiple analysis units will no longer be updated, the time-related memory problems existing in multiple analysis units identified in the last round of iteration are used as the final detection results.

[0008] In this way, through iterative analysis, the summary information of all analysis units can eventually reach a stable state, that is, they are no longer updated. At this time, since no benefits can be obtained during the iteration, it can be ended. At the same time, it can be considered that the summary information generated by the last iteration is correct, so the time-related memory problems identified at this time are also accurate. In this way, the accuracy of the detection can be improved by using the time-related memory problems identified during the last round of iterations as the final detection results. In addition, by constructing the summary information and iteratively using the summary information obtained in the previous round, it is not necessary to construct a call graph that describes the calling relationship between all analysis units, so there is no need to consider the analysis order between the analysis units. At the same time, since global pointer analysis is required to construct the call graph, the resource overhead consumed is relatively large, and since there is no need to construct the call graph in this application, the resource overhead can be greatly reduced.

[0009] In a possible implementation, a state analysis is performed on the state of the memory block pointed to by the pointer in the analysis unit, including: based on a preset state transition rule, traversing the statements in the analysis unit, and performing a state analysis on the state of the memory block pointed to by the pointer in the analysis unit. The state transition rule is used to describe the state change rule of the memory block pointed to by the first pointer when assigning a value to the first pointer or using the first pointer. In this way, by traversing the statements in the analysis unit according to the state transition rule, the state analysis of the memory block pointed to by the pointer can be implemented. In addition, during the analysis process, memory allocation points, memory release points, and memory use points can be identified through function statements, thereby solving the time-related memory problems of repeated release and reuse after release.

[0010] In a possible implementation, according to the state analysis result corresponding to the state analysis, the time-related memory problem existing in the analysis unit is identified, specifically including: when the state analysis result indicates that the state of the memory block is a termination state, determining that the statement related to the memory block in the analysis unit has a time-related memory problem, and, according to the type of the termination state, determining the error type and the error statement, wherein the termination state is used to characterize that the memory block is not used correctly, the error type includes: one or more of repeated release, memory leak and reuse after release, and the error statement includes: one or more of memory allocation statement, memory use statement and memory release statement; when the state analysis result indicates that the state of the memory block is an intermediate state, determining that the statement related to the memory block in the analysis unit does not have a time-related memory problem, and the intermediate state is used to characterize that the memory block is being used correctly. Therefore, it is possible to analyze whether there is a time-related memory problem through the state analysis result.

[0011] In a possible implementation, the summary information of the analysis unit includes: summary information of pointers associated with formal parameters, global variables and return values ​​in the analysis unit, and the pointers associated with formal parameters, global variables and return values ​​include the second pointer.

[0012] The summary information of the second pointer includes one or more of the following: the identifier of the second pointer, the position of the formal parameter, global variable or return value associated with the second pointer in the analysis unit, the relationship between the second pointer and the formal parameter, global variable and return value in the analysis unit, the state of the memory block pointed to by the second pointer when entering or exiting the analysis unit, or the alias and non-alias relationship between the second pointer and the pointers associated with the formal parameter, global variable and return value in the analysis unit other than the second pointer. In this way, the summary information can include all the information in the analysis unit that interacts with the outside, thereby reducing the loss between the summary information of the analysis unit and the actual memory behavior inside the analysis unit.

[0013] In a possible implementation, the input and output pointers in the analysis unit may include one or more of the following: a pointer related to a formal parameter or a return value and brought into or out of the analysis unit, or a global variable, or a pointer related to a global variable and brought into or out of the analysis unit by the global variable. Thus, the summary information can include all the information in the analysis unit that interacts with the outside, thereby reducing the loss between the summary information of the analysis unit and the actual memory behavior inside the analysis unit.

[0014] In a possible implementation, before analyzing the state of the memory block pointed to by the pointer in the analysis unit, the method further includes: when there are multiple different branches pointing to the same node in the control flow chart of the analysis unit, normalizing the states of the memory blocks pointed to by the pointers transmitted by the multiple different branches. In this way, the states of the memory blocks pointed to by the pointers transmitted by these branches can be made unique, reducing the false alarm rate.

[0015] In a possible implementation, the states of the memory blocks pointed to by the pointers transmitted from multiple different branches are normalized, specifically including: converting wild pointers in multiple different branches into null pointers. The state of the memory block pointed to by the null pointer can be any state, thereby achieving state normalization.

[0016] In a possible implementation, before analyzing the state of the memory block pointed to by the pointer in the analysis unit, the method further includes: eliminating redundant paths in the analysis unit, thereby improving detection efficiency and reducing false positive rate.

[0017] In a possible implementation, eliminating redundant paths in the analysis unit includes one or more of the following:

[0018] In the case where there is a dominating and post-dominating relationship between a memory allocation point and a release point of the memory block pointed to by the second pointer in the analysis unit, determining that there is no need to perform reachability judgment on the memory block pointed to by the second pointer;

[0019] Alternatively, when the condition in the if statement in the analysis unit is always true, eliminate the branch in the if statement where the condition is false, and when the condition in the if statement in the analysis unit is always false, eliminate the branch in the if statement where the condition is true;

[0020] Or, when the condition in the while statement in the analysis unit is always false, eliminate the branch in the while statement where the condition is true;

[0021] Alternatively, when the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement is the same as the condition in the second if statement, the second if statement is eliminated, and the branch in which the condition in the second if statement is true is added to the branch in which the condition in the first if statement is true, and the branch in which the condition in the second if statement is false is added to the branch in which the condition in the first if statement is false; when the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement is opposite to the condition in the second if statement, the second if statement is eliminated, and the branch in which the condition in the second if statement is true is added to the branch in which the condition in the first if statement is false, and the branch in which the condition in the second if statement is false is added to the branch in which the condition in the first if statement is true;

[0022] Alternatively, when the result of calling the function in the analysis unit is used as a judgment condition and the judgment condition affects the path reachability judgment, the function is expanded and inlined; when the result of calling the function in the analysis unit is not used as a judgment condition, or the judgment condition does not affect the path reachability judgment, the function is not inlined.

[0023] In a possible implementation, the method further includes: in the process of state analysis of the state of the memory block pointed to by the pointer in the analysis unit, when there are multiple different branches pointing to the same node in the control flow graph of the analysis unit, recording the first state of the memory block corresponding to the node when the first variable transmitted from the first branch of the multiple branches enters the node; based on the recorded first state, traversing the statements in the nodes on the edges associated with the node and not explored in the control flow graph, and performing state analysis on the state of the memory block pointed to by the pointer in the traversed statement. In this way, the path exploration space is simplified, the path exploration efficiency is improved, and the detection efficiency is further improved.

[0024] In a possible implementation, the method further includes: when the second state of the memory block corresponding to the node is inconsistent with the first state when the pointer transmitted from other branches among multiple branches enters the node, the error type and error statement are determined according to the conflict between the first state and the second state. Among them, the error type includes: one or more of repeated release, memory leak and reuse after release, and the error statement includes: one or more of memory allocation statement, memory use statement and memory release statement. In this way, by comparing the recorded state with the state of the memory block corresponding to the node when the pointer transmitted from the current branch enters the node, it can be known whether there are time-related memory problems in the two branches, thereby improving the detection efficiency.

[0025] In a possible implementation, the method also includes: when the second state of the memory block corresponding to the node is inconsistent with the first state when the pointers transmitted by other branches among multiple branches enter the node, and the first state is allocated, adding a null assignment statement in other branches, and the null assignment statement is used to assign the pointers transmitted by other branches to null. In this way, the states of the memory blocks pointed to by the pointers transmitted by multiple different branches can be normalized, so that the states of the memory blocks pointed to by the pointers transmitted by these branches are unique, thereby reducing the false alarm rate.

[0026] In addition, a prompt message may be output. The prompt message may be used to prompt that the second state is changed to an empty state, or that the second state is changed to the first state. In this way, the user can normalize the states of the memory blocks pointed to by the pointers transmitted from multiple different branches based on their own needs, thereby resolving the conflict between the first state and the second state.

[0027] In a possible implementation, after obtaining the detection result related to the time-related memory problem in the analysis unit, the method further includes: using a constraint solver to correct the detection result, thereby correcting the detection result and further reducing the false alarm rate.

[0028] In a possible implementation, the detection result includes one or more of the following: a module with a time-related memory problem, or a line of code with a time-related memory problem, or a line or column in the source code of a pointer with a time-related memory problem, or an execution path from a memory allocation point with a time-related memory problem to an error reporting point, where the error reporting point includes a memory usage point or a memory release point.

[0029] In a second aspect, the present application provides a time-based memory security detection device, comprising: a first processing module and a second processing module. The first processing module is used to obtain multiple analysis units based on source code, and the analysis unit includes a function or a function group. The second processing module is used to perform state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein the multiple analysis units include a first analysis unit and a second analysis unit, and the first analysis unit contains a function call statement, and the function call statement is used to call the second analysis unit. When the function call statement is analyzed, the summary information of the second analysis unit is used to perform state analysis on the state of the memory block pointed to by the pointer associated with the function call statement, and the summary information of the analysis unit is used to describe the memory state of the memory block pointed to by the input and output pointers in the analysis unit when entering and exiting the analysis unit. The second processing module is also used to generate summary information of the analysis unit according to the state analysis results corresponding to the analysis unit, and obtain detection results related to time-based memory problems in the analysis unit.

[0030] In one possible implementation, when the second processing module performs state analysis on the state of the memory block pointed to by the pointer in the analysis unit, it is specifically used to: iteratively perform state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein, during the current round of iteration, the summary information generated by the previous iteration is used to perform state analysis on the state of the memory block pointed to by the pointer in the analysis unit.

[0031] The second processing module generates summary information of the analysis unit according to the state analysis results corresponding to the state analysis, and obtains the detection results related to the time-related memory problems in the analysis unit. It is specifically used for: in the iteration process, according to the state analysis results obtained in the current round of iteration, identifying the time-related memory problems existing in the analysis unit, and updating the summary information of the analysis unit; and, when the summary information of multiple analysis units will no longer be updated, taking the time-related memory problems existing in multiple analysis units identified in the last round of iteration as the final detection results.

[0032] In one possible implementation, when the second processing module performs state analysis on the state of the memory block pointed to by the pointer in the analysis unit, it is specifically used to: based on a preset state transition rule, traverse the statements in the analysis unit, and perform state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein the state transition rule is used to describe the state change rule of the memory block pointed to by the first pointer when the first pointer is assigned a value or used.

[0033] In one possible implementation, when the second processing module identifies the time-related memory problems existing in the analysis unit based on the state analysis result corresponding to the state analysis, it is specifically used to: when the state analysis result indicates that the state of the memory block is a terminated state, determine that the statements related to the memory block in the analysis unit have time-related memory problems, and, according to the type of the terminated state, determine the error type and error statement, wherein the terminated state is used to characterize that the memory block is not used correctly, the error type includes: one or more of repeated release, memory leak, and reuse after release, and the error statement includes: one or more of memory allocation statement, memory usage statement, and memory release statement; when the state analysis result indicates that the state of the memory block is an intermediate state, determine that the statements related to the memory block in the analysis unit do not have time-related memory problems, and the intermediate state is used to characterize that the memory block is being used correctly.

[0034] In a possible implementation, the summary information of the analysis unit includes: summary information of pointers associated with formal parameters, global variables, and return values ​​in the analysis unit, and the pointers associated with formal parameters, global variables, and return values ​​include second pointers. Exemplarily, the pointers associated with formal parameters, global variables, and return values ​​can be understood as input and output pointers.

[0035] The summary information of the second pointer includes one or more of the following: the identifier of the second pointer, the position of the formal parameters, global variables or return values ​​associated with the second pointer in the analysis unit, the relationship between the second pointer and the formal parameters, global variables and return values ​​in the analysis unit, the state of the memory block pointed to by the second pointer when entering or exiting the analysis unit, or the alias and non-alias relationship between the second pointer and other pointers in the entry and exit pointers in the analysis unit except the second pointer.

[0036] In one possible implementation, the input and output pointers in the analysis unit may include one or more of the following: a pointer related to a formal parameter or a return value and brought into or out of the analysis unit, or a global variable, or a pointer related to a global variable and brought into or out of the analysis unit by the global variable.

[0037] In one possible implementation, before performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, the second processing module is also used to: when there are multiple different branches pointing to the same node in the control flow graph of the analysis unit, normalize the states of the memory blocks pointed to by the pointers transmitted by multiple different branches.

[0038] In a possible implementation, when normalizing the states of the memory blocks pointed to by the pointers transmitted from the multiple different branches, the second processing module is specifically configured to: convert wild pointers in the multiple different branches into null pointers.

[0039] In a possible implementation, before the second processing module performs status analysis on the status of the memory block pointed to by the pointer in the analysis unit, it is further configured to: eliminate redundant paths in the analysis unit.

[0040] In a possible implementation, eliminating redundant paths in the analysis unit includes one or more of the following:

[0041] In the case where there is a dominating and post-dominating relationship between a memory allocation point and a release point of the memory block pointed to by the second pointer in the analysis unit, determining that there is no need to perform reachability judgment on the memory block pointed to by the second pointer;

[0042] Alternatively, when the condition in the if statement in the analysis unit is always true, eliminate the branch in the if statement where the condition is false, and when the condition in the if statement in the analysis unit is always false, eliminate the branch in the if statement where the condition is true;

[0043] Or, when the condition in the while statement in the analysis unit is always false, eliminate the branch in the while statement where the condition is true;

[0044] Alternatively, when the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement is the same as the condition in the second if statement, the second if statement is eliminated, and the branch in which the condition in the second if statement is true is added to the branch in which the condition in the first if statement is true, and the branch in which the condition in the second if statement is false is added to the branch in which the condition in the first if statement is false; when the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement is opposite to the condition in the second if statement, the second if statement is eliminated, and the branch in which the condition in the second if statement is true is added to the branch in which the condition in the first if statement is false, and the branch in which the condition in the second if statement is false is added to the branch in which the condition in the first if statement is true;

[0045] Alternatively, when the result of calling the function in the analysis unit is used as a judgment condition and the judgment condition affects the path reachability judgment, the function is expanded and inlined; when the result of calling the function in the analysis unit is not used as a judgment condition, or the judgment condition does not affect the path reachability judgment, the function is not inlined.

[0046] In one possible implementation, the second processing module is also used to: in the process of performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, when there are multiple different branches pointing to the same node in the control flow graph of the analysis unit, record the first state of the memory block corresponding to the node when the first variable transmitted from the first branch of the multiple branches enters the node; based on the recorded first state, traverse the statements in the nodes on the edges associated with the node and unexplored in the control flow graph, and perform state analysis on the state of the memory block pointed to by the pointer in the traversed statement.

[0047] In a possible implementation, the second processing module is further used to: when the second state of the memory block corresponding to the node is inconsistent with the first state when the pointers transmitted from other branches in the multiple branches enter the node, determine the error type and error statement according to the conflict between the first state and the second state. The error type includes: one or more of repeated release, memory leak and reuse after release, and the error statement includes: one or more of memory allocation statement, memory use statement and memory release statement.

[0048] In one possible implementation, the second processing module is also used to: when the second state of the memory block corresponding to the node is inconsistent with the first state when the pointer transmitted from other branches among multiple branches enters the node, and the first state is allocated, add a null assignment statement in other branches, and the null assignment statement is used to assign the pointer transmitted from other branches to null; or, output a prompt message, and the prompt message is used to prompt to change the second state to the empty state, or, change the second state to the first state.

[0049] In a possible implementation, after the second processing module outputs the detection result related to the time-related memory problem in the analysis unit, it is further used to: modify the detection result by using a constraint solver.

[0050] In a possible implementation, the detection result includes one or more of the following: a module with a time-related memory problem, or a line of code with a time-related memory problem, or a line or column in the source code of a pointer with a time-related memory problem, or an execution path from a memory allocation point with a time-related memory problem to an error reporting point, where the error reporting point includes a memory usage point or a memory release point.

[0051] In a third aspect, the present application provides a computing device cluster, comprising at least one computing device, each computing device comprising a processor and a memory; the processor of at least one computing device is used to execute instructions stored in the memory of at least one computing device, so that the computing device cluster performs the method described in the first aspect or any possible implementation of the first aspect.

[0052] In a fourth aspect, the present application provides a computer-readable storage medium, including computer program instructions, when the computer program instructions are executed by a computing device, the computing device executes the method described in the first aspect or any possible implementation of the first aspect; or, when the computer program instructions are executed by a computing device cluster, the computing device cluster executes the method described in the first aspect or any possible implementation of the first aspect. Exemplarily, the computing device cluster may include one or more computing devices.

[0053] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed by a computing device, causes the computing device to perform the method described in the first aspect or any possible implementation of the first aspect, or, when executed by a computing device cluster, causes the computing device cluster to perform the method described in the first aspect or any possible implementation of the first aspect. Exemplarily, the computing device cluster may include one or more computing devices.

[0054] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is a schematic diagram of the architecture of a time-related memory problem detection system provided in an embodiment of the present application;

[0056] Figure 2 is a schematic diagram of the structure of summary information of a pointer in an analysis unit provided in an embodiment of the present application;

[0057] Figure 3 It is a schematic diagram of the structure of summary information of a pointer in another analysis unit provided in an embodiment of the present application;

[0058] Figure 4 is a schematic diagram of an input-output graph (in-out graph) of an analysis unit provided in an embodiment of the present application;

[0059] Figure 5 It is a schematic diagram of a state transfer rule of a memory block provided in an embodiment of the present application;

[0060] Figure 6is a schematic diagram of a control flow chart of an analysis unit provided in an embodiment of the present application;

[0061] Figure 7 is a schematic diagram of a control flow chart of another analysis unit provided in an embodiment of the present application;

[0062] Figure 8 It is a schematic diagram of a function call graph in a source code provided by an embodiment of the present application;

[0063] Fig. 9 It is a schematic diagram of the architecture of another time-related memory problem detection system provided in an embodiment of the present application;

[0064] Fig.10 is a comparative schematic diagram of a control flow chart of an analysis unit before and after eliminating redundant paths in the analysis unit provided by an embodiment of the present application;

[0065] Fig.11 is a comparative schematic diagram of another control flow chart of the analysis unit before and after eliminating redundant paths in the analysis unit provided by an embodiment of the present application;

[0066] Fig.12 It is a comparative schematic diagram of whether redundant function expansion is eliminated in a control flow chart of an analysis unit provided in an embodiment of the present application;

[0067] Fig.13 It is a flowchart of a method for detecting time-related memory problems provided in an embodiment of the present application;

[0068] Fig.14 It is a structural diagram of a time-related memory problem detection device provided in an embodiment of the present application;

[0069] Fig.15 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0070] Fig.16 is a schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

[0071] Fig.17 It is a structural diagram of another computing device cluster provided in an embodiment of the present application. DETAILED DESCRIPTION

[0072] The term "and / or" in this article is a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The symbol " / " in this article indicates that the associated objects are in an or relationship, for example, A / B means A or B.

[0073] The terms "first" and "second" in the specification and claims herein are used to distinguish different objects rather than to describe a specific order of the objects. For example, a first response message and a second response message are used to distinguish different response messages rather than to describe a specific order of the response messages.

[0074] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0075] In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more than two. For example, multiple processing units refer to two or more processing units, etc.; multiple elements refer to two or more elements, etc.

[0076] First, the relevant technical terms involved in the technical solution provided in this application are introduced.

[0077] (1) Memory safety issues

[0078] When a computer program makes destructive access to a memory area, it will cause software errors or security vulnerabilities, which is called a memory safety problem in the program. These destructive access behaviors mainly include: null pointer dereference, out-of-bounds read, out-of-bounds write, use after release, memory leak, repeated release, etc. Among them, null pointer dereference, out-of-bounds read and out-of-bounds write have nothing to do with the order of memory access, but only with whether the memory access exceeds the space limit at the moment, which is called space-type memory safety problem. Use after release, memory leak and repeated release are strongly related to the order of memory access, which is called time-type memory problem.

[0079] (2) Control flow graph (CFG)

[0080] A control flow graph, also called a control flow chart, is an abstract representation of a process or program. It is an abstract data structure used in the compiler and maintained internally by the compiler. It represents all the paths that will be traversed during the execution of a program. A control flow graph can be composed of a series of nodes and edges. A node represents a basic block (BB) in the program. Statements in a basic block are executed in sequence, jumping from the last statement of a basic block to the first statement of the next basic block. Edges represent the control flow transfer relationship between basic blocks. Control flow transfers include branches of conditional statements (such as if statements and switch statements), iterations of loop statements, and function calls and returns. The control flow graph connects different basic blocks through these edges to show the control flow of the program.

[0081] (3) Basic blocks

[0082] A basic block is a sequence of instructions without branches, that is, a group of statements executed consecutively.

[0083] (4) Domination and post-dominance

[0084] If all paths from the program start point to basic block N reach basic block M before reaching basic block N, then basic block M is said to dominate basic block N. For example, if you have to go through BB1 to get to BB2, then BB1 is said to dominate BB2.

[0085] Considering the opposite direction, if all paths from basic block N to the end point of the program reach basic block M before reaching the end point, then basic block M post-dominates basic block N.

[0086] (5) Inline expansion

[0087] Inline expansion is an optimization technique that expands the function body directly to the call site. It can be manually specified (such as the inline keyword) or automatically completed through compilation optimization.

[0088] (6) Alias ​​relationship

[0089] When two pointers p and q point to the same memory area, the allocation, release, and use of p and the allocation, release, and use of q are functionally equivalent, and p and q are said to have an alias relationship.

[0090] (7) Static single assignment (ssa)

[0091] Static single assignment is a feature of the intermediate representation (IR) generated by the compiler, where each variable is assigned only once. In the original program, if the same variable is assigned multiple times, the old variable name is added with a subscript index to become a new variable name to identify each variable and its different versions.

[0092] (8) phi node

[0093] The phi node is on an IR with the ssa feature. If the current value of a variable i comes from the previous two different branches i1 and i2, in order to ensure that each variable is assigned only once, a phi node will be established: i3 = phi (i1, i2) to indicate that i3 may be equal to i1 or i2.

[0094] (9) Declaration point

[0095] A declaration point specifies the type of the variable p, but does not give a definition, such as "int*p;", "func(int*p);", etc.

[0096] (10) Definition point

[0097] A definition point is a statement that assigns a value to any variable p. For example: "p = malloc(100);", "p = 10;", "p = func(a);", etc.

[0098] (11) Distribution Point

[0099] A type of definition point, which refers to a statement that defines a pointer p using the return value of a memory allocation function. The memory allocation function can also be a user-defined function. For example: "p = malloc(100)".

[0100] (12) Use point

[0101] Statements that use the memory block pointed to by pointer p. The use of memory blocks can be divided into two forms: load or write (load / store). For example: "a = *p" is a load behavior, and "*p = 10;" is a write behavior.

[0102] (13) Release point

[0103] A statement that uses a memory release function to release the memory block pointed to by pointer p. The memory release function can also be a user-defined function. For example: "free(p)".

[0104] (14) Source code

[0105] Source code is a text file written in a programming language that contains instructions and algorithms for implementing specific functions. Source code can be converted into machine language or bytecode by a compiler or interpreter so that the computer can execute the program.

[0106] Next, the technical solution provided by this application is introduced.

[0107] For example, Figure 1 FIG. 1 is a schematic diagram showing the architecture of a time memory problem detection system provided by an embodiment of the present application. Figure 1 As shown, the time-based memory problem detection system 100 may include: a program partitioning module 110 and a summary generation module 120. The program partitioning module 110 is mainly used to divide the source code into independent analysis units. Each analysis unit is mainly composed of a function or a function group. In this way, the memory behavior of each analysis unit is decoupled, so that the calling order between the analysis units can be ignored in the subsequent. In addition, in order to further reduce the coupling between the analysis units, simplify the summary information generated subsequently and improve the analysis efficiency and analysis accuracy, multiple functions with strong coupling can be used as a function group through the calling relationship between the functions in the source code. For example, when in an if statement in a function, the flag is released when a certain condition is met, and the flag is not released when it is not met, and the definition of the flag comes from a function in the upper layer, then the coupling between the function where the if statement is located and the upper layer function is very strong. By taking the function group composed of the function and the upper layer function as an analysis unit, it is no longer necessary to analyze the impact caused by different flag values ​​when generating summary information in the subsequent generation, so as to achieve the purpose of simplifying the summary information.

[0108] The summary generation module 120 mainly processes each analysis unit divided by the program division module 110 to obtain summary information of each analysis unit and analyze the time memory problems existing in each analysis unit. The summary information of the analysis unit is used to describe the state of the memory block pointed to by the pointer associated with the formal parameter, global variable and return value in the analysis unit when entering and exiting the analysis unit. Exemplarily, the memory block state may include: uninitialized (kUninitialized), initialized (kInitialized), null pointer (kNull), allocated (kAllocated), or released (kFreed). For example, "int*p;" only declares p and does not point to any memory block. It is considered that the memory block pointed to by p is in the kUninitialized state, and any subsequent use of p is wrong; "intp=100;" means that the value of p is 100, which is a variable stored on the stack, indicating that p points to the memory area on the stack, and the memory block pointed to by p is considered to be in the kInitialized state. The memory on the stack is allocated and released by the system, so it is wrong to manually release the memory on the stack; "int*p=malloc(100);" means that p points to an allocated heap memory, and the length of the memory block is 100. It is considered that the memory block pointed to by p is in the kAllocated state. The memory on the heap needs to be manually allocated and released, so it is wrong to only allocate but not release the memory on the heap; "free(p);" means that p points to a freed heap memory, and the memory block pointed to by p is in the kFreed state. Since the memory block pointed to by p has been released, any subsequent use of p is wrong. Through this design of memory block status, stack memory and heap memory can be well distinguished. Since there is no clear distinction between pointer variables and non-pointer variables in programming languages ​​such as C, developers can actually write code such as "intp = malloc (100)" or "int*p = 10". In the former, although p is an int type, it is essentially a pointer to the first address of a heap memory with a length of 100 and needs to be released later. In the latter, although p is an int* type, it essentially points to a piece of stack memory and does not need to be released later. Therefore, through the design and identification of this memory block state, it is possible to distinguish between stack memory and heap memory, and there is no need to consider the division of pointer variables and non-pointer variables.

[0109] For summary information, pointers associated with formal parameters, global variables and return values ​​in an analysis unit can all have summary information. The summary information of all pointers associated with formal parameters and return values ​​in an analysis unit constitutes the summary information of the analysis unit. The summary information of a pointer can be used to describe the state of the memory block pointed to by the pointer when entering and exiting the analysis unit where the pointer is located. Exemplarily, pointers associated with formal parameters, global variables and return values ​​may include: pointers related to formal parameters and return values ​​and brought into or out of the analysis unit, or global variables, or one or more of pointers brought into or out of the analysis unit by global variables.

[0110] For example, Figure 2 A schematic diagram of the data structure of summary information provided by an embodiment of the present application is shown. Figure 2 As shown, the summary information may include: a pointerId field, an indirectLevelFldAndOffset field, an isIn field, an isOut field, an inStat field, an outStat field, a mayUseSet field, and a mustNoUseSet field.

[0111] The pointerId field is used to give each pointer a unique ID number for distinction.

[0112] The indirectLevelFldAndOffset field contains four parts: offset, fieldId, level, and formalId, which are used to distinguish multi-level pointers and structure members. Offset indicates the offset of the memory area pointed to by the pointer. For example, if intp=malloc(100) points to the first address of the memory block, and intq=p+1, then the offset value of q is 1, indicating that q points to a position with an offset of 1 byte in the memory area. FieldId indicates domain information. For example, if Struct S{int*a,int*b} defines a structure S, Sp=malloc(100) points to the first address of the memory block, then q=pa indicates that q points to the place in the memory area where domain a is. According to the definition of S, the ID number of domain a can be inferred and filled into the fieldId field of q. level indicates the level of indirect memory access, for example: if int**p=malloc(100) points to the first address of the memory block, then q=*p indicates a first-level indirect access to p, in which case the level field of q is 1; if q=**p, it indicates a second-level indirect access, in which case the level field of q is 2. formalId indicates the position of the pointer in the function parameter, and is used to connect the calling function and the called function. For example: in func(p,q), p is the 0th pointer associated with the formal parameter, so the formalId field of p is 0, and q is the 1st pointer associated with the formal parameter, so the formalId field of q is 1.

[0113] Both the isIn field and the isOut field can be true or false. Among them, when the isIn field is true, it means that the memory area pointed to by the pointer has entered the analysis unit. When the isOut field is true, it means that the memory area pointed to by the pointer has exited the analysis unit. In addition, the isIn field and the isOut field can also be true at the same time, indicating that the memory area pointed to by the pointer first entered the analysis unit and then exited the analysis unit. Exemplarily, the isIn field and the isOut field can be used to describe whether the memory area pointed to by the pointer has entered or exited the analysis unit, or has both entered and exited the analysis unit. For example: the code of a certain analysis unit is as follows:

[0114]

[0115] In this code, the memory block pointed to by pointer p both enters and exits the analysis unit, so the isIn field and isOut field in the summary information of pointer p are both true.

[0116] For the inStat field and the outStat field, when isIn=true, inStat indicates the memory block state of the memory area pointed to by the pointer when entering the analysis unit; when isIn=false, the inStat field is the initial value, i.e. kUninitialized. When isOut=true, outStat indicates the memory block state of the memory area pointed to by the pointer when exiting the analysis unit; when isOut=false, the outStat field is the initial value, i.e. kUninitialized. For example, the code of an analysis unit is as follows:

[0117]

[0118] In this code, the memory block pointed to by pointer p is only for entering the analysis unit, and memory is allocated for it before entering. Therefore, the isIn field in the summary information of pointer p is true, the isOut field is false, inStat = kAllocated, outStat = kUninitialized. The memory block pointed to by pointer q is also only for entering the analysis unit, and memory is allocated for it before entering. Therefore, the isIn field in the summary information of pointer q is true, the isOut field is false, inStat = kAllocated, outStat = kUninitialized. The memory block pointed to by pointer r is only for exiting the analysis unit, and memory is allocated for it before exiting. Therefore, the isIn field in the summary information of pointer r is false, the isOut field is true, inStat = kUninitialized, outStat = kAllocated.

[0119] mayUseSet is used to record the pointerId of all pointers that have an alias relationship with the pointer, which can be obtained by executing an alias analysis algorithm (such as Anderson algorithm, Steensgaard algorithm, etc.) on the code in a single analysis unit. For example, the code of a certain analysis unit is as follows:

[0120]

[0121] In this code, if p's pointerId=1, q's pointerId=2, and r's pointerId=3, then p's mayUseSet field is {2,3}, q's mayUseSet field is {1,3}, and r's mayUseSet field is {1,2}.

[0122] mustNoUseSet is used to record the pointerId of all pointers that must not have an alias relationship with a certain pointer. When a memory area pointed to by a pointer is released in a certain analysis unit, and then a memory area pointed to by another pointer is used, it is necessary to determine that these two memory areas do not have an alias relationship when entering this analysis unit (otherwise, a use after release will occur). For example, the code of a certain analysis unit is as follows:

[0123]

[0124] In this code, if p's pointerId=1 and q's pointerId=2, then p's musyNoUseSet field is {2}. Since the alias relationship is bidirectional, q's mustNoUseSet field is {1}.

[0125] It should be understood that Figure 2 The data structure of the summary information is shown in one form. In other embodiments, the data structure of the summary information may be in other forms or include more or fewer fields, depending on the actual situation and is not limited here. Figure 3 As shown. Figure 3 In the data structure of the summary information, the data structure may include: a pointerId field, a formalId field, an isIn field, an isOut field, an inStat field, and an outStat field.

[0126] In this embodiment, the summary generation module 120 may include: multiple input / output pointer extraction modules 121, multiple summary initialization modules 122, and multiple local analysis modules 123. Among them, one input / output pointer extraction module 121, one summary initialization module 122, and one local analysis module 123 are jointly responsible for processing one analysis unit. Since the decoupling of the memory behaviors of different analysis units has been achieved in the program division stage, the calling relationship between the analysis units can be directly ignored during the processing of the analysis units, and multiple analysis units can be processed in parallel at the same time, which improves the processing efficiency and reduces the analysis time.

[0127] The input and output pointer extraction module 121 is mainly responsible for extracting the pointers associated with the formal parameters, global variables and return values ​​in the analysis unit, so as to generate summary information using these pointers later. Among them, the input and output pointers refer to: pointers associated with the formal parameters, global variables and return values, which can enter and exit the analysis unit through the formal parameters, global variables or return values. Exemplarily, before extraction, the IR with SSA characteristics of the analysis unit can be obtained from the IR with SSA characteristics of the source code obtained by the compiler. Then, the formal parameters and return values ​​of the analysis unit can be extracted from the IR with SSA characteristics of the analysis unit, and then analyzed through constraint relationships (such as assignment, memory loading, function call, etc.) to extract the pointers associated with the formal parameters, global variables and return values, and clarify the entry or exit direction of each pointer. For example, the code in a certain analysis unit is as follows:

[0128]

[0129] In the above code, we can first extract the formal parameters, global variables and return values ​​according to the function description, namely len, p_0, s, p_2. Among them, len, p_0, s are formal parameters, u is a global variable, and p_2 is the return value. Then, we traverse all the statements in the function and identify the constraint relationship between the pointers to construct the following Figure 4 The input-output graph (in-out graph) is shown in Figure 4 In the figure, all variables connected in series by solid arrows (len, p_0, *p_0, **p_0, s, sa, ub) enter the analysis unit; all variables connected in series by dotted arrows (*(p_0)_1, q_0, q_1, q_2, *p_2, p_2, sa, ub) exit the analysis unit. In some embodiments, in addition to using in-outgraph to extract in-out pointers, they can also be extracted by recursive backtracking of formal parameters, global variables, and return values, or by using the assignment graph in the static value-flow (SVF) scheme. The specific details can be determined according to actual conditions and are not limited here.

[0130] The summary initialization module 122 is mainly responsible for initializing the summary information of the input and output pointers extracted from the analysis unit by the input and output pointer extraction module 121. The summary initialization module 122 can initialize a piece of summary information for each input and output pointer.

[0131] For example, Figure 2For example, for any input / output pointer, the pointerId field can be used to identify it in the summary information of the pointer, where different input / output pointers have different pointerIds. Then, in the summary information of the pointer, the indirectLevelFldAndOffset field can be filled according to the analysis result of the input / output parameter extraction module 121. For example, continue to refer to Figure 4 , level=0,offset=0,fieldId=0,formalId=1 in the indirectLevelFldAndOffset field in the summary information of p_0; level=1,offset=0,fieldId=0,formalId=1 in the indirectLevelFldAndOffset field in the summary information of p_0; level=2,offset=0,fieldId=0,formalId=1 in the indirectLevelFldAndOffset field in the summary information of p_0; level=0,offset=0,fieldId=0,formalId=2 in the indirectLevelFldAndOffset field in the summary information of s; level=1,offset=0,fieldId=1,formalId=2 in the indirectLevelFldAndOffset field in the summary information of sa; level=1,offset=0,fieldId=2,formalId=3 in the indirectLevelFldAndOffset field in the summary information of ub. Next, you can assign values ​​to the isIn and isOut fields. Among them, when the pointer enters the analysis unit through formal parameters or global variables, the isIn field can be assigned a value of true; when the pointer exits the analysis unit through formal parameters or return values, the isOut field is assigned a value of true; when the pointer can both enter the analysis unit and exit the analysis, the isIn field can be assigned a value of true, and the isOut field is also assigned a value of true. Finally, in the summary information of the pointer, the inStat and outStat fields can be initialized to kUninitialized, and the mayUseSet and mustNoUseSet fields can be initialized to empty. It should be understood that the time for initializing the contents of different fields in the summary information can be determined according to actual conditions and is not limited here.

[0132] The local analysis module 123 is mainly responsible for obtaining the control flow graph (CFG) of the analysis unit from the IR with the SSA feature of the analysis unit. In addition, the local analysis module 123 is also responsible for traversing the IR along the CFG to obtain each statement, performing state analysis on all pointers in the statement, and identifying the code lines with time-related memory problems based on the transition analysis results, and updating the inStat field and outStat field in the summary information initialized by the summary initialization module 122. For state analysis, Figure 5 As shown, Figure 5 (A) shows the state transition of the memory block pointed to by a pointer when a value is assigned to a pointer. Figure 5 (B), (C) and (D) respectively show the state transition of the memory block pointed to by a pointer when a pointer is used. Figure 5 In (A), after memory is allocated to the pointer, the state of the memory block pointed to by the pointer will become kAllocated; when the pointer is assigned a value of 0, the state of the memory block pointed to by the pointer will become kNull; when the pointer is assigned a non-zero constant, the state of the memory block pointed to by the pointer will become kInitialized; when the pointer is assigned a value other than 0, the state of the memory block pointed to by the pointer will inherit the state of the right value. For example, for pointer p, when p = malloc(), the state of the memory block pointed to by p becomes kAllocated; when p = 0, the state of the memory block pointed to by p becomes kNull; when p = 5, the state of the memory block pointed to by p becomes kInitialized; when p = q, the state of the memory block pointed to by p becomes the state of the memory block pointed to by q.

[0133] exist Figure 5In (B), when using a pointer, when the state of the memory block pointed to by the pointer is kUninitialized / kInitialized, if the pointer is an input parameter and the pointer is loaded or written (load / store), the state of the memory block pointed to by the pointer becomes kAllocated. If the pointer is an input parameter and the memory pointed to by the pointer is released, the state of the memory block pointed to by the pointer becomes kFreed. If the pointer is not an input parameter and the pointer is loaded or written (load / store), or the memory pointed to by the pointer is released, at this time, since the memory block pointed to by the pointer has not been allocated, there is a problem of using illegal memory, that is, the problem of using after release. If other operations are performed on the pointer, the state of the memory block pointed to by the pointer remains unchanged. For example, if p is the input parameter, when *p=x, the memory block pointed to by p is written, and the state of the memory block pointed to by p becomes kAllocated; when x=*p, the memory block pointed to by p is loaded, and the state of the memory block pointed to by p becomes kAllocated; when free(p), the memory block pointed to by p is released, and the state of the memory block pointed to by p becomes kFreed.

[0134] exist Figure 5 In (C), when using a pointer, when the state of the memory block pointed to by the pointer is kAllocated, if the memory pointed to by the pointer is released, the state of the memory block pointed to by the pointer becomes kFreed. If the program ends at this time, since the memory has been allocated, if it exits directly at this time, the memory will not be released, which will cause a memory leak problem due to the non-released memory. If the memory block pointed to by the pointer is loaded, written or other operations are performed, since the memory has been allocated, the state of the memory block pointed to by the pointer remains unchanged.

[0135] exist Figure 5 In (D), when using a pointer, when the state of the memory block pointed to by the pointer is kFreed, if the memory pointed to by the pointer is released, since the memory block is already in the released state, when the memory block pointed to by the pointer is released again, there will be a problem of repeated release. If the memory block pointed to by the pointer is loaded or written, the memory block will be used again. At this time, since the memory block is already in the released state, there will be a problem of reuse after release (i.e., using illegal memory). When performing other operations on the memory block pointed to by the pointer, the state of the memory block pointed to by the pointer remains unchanged.

[0136] It should be noted that Figure 5The kUninitialized, kInitialized, kAllocated, kNull, and kFreed in the table all indicate that the memory block is being used correctly. When the state of a memory block is any of these states, the state of the memory block can be called an "intermediate state." Figure 5 The use after free, double free and no free in the description all indicate that the memory block is not used correctly. When the state of the memory block is any of these states, the state of the memory block can be called the "termination state". Among them, use after free, double free and no free can be called types of termination states. One type of termination state can correspond to one error type. When the state of the memory block is the "termination state", different types of termination states can have different error types and error statements. For example: when the termination state type is use after free, the error type is use after release, and the error statement is a memory use statement; when the termination state type is double free, the error type is repeated release, and the error statement is a memory release statement; when the termination state type is no free, the error type is memory not released (also called "memory leak"), and the error statement is a memory allocation statement.

[0137] When the local analysis module 123 analyzes the analysis unit, based on Figure 5 According to the state transition diagram shown in , the statements in the IR are analyzed path by path and line by line, the state analysis is performed on each pointer involved in the statement, and the time-related memory problems existing in the analysis unit are identified. For example, when the state analysis of the memory block executed by a pointer is no-free, it can be confirmed that the state of the pointer is a termination state. Furthermore, the type of the termination state is no free, so it can be determined that the error type is that the memory is not released, and the error statement is the memory allocation statement of the pointer. In this way, the detection result of the pointer is obtained. When the states of the memory blocks pointed to by other pointers in the analysis unit are all intermediate states after the transfer, the local analysis module 123 can use the detection results it obtains as the results of this analysis.

[0138] In some embodiments, when there is a variable in a certain analysis unit whose current value comes from a plurality of different branches in front of the analysis unit, the variable will be processed using a phi node in the IR with ssa characteristics of the analysis unit. At this time, the local analysis module 123 can directly complete error detection by storing and comparing the states of each variable in the phi node during the analysis process to reduce the path exploration space and improve the analysis efficiency. When the storage result of the previous branch is inconsistent with the result obtained by the state analysis of the current branch execution, an error is reported. When reporting an error, the error type and error statement can be determined according to the conflict between the states of the memory blocks pointed to by the pointers transmitted from different branches. For example, as shown in Table 1, when the state of the memory block pointed to by the pointer p_0 transmitted by the recorded branch is kUninitialized, kInitialized or kFreed, if the state of the memory block pointed to by the pointer p_1 transmitted by a certain branch is kAllocated, at this time, the states corresponding to the two branches are inconsistent, so there is a conflict. Further, it can be determined from Table 1 that the error type can be determined as memory not released, and the error statement is the memory allocation statement of p_1. When the state of the memory block pointed to by the pointer p_0 of the recorded branch is kAllocated, if the state of the memory block pointed to by the pointer p_1 of a certain branch is kUninitialized, kInitialized or kFreed, at this time, the states corresponding to the two branches are inconsistent, so there is a conflict. Further, it can be determined from Table 1 that the error type is repeated release, and the error statement is the memory release statement of p_0.

[0139] Table 1

[0140]

[0141] Specifically, after the local analysis module 123 completes the exploration of a path, it can store the state of a variable in the phi node on this path during the exploration process. When the local analysis module 123 explores another path, the local analysis module 123 can explore the path before the phi node and the path after the phi node respectively. When the local analysis module 123 explores the path before the phi node, the state of the variable in the phi node obtained by this exploration can be compared with the state of the variable in the phi node stored when it previously detected other paths. When the two are consistent, it indicates that the state of each variable in the path explored this time is correct, that is, no error is required; when the two are inconsistent, a conflict occurs, and according to the state conflict on the branch at the time of the conflict, an error is executed according to the error type and error statement in Table 1. When the local analysis module 123 explores the path after the phi node, it can only explore the unexplored path without exploring the path that has been explored. In this way, the path exploration space can be reduced and the analysis efficiency can be improved in this way. Exemplarily, when exploring a path, the local analysis module 123 may traverse the statements contained in the nodes on the path, and perform a state analysis on the states of the memory blocks pointed to by the pointers in the traversed statements.

[0142] For example, the code in an analysis unit is as follows:

[0143]

[0144]

[0145] The CFG constructed by the above code can be Figure 6 As shown. Figure 6 As can be seen from the above code, memory allocation occurs at BB2 and BB3, and release occurs at BB7. In order to ensure that the memory usage behavior on each path is legal, all possible four paths in the graph need to be explored separately and traversed in depth-first order: 12457, 12467, 13457, and 13467. In fact, after exploring 12457, you can directly fall back to the BB4 node (provided that the state of the BB4 node is saved) and further explore 467, without starting from node 1 and re-exploring 12467; after exploring 12457 and 467, fall back to the BB1 ​​node, explore the BB4 node along 134, and then compare it with the previously saved state of the BB4 node to confirm whether 13457 and 13467 are reasonable. If the comparison result finds that the state is inconsistent, you can directly report an error. The overall exploration process is simplified to 12457, 467, and 134, and the exploration space is reduced from 2 times per edge to 1 time per edge.

[0146] The above simplification process can be completed on the premise that the state of the BB4 node can be saved and compared. The p in the BB4 node may come from BB2 or BB3. When processing p, the ssa technology is used to rename the p in BB2 to p_1 and the p in BB3 to p_2. In BB4, a new statement p_3=phi(p_1,p_2) is added to indicate "when entering BB4 from BB2, p_3=p_1; when entering BB4 from BB3, p_3=p_2". When the first step is to traverse 12457, the state of p_1 is obtained at the BB4 node and saved. At the same time, the state of p_3 is the same as p_1 and saved. When the second step is to traverse 467, the state of p_1, i.e. p_3, at the BB4 node is inherited. When the third step is to traverse 134, the state of p_2 is obtained and compared with the previously recorded state of p_1: if the state of p_2 is different from the state of p_1, a conflict occurs and an error is reported.

[0147] In addition, the more paths that need to be explored, the more obvious the reduction in path exploration space is, and the more obvious the effect is. For example, when the CFG constructed by the code of a certain analysis unit is Figure 7 As shown in the figure, there are 8 paths to be explored, namely: 1-2-4-5-7-8-10, 1-2-4-5-7-9-10, 1-2-4-6-7-8-10, 1-2-4-6-7-8-10, 1-2-4-6-7-9-10, 1-3-4-5-7-8-10, 1-3-4-5-7-9-10, 1-3-4-6-7-8-10, 1-3-4-6-7-9-10. When the states of the corresponding variables are stored in BB4 and BB7 and compared, the paths to be explored become 4, namely: 1-2-4-5-7-8-10, 7-9-10, 4-6-7, 1-3-4. At the same time, the path exploration space is reduced from 4 times per edge to 1 time per edge.

[0148] In some embodiments, when a statement of analysis unit A executes a call to analysis unit B, and executes subsequent code based on the call result, if the update of the summary of analysis unit B has not been completed at this time, the subsequent analysis results and summary generation of analysis unit A will be affected because the summary information of analysis unit B obtained is inaccurate.

[0149] For example, the code in analysis unit A is as follows:

[0150]

[0151] The code in analysis unit B is as follows:

[0152]

[0153] In the above code, a statement in analysis unit A executes a call from analysis unit B to analysis unit B, and the subsequent code is executed according to the call result. If the update of the summary of analysis unit B has not been completed, the local analysis module 123 for analyzing analysis unit A will assign the value of q to other during the analysis because the summary of funB() is empty, so the state of the memory block pointed to by q is kInitialized. Then, a load operation is performed in analysis unit A through *q, and Figure 5 It can be seen from the state transition diagram that an error occurs in the state transition at this time, so an error will be reported. After completing the update of the summary of analysis unit B, when analyzing analysis unit A, q is assigned to p, so the state of the memory block pointed to by q is the same as the state of the memory block pointed to by p in the summary of analysis unit B, that is, kAllocated. Then, a load operation is performed in analysis unit A through *q. Since memory has been allocated for q, it is correct to execute the load operation. It can be seen that only when the summary information of the callee (that is, the called analysis unit) no longer changes, can the correct summary information of the caller be obtained and the correct memory problem can be analyzed.

[0154] Therefore, in order to ensure that the summary information of each analysis unit is correct and the analysis results are correct, each local analysis module 123 can iteratively analyze the corresponding analysis unit. In order to obtain the correct summary information, the local analysis module 123 may iterate at most the deepest call level of the analysis unit in the function call graph of the source code. Of course, it may also be more than the deepest call level, which can be determined according to the actual situation and is not limited here. For example, Figure 8 As shown, in Figure 8In the callgraph shown, analysis units funD and funE do not call other analysis units, so the deepest call levels of both are 0, that is, no iteration is required when analyzing funD and funE, and only one analysis is required at most. Analysis unit funC directly calls analysis unit funD and does not call other analysis units, so its deepest call level is 1, that is, at most one iteration is required when analyzing funC. Analysis unit funA can directly call analysis unit funD, or indirectly call analysis unit funD through analysis unit funC, so its deepest call level is 2, that is, at most two iterations are required when analyzing funC. Analysis unit funB directly calls analysis units funD and funE, so its deepest call level is 1, that is, at most one iteration is required when analyzing funB. The analysis unit main needs to call the analysis units funA and funB, so its deepest calling level is the maximum value of the deepest calling levels of funA and funB plus 1, which is 3. That is, at most 3 iterations are required when analyzing main.

[0155] It should be understood that, since the memory behavior of each analysis unit has been decoupled through the summary technology in this embodiment, the calling order between the analysis units can be directly ignored, and the memory problem analysis of all analysis units can be performed at the same time, which reduces the analysis time and improves the analysis efficiency. In addition, since the memory behavior of the analysis unit is fixed, the summary information of the corresponding analysis unit can be directly called in subsequent calls without opening the corresponding analysis unit, which reduces the computational overhead and avoids an exponential increase in computation. For example, Figure 8 As shown in the figure, main, funA, funB, funC, funD, and funE can be analyzed simultaneously in the first round, although only the correct summary information of funD and funE is obtained in this round; in the first iteration, all functions are analyzed at the same time. On the premise that funD and funE have obtained the correct summary information, the correct summary information of funB and funC can be obtained; the iteration is repeated until the third iteration, all correct summary information is obtained. It is worth mentioning that since all analysis units are analyzed in each round, there is no need to construct similar Figure 8 The call graph does not need to know which functions’ summary information is correct in each round. It can be judged whether further iteration is needed by whether all the summary information obtained in this round is updated relative to all the summary information obtained in the previous round. When the summary is no longer updated, new iterations will not bring any benefits.

[0156] In some embodiments, in order to ensure the correctness of the summary information of each analysis unit finally obtained, it can be determined that the correct summary information of all analysis units is obtained when the summary information of all analysis units is no longer updated. At the same time, the memory problem identified at this time can be output as the final detection result. Exemplarily, the final detection result may include: the module with time-related memory problems, the code line with time-related memory problems, the column of the pointer with time-related memory problems in the source code, and one or more items in the execution path from the memory allocation point with time-related memory problems to the error reporting point. Among them, the error reporting point includes the memory usage point or the memory release point.

[0157] The above is an introduction to the time class memory problem detection system 100 provided by the embodiment of the present application. In actual operation, when there are multiple different branches pointing to the same node in the analysis unit, if the state of the memory block pointed to by the pointers transmitted by these branches is not unique, it is easy to generate wrong summary information, and it is easy to have the situation of false alarm. In addition, there are often redundant paths in the analysis unit, and these redundant paths also often affect the analysis result. In view of this, the embodiment of the present application provides another time class memory problem detection system.

[0158] For example, Fig. 9 FIG. 2 shows another schematic diagram of the architecture of a time-related memory problem detection system provided by an embodiment of the present application. Fig. 9 As shown, the time-based memory problem detection system 900 may include: Figure 1 The program partitioning module 110 and the summary generating module 120 described in the embodiment of the present invention, as well as the state normalization module 910 and the local optimization module 920. There can be multiple state normalization modules 910 and local optimization modules 920, and one state normalization module 910 can be used to process one analysis unit, and one local optimization module 920 can also be used to process one analysis unit.

[0159] Among them, the state normalization module 910 is mainly responsible for normalizing the states of the memory blocks pointed to by the pointers transmitted by these branches when there are multiple different branches pointing to the same node in the CFG of the analysis unit. Among them, it can be defined that when a pointer is a null pointer, the state of the memory block pointed to by the pointer can be any state.

[0160] For example, the code in an analysis unit is as follows:

[0161]

[0162]

[0163] In the CFG obtained by the above code, the two branches in the if statement point to the same node. However, in the if statement, the state of the memory block pointed to by the pointer p passed by the branch when flag = true is kFreed; the state of the memory block pointed to by the pointer p passed by the branch when flag = false is kAllocated. It can be seen that the states of the memory blocks pointed to by the pointers passed by the two branches in the if statement are inconsistent. Therefore, the state of the memory block pointed to by the p pointer in this analysis unit is not unique. At this point, in the above code, the state normalization can be achieved by converting the wild pointer to a null pointer. The converted code is as follows:

[0164]

[0165] The illegal use of null pointers is a common spatial memory safety issue, which can be solved by superimposing null pointer runtime checks and other means. On this basis, this embodiment assumes that the problem of illegal use of null pointers is perfectly solved, and the state of the memory block pointed to by the null pointer can be regarded as equivalent to any state. Through the converted code, it can be seen that the state of the memory blocks pointed to by the pointers passed by the two branches in the if statement is kFreed.

[0166] It should be understood that in addition to automatically normalizing the state, the state normalization module 910 can also inform the developer of the non-uniqueness of the state when multiple branches point to the same node and the states of the memory blocks pointed to by the pointers passed by these branches are not unique, so that the developer can achieve state normalization by normalizing the function interface to constrain the use of pointers.

[0167] For example, the input parameter p of the realloc function shown below describes the states of kAllocated, kFreed, and kAllocated when it passes through three branches, resulting in a non-unique state phenomenon. This information can be informed to the developer here, and the developer decides how to deal with it.

[0168]

[0169] The local optimization module 920 is mainly used to utilize the IR with SSA characteristics of the analysis unit to eliminate redundant paths in the analysis unit to reduce the false negative rate during subsequent analysis. For example, when there are redundant unreachable paths, when there is a situation where the unreachable path is released and then reused, it may be considered as a reachable path, and an error will be reported at this time. Eliminating redundant paths can include: eliminating one or more of the following: eliminating redundant reachability judgments, eliminating unreachable paths, and eliminating redundant function expansions. These are introduced separately below.

[0170] (1) Eliminate redundant reachability judgments

[0171] To eliminate redundant reachability judgments, when there is a dominating and post-dominant relationship between the memory allocation point and the release point, the memory behavior between the two points can be determined to be reasonable, and there is no need to perform reachability judgments on multiple paths in the intermediate process. Therefore, when there is a dominating and post-dominant relationship between the allocation point and the release point of the memory block pointed to by a pointer, the memory block can be marked as not requiring reachability judgment. In this way, it can be directly determined that the paths between the allocation point and the release point of this memory block are all reachable in the future, without having to judge the paths between the allocation point and the release point of the memory block one by one, thereby improving the analysis efficiency.

[0172] For example, if Fig.10 As shown in (A), it shows the CFG of a certain analysis unit. Each node represents a BB. Memory allocation behavior is performed at BB1, and memory release behavior is performed at BB7. At the same time, at the end of BB1, the judgment of condition a leads to the two branches BB2 and BB3 respectively. After converging to BB4, the judgment of condition b leads to the two branches BB5 and BB6 respectively, and finally converges to BB7. The whole process can be seen as having four paths: BB1→BB2→BB4→BB5→BB7, BB1→BB2→BB4→BB6→BB7, BB1→BB3→BB4→BB5→BB7, and BB1→BB3→BB4→BB6→BB7. In order to clarify whether the memory allocation, use, and release on each path are reasonable, it is necessary to judge the reachability of the four paths separately. From CFG, we can see that starting from BB1, we must pass through BB7 (BB1 dominates BB7), and to reach BB7, we must first pass through BB1 (BB7 post-dominates BB1). Therefore, the order of memory allocation, use, and release is reasonable, and we can make an analysis without making a reachability judgment. By directly judging the reachability based on the dominance and post-dominance relationship, we can directly treat the original four paths as one path for judgment, such as Fig.10 As shown in (B). After that, the statements on this path can be analyzed.

[0173] (2) Eliminate unreachable paths

[0174] For eliminating unreachable paths, when there are some definitely unreachable branches in the analysis unit, customized compilation techniques can be used to find and eliminate them. These scenarios include judgments on whether a single condition such as if(flag) or while(flag) is always true / false, and judgments on whether two conditions such as if(a)----if(b) are always the same, etc. The customized techniques mainly include two parts: the value range propagation (VRP) algorithm used to calculate and propagate the value range of variables, and the simplify control flow graph (simplify CFG) algorithm used to streamline and eliminate the CFG.

[0175] Among them, for code of the type "if(i < n) A; else B;", the VRP algorithm can be used to solve and propagate the value range of the judgment object i in the conditional statement to confirm the satisfiability of the judgment condition i < n. If the condition i < n will definitely be satisfied, the simplify CFG algorithm is used to eliminate the B branch. If the condition i < n will definitely not be satisfied, the simplify CFG algorithm is used to eliminate the A branch. Otherwise, no processing is done.

[0176] For code of the type "while(i < n) A;", the VRP algorithm can be used to solve and propagate the value range of the judgment object i in the conditional statement to confirm the satisfiability of the judgment condition i < n. If i < n will definitely not be satisfied, the simplify CFG algorithm is used to eliminate the A branch; otherwise, no processing is done.

[0177] For code of the type "if(a) A; else B; if(b) C; else D;", the VRP algorithm can be used to solve and propagate the value ranges of the judgment object a and the judgment object b in the conditional statement to confirm the satisfiability of a == b. If it will definitely be satisfied, the simplify CFG algorithm is used to connect the A-C branches and the B-D branches; if it will definitely not be satisfied, the simplify CFG algorithm is used to connect the A-D branches and the B-C branches; otherwise, no processing is done.

[0178] For example, such as Fig.11As shown in (A), it shows the CFG of a certain analysis unit. Each node represents a BB. BB1 and BB4 both use condition a for branch judgment. Through analysis, it can be seen that the graph contains four paths: BB1→BB2→BB4→BB5→BB7, BB1→BB2→BB4→BB6→BB7, BB1→BB3→BB4→BB5→BB7, BB1→BB3→BB4→BB6→BB7, but the two paths BB1→BB2→BB4→BB6→BB7 and BB1→BB3→BB4→BB5→BB7 are definitely unreachable, and there is no need to perform reachability judgment. Through the VRP algorithm, it can be known that the judgment conditions in BB1 and BB4 are consistent. After the judgment at BB4, the BB1→BB2 branch will definitely reach BB5 and cannot reach BB6. Through the simplifyCFG algorithm, the CFG of the analysis unit can be changed according to the above conclusions, BB4 is deleted, BB2 directly points to BB5, and BB3 directly points to BB6. In this way, subsequent summary generation, code generation and other tasks can be completed based on the new CFG, thereby reducing the number of paths that need to be judged subsequently and improving analysis efficiency.

[0179] (3) Eliminate redundant function expansion (inline)

[0180] For function expansion to eliminate redundancy, when the function call result is used as a judgment condition and affects the reachability analysis, function expansion (i.e., inline, expand the function body here) can be performed; otherwise, inline is not performed.

[0181] For example, if Fig.12 As shown in (A), it shows the CFG of a certain analysis unit, and each node represents a BB. In this analysis unit, memory allocation and release occur in BB1 and BB3 respectively. It is necessary to determine the reachability of the path if(funcA(…))→BB1→if(funcB(…))→BB3. This reachability depends on whether the return values ​​of the functions funcA(..) and funcB(..) are the same. Therefore, inline expansion is required to clarify the determination result.

[0182] like Fig.12As shown in (B), it shows the CFG of a certain analysis unit, and each node represents a BB. In this analysis unit, memory allocation and release occur at BB1 and BB4 respectively. In order to ensure that there is no reuse after release, it is necessary to determine that memory is not released at funcA(...); in order to ensure that there is no memory leak, it is necessary to determine that memory is released at funcB(...). The judgment of memory behavior can be obtained through the function summary, and there is no need for inline expansion. Moreover, once inline behavior occurs, the number of paths increases (for example, there are 4 paths after funcA is expanded, because the subsequent funcB(...) and BB4 are 2 paths, then the entire CFG becomes 4*2=8 paths), which increases the workload of reachability judgment and brings the risk of false alarms (once the reachability judgment is unclear, false alarms are likely to occur).

[0183] It should be understood that in Fig. 9 In the time-based memory problem detection system 900 shown, the state normalization module 910 and the local optimization module 920 can be selected either alone or simultaneously, depending on the actual situation and is not limited here.

[0184] The above is an introduction to the time-based memory problem detection system provided in the embodiment of the present application. Next, based on the above content, a time-based memory security detection method provided in the embodiment of the present application is introduced. Among them, part or all of the content in this method can refer to the above introduction to the time-based memory problem detection system.

[0185] For example, Fig.13 The flowchart of a time-based memory safety detection method provided by an embodiment of the present application is shown. It can be understood that the method can be executed by any device, equipment, platform, or device cluster with computing and processing capabilities. Fig.13 As shown, the time-based memory safety detection method may include the following steps:

[0186] S1301. Based on source code, obtain multiple analysis units, where the analysis unit includes a function or a function group.

[0187] In this embodiment, when analyzing the source code for time-related memory problems, multiple analysis units can be first obtained through the source code, for example, by dividing the source code. In this way, the memory behaviors of each analysis unit are decoupled, so that the calling order between the analysis units can be ignored in subsequent analysis. Each analysis unit can include a function or a function group. Exemplarily, for this step, see the aforementioned introduction to the program partitioning module 110 in the time-related memory problem detection system, which will not be repeated here.

[0188] S1302. Perform a state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein the multiple analysis units include a first analysis unit and a second analysis unit, the first analysis unit includes a function call statement, and the function call statement is used to call the second analysis unit. When the function call statement is analyzed, the summary information of the second analysis unit is used to perform a state analysis on the state of the memory block pointed to by the pointer associated with the function call statement, and the summary information of the analysis unit is used to describe the memory state of the memory block pointed to by the input and output pointers in the analysis unit when entering and exiting the analysis unit.

[0189] In this embodiment, after obtaining multiple analysis units, for any analysis unit, the state of the memory block pointed to by the pointer in the analysis unit can be analyzed. Wherein, when analyzing a function call statement contained in a certain analysis unit, the summary information of the analysis unit called by the function call statement can be used to perform state analysis on the state of the memory block pointed to by the pointer associated with the function call statement (such as: the pointer assigned by the function call statement, the pointer used by the function call statement, etc.). Wherein, the input and output pointers can be pointers associated with formal parameters, global variables and return values. For example: there is a function call statement p=funB() in analysis unit A. At this time, the state of the memory block pointed to by the return value of analysis unit B is directly used as the state of the memory block pointed to by p. Exemplarily, the summary information of the analysis unit is used to describe the memory state of the memory block pointed to by the input and output pointers in the analysis unit when entering and exiting the analysis unit. Exemplarily, the summary information of the second analysis unit can be but is not limited to being obtained in advance.

[0190] In this embodiment, the summary information of the analysis unit includes: summary information of the input and output pointers in the analysis unit. When the input and output pointers include a second pointer, the summary information of the second pointer may include one or more of the following: the identifier of the second pointer, the position of the formal parameters, global variables or return values ​​associated with the second pointer in the analysis unit, the relationship between the second pointer and the formal parameters, global variables and return values ​​in the analysis unit, the state of the memory block pointed to by the second pointer when entering or exiting the analysis unit, or the alias and non-alias relationship between the second pointer and other pointers in the input and output pointers of the analysis unit except the second pointer. For the data structure of the summary information, please refer to the aforementioned Figure 2 In some embodiments, when the state of the memory block pointed to by the pointer in a certain analysis unit is analyzed for the first time, the state of the memory block pointed to by the pointer in the summary information of the analysis unit may be empty or a certain initial value, which may be determined according to the actual situation and is not limited here.

[0191] As a possible implementation, when performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, the statements in the analysis unit can be traversed based on a preset state transition rule to perform state analysis on the state of the memory block pointed to by the pointer in the analysis unit. Exemplarily, the state transition rule can be Figure 5 The state transition rule shown in . The state transition rule can be used to describe the state change rule of the memory block pointed to by the pointer when assigning a value to a pointer or using the pointer. For example, for the process of state analysis based on the state transition rule, see the above Figure 5 In addition, in this way, during the analysis process, the memory allocation point, memory release point and memory usage point can be identified from the function statement, so as to solve the time-related memory problems related to the memory usage point, such as repeated release, reuse after release, etc.

[0192] As another possible implementation, when performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, a value flow graph for characterizing the relationship between the pointers in the analysis unit can be constructed first, and the memory allocation point and the memory release point can be identified on the value flow graph. Afterwards, the state analysis of the memory block pointed to by the pointer in the analysis unit can be performed through the value flow graph, or through the value flow graph and CFG. However, since it is difficult to identify the memory usage point in this way, it is difficult to identify time-related memory problems such as repeated release and reuse after release in this way.

[0193] S1303: Generate summary information of the analysis unit according to the status analysis result corresponding to the analysis unit, and obtain detection results related to time-related memory problems in the analysis unit.

[0194] In this embodiment, after completing the state analysis of the memory block pointed to by a certain pointer in the analysis unit, the state analysis result can be used to identify whether the statement related to the memory block in the analysis unit has a time-related memory problem. After completing the state analysis of the memory blocks pointed to by all pointers in the analysis unit, the time-related memory problem in the analysis unit can be identified through the obtained state analysis result to obtain the detection result related to the time-related memory problem in the analysis unit. In this way, the user can learn the area in the analysis unit where the time-related memory problem exists through the detection result. Exemplarily, the detection result includes one or more of the following: a module where the time-related memory problem exists, or a line of code where the time-related memory problem exists, or a line or column in the source code where the pointer has the time-related memory problem, or an execution path from the memory allocation point to the error point where the time-related memory problem exists. Among them, the error point includes a memory usage point or a memory release point. In addition, the summary information of the analysis unit can also be generated according to the state analysis result of the memory block executed by the pointer in the analysis unit, so as to perform state analysis through the summary information. See the description of the local analysis module 123 above for details, which will not be repeated here.

[0195] As a possible implementation method, when the state analysis result indicates that the state of the memory block is a termination state, it can be determined that the statements related to the memory block in the analysis unit have time-related memory problems. The termination state is used to characterize that the memory block is not used correctly. At this time, the error type and error statement can be determined according to the type of the termination state. The error type includes one or more of repeated release, memory leak, and reuse after release, and the error statement includes one or more of memory allocation statement, memory use statement, and memory release statement. In this way, the code line or statement with time-related memory problems is identified. When the state analysis result indicates that the state of the memory block is an intermediate state, it can be determined that the statements related to the memory block in the analysis unit do not have time-related memory problems. The intermediate state is used to characterize that the memory block is being used correctly.

[0196] Therefore, when performing time-related memory problem detection, the memory behaviors between different analysis units can be decoupled by dividing the source code, so that whether there are time-related memory problems in each analysis unit can be analyzed separately, avoiding global analysis and reducing resource overhead. In addition, through the summary information of the analysis unit, there is a calling behavior between the analysis units, and when analyzing the caller, the summary information of the callee can be directly queried without analyzing the memory behavior inside the callee, reducing the analysis amount and improving the analysis efficiency. At the same time, during the detection process, the memory behavior analysis across analysis units can be performed using the summary information, so that the memory behavior detection across analysis units can be realized, reducing the false alarm rate. In addition, the summary information of the analysis unit contains the status of the memory block corresponding to the pointer associated with the formal parameter, global variable and return value, which makes it possible to include all the information in the analysis unit that interacts with the outside, thereby reducing the loss between the summary information of the analysis unit and the actual memory behavior inside the analysis unit.

[0197] In some embodiments, the step of performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit in the aforementioned S1302 may specifically be: iteratively performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit. Among them, in the current round of iteration, the summary information generated in the previous round of iteration is used to perform state analysis on the state of the memory block pointed to by the pointer in the analysis unit. In this way, accurate summary information can be obtained through iterative analysis. For example, when the analysis units are funA and funB, and there is a p=funB() statement in funA, when analyzing funA, the state of p inherits the state of the return value of funB on the right, but the state of the return value of funB must be obtained from the summary of funB. Since it is difficult to control the order of generating the summary information of funA and funB in this round of iteration, the summary information of funB generated in the previous round is used in this round of iteration. Exemplarily, in order to speed up the detection speed, the state analysis of the state of the memory block pointed to by the pointer in the analysis unit can be performed in parallel iterations. Exemplarily, the current round of iteration may be the latest round of iteration, for example, if the latest round of iteration is the 5th round of iteration, then the 5th round is the current round. In addition, if the current round is the i-th round, then the previous round of the current round is the i-1th round.

[0198] At this time, the step of generating summary information of the analysis unit according to the state analysis result corresponding to the state analysis in the aforementioned S1303, and obtaining the detection result related to the time-related memory problem in the analysis unit, can be specifically as follows: in the iterative process, according to the state analysis result obtained in the current round of iteration, identifying the time-related memory problem existing in the analysis unit, and updating the summary information of the analysis unit; and, in the case where the summary information of multiple analysis units will not be updated, the time-related memory problem existing in multiple analysis units identified in the last round of iteration is used as the final detection result. Since the summary information of all analysis units is no longer updated, it can be understood that the summary information at this time is correct, so the time-related memory problem identified at this time is also accurate. In this way, the time-related memory problem identified in the last round of iteration is used as the final detection result, which can improve the accuracy of the detection. In addition, by constructing the summary information and iteratively using the summary information obtained in the previous round, it is possible to avoid the need to construct a call graph describing the call relationship between all analysis units, which does not need to consider the analysis order between the analysis units. At the same time, since building a callgraph requires global pointer analysis, it consumes a lot of resources. However, in this application, since there is no need to build a callgraph, the resource overhead can be greatly reduced.

[0199] As another possible implementation, in addition to iteratively analyzing multiple analysis units, one analysis unit may be processed first, and then another analysis unit. For example, referring to 8, funD may be analyzed first, and then funC may be analyzed after the analysis is completed, that is, each analysis unit may be processed sequentially from bottom to top along the function call graph. Of course, other methods may also be used, which may be determined according to actual conditions and are not limited here.

[0200] In some embodiments, before the aforementioned S1302, when there are multiple different branches pointing to the same node in the control flow chart of the analysis unit, the states of the memory blocks pointed to by the pointers transmitted by the multiple different branches can be normalized. In this way, the states of the memory blocks pointed to by the pointers transmitted by these branches can be made unique, thereby reducing the false alarm rate. Exemplarily, when normalizing, the wild pointers in multiple different branches can be converted into null pointers. Among them, the state of the memory block pointed to by the null pointer can be any state. In addition, a prompt message can also be output to prompt the user to modify the code in the analysis unit, thereby completing the normalization operation. For the normalization process of the state of the memory block, please refer to the aforementioned introduction to the state normalization module 910 in the time-based memory problem detection system 900, which will not be repeated here.

[0201] In some embodiments, before the aforementioned S1302, redundant paths in the analysis unit may be eliminated to improve detection efficiency and reduce false positive rate. Eliminating redundant paths in the analysis unit includes one or more of the following:

[0202] In the case where there is a dominating and post-dominating relationship between a memory allocation point and a release point of the memory block pointed to by the second pointer in the analysis unit, determining that there is no need to perform reachability judgment on the memory block pointed to by the second pointer;

[0203] Alternatively, when the condition in the if statement in the analysis unit is always true (i.e., always established), eliminate the branch in the if statement where the condition is false, that is, eliminate the branch in the if statement where the condition is not established; when the condition in the if statement in the analysis unit is always false (i.e., always not established), eliminate the branch in the if statement where the condition is true, that is, eliminate the branch in the if statement where the condition is established;

[0204] Alternatively, when the condition in the while statement in the analysis unit is always false (i.e., always not true), eliminate the branch in the while statement where the condition is true, that is, eliminate the branch in the if statement where the condition is true;

[0205] Alternatively, when the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement is the same as the condition in the second if statement, the second if statement is eliminated, and the branch in which the condition in the second if statement is true (i.e., the branch in which the condition is satisfied) is added to the branch in which the condition in the first if statement is true, and the branch in which the condition in the second if statement is false (i.e., the branch in which the condition is not satisfied) is added to the branch in which the condition in the first if statement is false; when the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement is opposite to the condition in the second if statement, the second if statement is eliminated, and the branch in which the condition in the second if statement is true is added to the branch in which the condition in the first if statement is false, and the branch in which the condition in the second if statement is false is added to the branch in which the condition in the first if statement is true;

[0206] Alternatively, when the result of calling the function in the analysis unit is used as a judgment condition, and the judgment condition affects the judgment of path reachability, the function is expanded and inlined; when the result of calling the function in the analysis unit is not used as a judgment condition, or the judgment condition does not affect the judgment of path reachability, the function is not inlined. For the process of eliminating redundant paths in the analysis unit, please refer to the above introduction to the local optimization module 920 in the time-based memory problem detection system 900, which will not be repeated here.

[0207] In some embodiments, in the process of state analysis of the state of the memory block pointed to by the pointer in the analysis unit, when there are multiple different branches pointing to the same node in the control flow chart of the analysis unit, the first state of the memory block corresponding to the node when the first variable transmitted by the first branch in the multiple branches enters the node can be recorded. Then, based on the recorded first state, the statements in the nodes on the edges associated with the node and not explored in the control flow chart are traversed, and the state of the memory block pointed to by the pointer in the traversed statement is analyzed. In this way, the path exploration space is simplified, the path exploration efficiency is improved, and the detection efficiency is further improved. Among them, when the statements in the nodes on the edges associated with the node and not explored in the control flow chart are traversed, and the state of the memory block pointed to by the pointer in the traversed statement is analyzed, the first state can be compared with the state of the memory block pointed to by the pointer transmitted by other branches to confirm whether these branches have time-related memory problems. See the introduction of the local analysis module 123 in the time-related memory problem detection system 100 for details, which will not be repeated here.

[0208] In some embodiments, when the second state of the memory block corresponding to the node is inconsistent with the first state when the pointer transmitted from other branches in multiple branches enters the node, the error type and error statement are determined according to the conflict between the first state and the second state. Among them, the error type includes: one or more of repeated release, memory leak and reuse after release, and the error statement includes: one or more of memory allocation statement, memory use statement and memory release statement. In this way, by comparing the recorded state with the state of the memory block corresponding to the node when the pointer transmitted from the current branch enters the node, it can be known whether there are time-related memory problems in the two branches, thereby improving the detection efficiency.

[0209] In some embodiments, when the second state of the memory block corresponding to the node is inconsistent with the first state when the pointers transmitted from other branches in multiple branches enter the node, and the first state is allocated, a null assignment statement is added in the other branches, and the null assignment statement is used to assign the pointers transmitted from other branches to null. In this way, the states of the memory blocks pointed to by the pointers transmitted from multiple different branches can be normalized, so that the states of the memory blocks pointed to by the pointers transmitted from these branches are unique, reducing the false alarm rate.

[0210] In addition, a prompt message may be output. The prompt message may be used to prompt that the second state is changed to an empty state, or that the second state is changed to the first state. In this way, the user can normalize the states of the memory blocks pointed to by the pointers transmitted from multiple different branches based on their own needs to resolve the conflict between the first state and the second state.

[0211] In some embodiments, after the aforementioned S1304, a constraint solver (such as a Z3 solver, etc.) may be used to correct the detection result, thereby further reducing the false negative rate.

[0212] It is understandable that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0213] The above is an introduction to the time-based memory security detection method provided in the embodiment of the present application. Next, based on the method in the above embodiment, a time-based memory security detection device provided in the embodiment of the present application is introduced.

[0214] For example, Fig.14 FIG. 1 is a schematic diagram showing the structure of a time memory security detection device provided by an embodiment of the present application. Fig.14 As shown, the time-related memory safety detection device may include: a first processing module 1401 and a second processing module 1402. The first processing module 1401 and the second processing module 1402. The first processing module 1401 is used to obtain multiple analysis units based on source code, and the analysis unit includes a function or a function group. The second processing module 1402 is used to perform state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein the multiple analysis units include the first analysis unit and the second analysis unit, and the first analysis unit includes a function call statement, and the function call statement is used to call the second analysis unit. When the function call statement is analyzed, the summary information of the second analysis unit is used to perform state analysis on the state of the memory block pointed to by the pointer associated with the function call statement, and the summary information of the analysis unit is used to describe the memory state of the memory block pointed to by the input and output pointers in the analysis unit when entering and exiting the analysis unit. The second processing module 1402 is also used to generate summary information of the analysis unit according to the state analysis result corresponding to the analysis unit, and obtain the detection result related to the time-related memory problem in the analysis unit. Exemplarily, the first processing module 1401 may be the aforementioned program division module 110. The second processing module 1402 may be the aforementioned summary generation module 120, or may be mainly composed of the aforementioned state normalization module 910 and the summary generation module 120, or may be mainly composed of the aforementioned local optimization module 920 and the summary generation module 120, or may be mainly composed of the aforementioned state normalization module 910, the local optimization module 920 and the summary generation module 120.

[0215] In some embodiments, when the second processing module 1402 performs state analysis on the state of the memory block pointed to by the pointer in the analysis unit, it is specifically used to: iteratively perform state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein, during the current round of iteration, the summary information generated in the previous round of iteration is used to perform state analysis on the state of the memory block pointed to by the pointer in the analysis unit.

[0216] The second processing module 1402 generates summary information of the analysis unit according to the state analysis results corresponding to the state analysis, and obtains the detection results related to the time-related memory problems in the analysis unit. It is specifically used for: in the iteration process, according to the state analysis results obtained in the current round of iteration, identifying the time-related memory problems existing in the analysis unit, and updating the summary information of the analysis unit; and, when the summary information of multiple analysis units will no longer be updated, taking the time-related memory problems existing in multiple analysis units identified in the last round of iteration as the final detection results.

[0217] In some embodiments, when performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, the second processing module 1402 is specifically used to: based on a preset state transition rule, traverse the statements in the analysis unit and perform state analysis on the state of the memory block pointed to by the pointer in the analysis unit. The state transition rule is used to describe the state change rule of the memory block pointed to by the first pointer when assigning a value to the first pointer or using the first pointer.

[0218] In some embodiments, when the second processing module 1402 identifies the time-related memory problems existing in the analysis unit according to the state analysis results corresponding to the state analysis, it is specifically used to: when the state analysis results indicate that the state of the memory block is a terminated state, determine that the statements related to the memory block in the analysis unit have time-related memory problems, and, according to the type of the terminated state, determine the error type and error statement, wherein the terminated state is used to characterize that the memory block is not used correctly, the error type includes: one or more of repeated release, memory leak and reuse after release, and the error statement includes: one or more of memory allocation statement, memory use statement and memory release statement; when the state analysis result indicates that the state of the memory block is an intermediate state, determine that the statements related to the memory block in the analysis unit do not have time-related memory problems, and the intermediate state is used to characterize that the memory block is being used correctly.

[0219] In some embodiments, the summary information of the analysis unit includes: summary information of pointers associated with formal parameters, global variables and return values ​​in the analysis unit, and the pointers associated with formal parameters, global variables and return values ​​include second pointers. Exemplarily, the pointers associated with formal parameters, global variables and return values ​​can be understood as input and output pointers.

[0220] The summary information of the second pointer includes one or more of the following: the identifier of the second pointer, the position of the formal parameters, global variables or return values ​​associated with the second pointer in the analysis unit, the relationship between the second pointer and the formal parameters, global variables and return values ​​in the analysis unit, the state of the memory block pointed to by the second pointer when entering or exiting the analysis unit, or the alias and non-alias relationship between the second pointer and pointers other than the second pointer in the analysis unit that are associated with the formal parameters, global variables and return values.

[0221] In some embodiments, the input and output pointers in the analysis unit may include one or more of the following: a pointer related to a formal parameter or a return value and brought into or out of the analysis unit, or a global variable, or a pointer related to a global variable and brought into or out of the analysis unit by the global variable.

[0222] In some embodiments, before performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, the second processing module 1402 is also used to: when there are multiple different branches pointing to the same node in the control flow graph of the analysis unit, normalize the states of the memory blocks pointed to by the pointers transmitted by multiple different branches.

[0223] In some embodiments, when normalizing the states of the memory blocks pointed to by the pointers transmitted from multiple different branches, the second processing module 1402 is specifically used to: convert wild pointers in multiple different branches into null pointers.

[0224] In some embodiments, before performing status analysis on the status of the memory block pointed to by the pointer in the analysis unit, the second processing module 1402 is further configured to: eliminate redundant paths in the analysis unit.

[0225] In some embodiments, eliminating redundant paths in the analysis unit includes one or more of the following:

[0226] In the case where there is a dominating and post-dominating relationship between a memory allocation point and a release point of the memory block pointed to by the second pointer in the analysis unit, determining that there is no need to perform reachability judgment on the memory block pointed to by the second pointer;

[0227] Alternatively, when the condition in the if statement in the analysis unit is always true, eliminate the branch in the if statement where the condition is false, and when the condition in the if statement in the analysis unit is always false, eliminate the branch in the if statement where the condition is true;

[0228] Or, when the condition in the while statement in the analysis unit is always false, eliminate the branch in the while statement where the condition is true;

[0229] Alternatively, when the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement is the same as the condition in the second if statement, the second if statement is eliminated, and the branch in which the condition in the second if statement is true is added to the branch in which the condition in the first if statement is true, and the branch in which the condition in the second if statement is false is added to the branch in which the condition in the first if statement is false; when the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement is opposite to the condition in the second if statement, the second if statement is eliminated, and the branch in which the condition in the second if statement is true is added to the branch in which the condition in the first if statement is false, and the branch in which the condition in the second if statement is false is added to the branch in which the condition in the first if statement is true;

[0230] Alternatively, when the result of calling the function in the analysis unit is used as a judgment condition and the judgment condition affects the path reachability judgment, the function is expanded and inlined; when the result of calling the function in the analysis unit is not used as a judgment condition, or the judgment condition does not affect the path reachability judgment, the function is not inlined.

[0231] In some embodiments, the second processing module 1402 is also used to: in the process of performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, when there are multiple different branches pointing to the same node in the control flow graph of the analysis unit, record the first state of the memory block corresponding to the node when the first variable transmitted from the first branch of the multiple branches enters the node; based on the recorded first state, traverse the statements in the nodes on the edges associated with the node and unexplored in the control flow graph, and perform state analysis on the state of the memory block pointed to by the pointer in the traversed statement.

[0232] In some embodiments, the second processing module 1402 is further used to: when the second state of the memory block corresponding to the node is inconsistent with the first state when the pointer transmitted from other branches in the multiple branches enters the node, determine the error type and error statement according to the conflict between the first state and the second state. The error type includes: one or more of repeated release, memory leak and reuse after release, and the error statement includes: one or more of memory allocation statement, memory use statement and memory release statement.

[0233] In some embodiments, the second processing module 1402 is also used for: when the second state of the memory block corresponding to the node is inconsistent with the first state when the pointer transmitted from other branches among multiple branches enters the node, and the first state is allocated, adding a null assignment statement in other branches, and the null assignment statement is used to assign the pointer transmitted from other branches to null; or, outputting a prompt message, and the prompt message is used to prompt to change the second state to the null state, or, to change the second state to the first state.

[0234] In some embodiments, after obtaining the detection result related to the time-related memory problem in the analysis unit, the second processing module 1402 is further used to: modify the detection result using a constraint solver.

[0235] In some embodiments, the detection results include one or more of the following: a module with a time-related memory problem, or a line of code with a time-related memory problem, or a line or column in the source code of a pointer with a time-related memory problem, or an execution path from a memory allocation point with a time-related memory problem to an error reporting point, where the error reporting point includes a memory usage point or a memory release point.

[0236] In some embodiments, Fig.14 The first processing module 1401 and the second processing module 1402 shown in the figure can be implemented by software or hardware. For example, the implementation of the first processing module 1401 is described below by taking the first processing module 1401 as an example. Similarly, the implementation of the second processing module 1402 can refer to the implementation of the first processing module 1401. In addition, Fig.15 The processing module 901 and the communication module 902 shown in FIG. 1 can also be implemented by software, or can be implemented by hardware, see the embodiment of FIG. Fig.14 The description of the communication module 902 and the processing module 901 shown in the figure will not be repeated here.

[0237] As an example of a software functional unit, the first processing module 1401 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the first processing module 1401 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code can be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code can be distributed in the same availability zone (AZ) or in different AZs, each AZ including a data center or multiple data centers with similar geographical locations. Among them, usually a region can include multiple AZs.

[0238] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0239] As an example of a hardware functional unit, the first processing module 1401 may include at least one computing device, such as a server, etc. Alternatively, the first processing module 1401 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0240] The multiple computing devices included in the first processing module 1401 can be distributed in the same region or in different regions. The multiple computing devices included in the first processing module 1401 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the first processing module 1401 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0241] It should be noted that, in other embodiments, the first processing module 1401 can be used to execute any step in the time-related memory problem detection method described in the above embodiment, and the second processing module 1402 can be used to execute any step in the time-related memory problem detection method described in the above embodiment. The steps that the first processing module 1401 and the second processing module 1402 are responsible for implementing can be specified as needed, and the first processing module 1401 and the second processing module 1402 respectively implement different steps in the time-related memory problem detection method described in the above embodiment to achieve Fig.14 The full functions of the time-based memory problem detection device 1400 are shown.

[0242] The present application also provides a computing device 1500. Fig.15 As shown, computing device 1500 includes: bus 1502, processor 1504, memory 1506 and communication interface 1508. Processor 1504, memory 1506 and communication interface 1508 communicate through bus 1502. Computing device 1500 can be a server or an electronic device. It should be understood that the present application does not limit the number of processors and memories in computing device 1500.

[0243] The bus 1502 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.15 The bus 1504 may include a path for transmitting information between various components of the computing device 1500 (eg, the memory 1506, the processor 1504, and the communication interface 1508).

[0244] The processor 1504 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0245] The memory 1506 may include a volatile memory, such as a random access memory (RAM). The processor 1504 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0246] The memory 1506 stores executable program codes, and the processor 1504 executes the executable program codes to respectively implement the aforementioned Fig.14 The functions of the first processing module 1401 and the second processing module 1402 shown in the embodiment are implemented to realize the time-related memory problem detection method described in the above embodiment. That is, the memory 1506 stores instructions for executing the time-related memory problem detection method described in the above embodiment.

[0247] Alternatively, the memory 1506 stores executable codes, and the processor 1504 executes the executable codes to respectively implement the aforementioned Fig.14 The functions of the time-related memory problem detection device 1400 shown in the embodiment are implemented to realize the time-related memory problem detection method described in the above embodiment. That is, the memory 1506 stores instructions for executing the time-related memory problem detection method described in the above embodiment.

[0248] The communication interface 1503 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 1500 and other devices or a communication network.

[0249] The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be an electronic device such as a desktop computer, a laptop computer, or a smart phone.

[0250] like Fig.16As shown, the computing device cluster includes at least one computing device 1500. The memory 1506 in one or more computing devices 1500 in the computing device cluster may store the same instructions for executing the time-based memory problem detection method described in the above embodiment.

[0251] In some possible implementations, the memory 1506 of one or more computing devices 1500 in the computing device cluster may also store some instructions for executing the time-related memory problem detection method described in the above embodiment. In other words, the combination of one or more computing devices 1500 can jointly execute the instructions for executing the time-related memory problem detection method described in the above embodiment.

[0252] It should be noted that the memory 1506 in different computing devices 1500 in the computing device cluster may store different instructions, which are respectively used to execute the aforementioned Fig.14 The illustrated part of the functions of the time-related memory problem detection device 1400. That is, the instructions stored in the memory 1506 in different computing devices 1500 can implement the functions of one or more modules in the first processing module 1401 and the second processing module 1402.

[0253] In some possible implementations, one or more computing devices in the computing device cluster may be connected via a network, which may be a wide area network or a local area network. Fig.17 A possible implementation is shown. Fig.17 As shown, two computing devices 1500A and 1500B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 1506 in the computing device 1500A stores instructions for executing the functions of the first processing module 1401. At the same time, the memory 1506 in the computing device 1500B stores instructions for executing the functions of the second processing module 1402.

[0254] It should be understood that Fig.17 The functionality of the computing device 1500A shown in FIG. 1 may also be implemented by multiple computing devices 1500. Similarly, the functionality of the computing device 1500B may also be implemented by multiple computing devices 1500.

[0255] The present application embodiment also provides another computing device cluster. The connection relationship between the computing devices in the computing device cluster can be similar to that of Fig.16 and Fig.17 The connection mode of the computing device cluster is different in that the memory 1506 in one or more computing devices 1500 in the computing device cluster may store the same instructions for executing the method in the above embodiment.

[0256] In some possible implementations, the memory 1506 of one or more computing devices 1500 in the computing device cluster may also store some instructions for executing the aforementioned time-related memory problem detection method. In other words, the combination of one or more computing devices 1500 may jointly execute instructions for executing the aforementioned time-related memory problem detection method.

[0257] Based on the method in the above embodiment, the embodiment of the present application provides a computer-readable storage medium, including computer program instructions. When the computer program instructions are executed by a computing device, the computing device executes the method in the above embodiment; or, when the computer program instructions are executed by a computing device cluster, the computing device cluster executes the method in the above embodiment. Exemplarily, the computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center that includes one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk), etc.

[0258] Based on the method in the above embodiment, an embodiment of the present application provides a computer program product containing instructions, which, when executed by a computing device, enables the computing device to execute the method in the above embodiment, or, when executed by a computing device cluster, enables the computing device cluster to execute the method in the above embodiment.

[0259] It is understood that the processor in the embodiments of the present application may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0260] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, and the software modules can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, mobile hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC.

[0261] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions may be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.

[0262] It should be understood that the various numerical numbers involved in the embodiments of the present application are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application.

[0263] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A time-based memory security detection method, characterized in that: The method comprises: Based on the source code, a plurality of analysis units are obtained, wherein the analysis unit includes a function or a function group; Performing a state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein the multiple analysis units include a first analysis unit and a second analysis unit, the first analysis unit includes a function call statement, the function call statement is used to call the second analysis unit, and when the function call statement is analyzed, using the summary information of the second analysis unit, performing a state analysis on the state of the memory block pointed to by the pointer associated with the function call statement, the summary information of the analysis unit is used to describe the memory state of the memory block pointed to by the entry and exit pointers in the analysis unit when entering and exiting the analysis unit; According to the status analysis result corresponding to the analysis unit, the summary information of the analysis unit is generated, and the detection result related to the time-related memory problem in the analysis unit is obtained.

2. The method according to claim 1, characterized in that The performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit includes: Iteratively performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein in the current round of iteration, using summary information generated in the previous round of iteration, the state analysis is performed on the state of the memory block pointed to by the pointer in the analysis unit; Generating summary information of the analysis unit according to the state analysis result corresponding to the state analysis, and obtaining the detection result related to the time-related memory problem in the analysis unit, includes: During the iteration process, based on the status analysis results obtained in the current round of iteration, the time-related memory problems existing in the analysis unit are identified, and the summary information of the analysis unit is updated; and, when the summary information of the multiple analysis units will not be updated any more, the time-related memory problems existing in the multiple analysis units identified in the last round of iteration are used as the final detection results.

3. The method according to claim 1 or 2, characterized in that: The summary information of the analysis unit includes: summary information of the input and output pointers in the analysis unit, the input and output pointers including the second pointer; The summary information of the second pointer includes one or more of the following: the identifier of the second pointer, the position of the formal parameters, global variables or return values ​​associated with the second pointer in the analysis unit, the relationship between the second pointer and the formal parameters, global variables and return values ​​in the analysis unit, the state of the memory block pointed to by the second pointer when entering or exiting the analysis unit, or the alias and non-alias relationship between the second pointer and other pointers in the entry and exit pointers except the second pointer.

4. The method according to any one of claims 1 to 3, characterized in that: The input and output pointers in the analysis unit include one or more of the following: A pointer associated with a formal parameter or a return value and brought into or out of the analysis unit, or a global variable, or a pointer associated with the global variable and brought into or out of the analysis unit by the global variable.

5. The method according to any one of claims 1 to 4, characterized in that: The performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit includes: Based on a preset state transfer rule, the statements in the analysis unit are traversed, and a state analysis is performed on the state of the memory block pointed to by the pointer in the analysis unit. The state transfer rule is used to describe the state change rule of the memory block pointed to by the first pointer when the first pointer is assigned a value or used.

6. The method according to any one of claims 1 to 5, characterized in that: The identifying, according to the state analysis result corresponding to the state analysis, the time memory problem existing in the analysis unit specifically includes: In the case where the state analysis result indicates that the state of the memory block is a termination state, determining that a statement related to the memory block in the analysis unit has a time-related memory problem, and determining an error type and an error statement according to the type of the termination state, wherein the termination state is used to characterize that the memory block is not used correctly, the error type includes: one or more of repeated release, memory leak, and reuse after release, and the error statement includes: one or more of a memory allocation statement, a memory use statement, and a memory release statement; When the state analysis result indicates that the state of the memory block is an intermediate state, it is determined that there is no time-related memory problem in the statements related to the memory block in the analysis unit, and the intermediate state is used to represent that the memory block is being used correctly.

7. The method according to any one of claims 1 to 6, characterized in that: Before performing status analysis on the status of the memory block pointed to by the pointer in the analysis unit, the method further includes: In the case that there are multiple different branches pointing to the same node in the control flow graph of the analysis unit, the states of the memory blocks pointed to by the pointers transmitted from the multiple different branches are normalized.

8. The method according to claim 7, characterized in that The normalizing the states of the memory blocks pointed to by the pointers transmitted by the multiple different branches specifically includes: The wild pointers in the multiple different branches are converted into null pointers.

9. The method according to any one of claims 1 to 8, characterized in that: Before performing status analysis on the status of the memory block pointed to by the pointer in the analysis unit, the method further includes: Redundant paths in the analysis unit are eliminated.

10. The method according to claim 9, characterized in that The eliminating redundant paths in the analysis unit includes one or more of the following: In the case where there is a dominating and post-dominating relationship between a memory allocation point and a release point of the memory block pointed to by the second pointer in the analysis unit, determining that there is no need to perform reachability judgment on the memory block pointed to by the second pointer; Alternatively, when the condition in the if statement in the analysis unit is always true, the branch in which the condition is false in the if statement is eliminated; when the condition in the if statement in the analysis unit is always false, the branch in which the condition is true in the if statement is eliminated; Alternatively, when the condition in the while statement in the analysis unit is always false, eliminating the branch in the while statement where the condition is true; Alternatively, when the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement has the same value as the condition in the second if statement, the second if statement is eliminated, and a branch in which the condition in the second if statement is true is added to a branch in which the condition in the first if statement is true, and a branch in which the condition in the second if statement is false is added to a branch in which the condition in the first if statement is false; When a second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement is opposite to the condition in the second if statement, the second if statement is eliminated, and a branch in which the condition in the second if statement is true is added to a branch in which the condition in the first if statement is false, and a branch in which the condition in the second if statement is false is added to a branch in which the condition in the first if statement is true; Alternatively, when the result of calling the function in the analysis unit is used as a judgment condition and the judgment condition affects the path reachability judgment, the function is expanded and inlined; when the result of calling the function in the analysis unit is not used as a judgment condition, or the judgment condition does not affect the path reachability judgment, the function is not inlined.

11. The method according to any one of claims 1-6, 9-10, characterized in that: The method further comprises: In the process of performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, when there are multiple different branches pointing to the same node in the control flow chart of the analysis unit, recording the first state of the memory block corresponding to the node when the first variable transmitted from the first branch of the multiple branches enters the node; Based on the recorded first state, statements in nodes on unexplored edges associated with the node in the control flow graph are traversed, and a state analysis is performed on the state of the memory block pointed to by the pointer in the traversed statement.

12. The method according to claim 11, characterized in that The method further comprises: When the second state of the memory block corresponding to the node is inconsistent with the first state when the pointers transmitted from other branches among the multiple branches enter the node, determine the error type and error statement according to the conflict between the first state and the second state; The error reporting types include: one or more of repeated release, memory leak and reuse after release, and the error reporting statements include: one or more of memory allocation statements, memory use statements and memory release statements.

13. The method according to claim 11, characterized in that The method further comprises: When the second state of the memory block corresponding to the node is inconsistent with the first state when the pointer transmitted from other branches among the multiple branches enters the node, and the first state is allocated, adding a null assignment statement in the other branches, wherein the null assignment statement is used to assign the pointer transmitted from the other branches to null; Alternatively, a prompt message is output, where the prompt message is used to prompt that the second state is changed to an empty state, or that the second state is changed to the first state.

14. The method according to any one of claims 1 to 13, characterized in that: After obtaining the detection result related to the time-related memory problem in the source code, the method further includes: The detection result is corrected using a constraint solver.

15. The method according to any one of claims 1 to 14, characterized in that: The test results include one or more of the following: A module with a time-related memory problem, or a line of code with a time-related memory problem, or a line or column of a pointer in the source code with a time-related memory problem, or an execution path from a memory allocation point with a time-related memory problem to an error reporting point, wherein the error reporting point includes a memory usage point or a memory release point.

16. A time memory security detection device, characterized in that: include: A first processing module, configured to obtain a plurality of analysis units based on source code, wherein the analysis unit includes a function or a function group; A second processing module is used to perform a state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein the multiple analysis units include a first analysis unit and a second analysis unit, the first analysis unit includes a function call statement, and the function call statement is used to call the second analysis unit. When the function call statement is analyzed, the summary information of the second analysis unit is used to perform a state analysis on the state of the memory block pointed to by the pointer associated with the function call statement, and the summary information of the analysis unit is used to describe the memory state of the memory block pointed to by the input and output pointers in the analysis unit when entering and exiting the analysis unit; The second processing module is further used to generate summary information of the analysis unit according to the status analysis result corresponding to the analysis unit, and obtain the detection result related to the time-related memory problem in the analysis unit.

17. The device according to claim 16, characterized in that When the second processing module performs state analysis on the state of the memory block pointed to by the pointer in the analysis unit, it is specifically used to: Iteratively performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein in the current round of iteration, using summary information generated in the previous round of iteration, the state analysis is performed on the state of the memory block pointed to by the pointer in the analysis unit; The second processing module generates summary information of the analysis unit according to the state analysis result corresponding to the state analysis, identifies the time memory problem existing in the analysis unit, and obtains the detection result related to the time memory problem in the analysis unit, specifically for: During the iteration process, based on the status analysis results obtained in the current round of iteration, the time-related memory problems existing in the analysis unit are identified, and the summary information of the analysis unit is updated; and, when the summary information of the multiple analysis units will not be updated any more, the time-related memory problems existing in the multiple analysis units identified in the last round of iteration are used as the final detection results.

18. The device according to any one of claims 16 or 17, characterized in that: The summary information of the analysis unit includes: summary information of the input and output pointers in the analysis unit, the input and output pointers including the second pointer; The summary information of the second pointer includes one or more of the following: the identifier of the second pointer, the position of the formal parameters, global variables or return values ​​associated with the second pointer in the analysis unit, the relationship between the second pointer and the formal parameters, global variables and return values ​​in the analysis unit, the state of the memory block pointed to by the second pointer when entering or exiting the analysis unit, or the alias and non-alias relationship between the second pointer and other pointers in the entry and exit pointers except the second pointer.

19. The device according to any one of claims 16 to 18, characterized in that: The input and output pointers in the analysis unit include one or more of the following: A pointer associated with a formal parameter or return value and brought into or out of the analysis unit, or a global variable, or a pointer brought into or out of the analysis unit by the global variable.

20. The pointer according to any one of claims 16 to 19, characterized in that: When the second processing module performs state analysis on the state of the memory block pointed to by the pointer in the analysis unit, it is specifically used to: Based on a preset state transfer rule, the statements in the analysis unit are traversed, and a state analysis is performed on the state of the memory block pointed to by the pointer in the analysis unit. The state transfer rule is used to describe the state change rule of the memory block pointed to by the first pointer when the first pointer is assigned a value or used.

21. The device according to any one of claims 16 to 20, characterized in that: When the second processing module identifies the time memory problem existing in the analysis unit according to the state analysis result corresponding to the state analysis, it is specifically used to: In the case where the state analysis result indicates that the state of the memory block is a termination state, determining that a statement related to the memory block in the analysis unit has a time-related memory problem, and determining an error type and an error statement according to the type of the termination state, wherein the termination state is used to characterize that the memory block is not used correctly, the error type includes: one or more of repeated release, memory leak, and reuse after release, and the error statement includes: one or more of a memory allocation statement, a memory use statement, and a memory release statement; When the state analysis result indicates that the state of the memory block is an intermediate state, it is determined that there is no time-related memory problem in the statements related to the memory block in the analysis unit, and the intermediate state is used to represent that the memory block is being used correctly.

22. The device according to any one of claims 16 to 21, characterized in that: Before performing status analysis on the status of the memory block pointed to by the pointer in the analysis unit, the second processing module is further used to: In the case that there are multiple different branches pointing to the same node in the control flow graph of the analysis unit, the states of the memory blocks pointed to by the pointers transmitted from the multiple different branches are normalized.

23. The device according to claim 22, characterized in that When normalizing the states of the memory blocks pointed to by the pointers transmitted by the multiple different branches, the second processing module is specifically used to: The wild pointers in the multiple different branches are converted into null pointers.

24. The device according to any one of claims 16 to 23, characterized in that: Before performing status analysis on the status of the memory block pointed to by the pointer in the analysis unit, the second processing module is further used to: Redundant paths in the analysis unit are eliminated.

25. The device according to claim 24, characterized in that The eliminating redundant paths in the analysis unit includes one or more of the following: In the case where there is a dominating and post-dominating relationship between a memory allocation point and a release point of the memory block pointed to by the second pointer in the analysis unit, determining that there is no need to perform reachability judgment on the memory block pointed to by the second pointer; Alternatively, when the condition in the if statement in the analysis unit is always true, the branch in which the condition is false in the if statement is eliminated; when the condition in the if statement in the analysis unit is always false, the branch in which the condition is true in the if statement is eliminated; Alternatively, when the condition in the while statement in the analysis unit is always false, eliminating the branch in the while statement where the condition is true; Alternatively, when the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement has the same value as the condition in the second if statement, the second if statement is eliminated, and a branch in which the condition in the second if statement is true is added to a branch in which the condition in the first if statement is true, and a branch in which the condition in the second if statement is false is added to a branch in which the condition in the first if statement is false; When a second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement is opposite to the condition in the second if statement, the second if statement is eliminated, and a branch in which the condition in the second if statement is true is added to a branch in which the condition in the first if statement is false, and a branch in which the condition in the second if statement is false is added to a branch in which the condition in the first if statement is true; Alternatively, when the result of calling the function in the analysis unit is used as a judgment condition and the judgment condition affects the path reachability judgment, the function is expanded and inlined; when the result of calling the function in the analysis unit is not used as a judgment condition, or the judgment condition does not affect the path reachability judgment, the function is not inlined.

26. The device according to any one of claims 16-21, 24, and 25, characterized in that: The second processing module is further used for: In the process of performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, when there are multiple different branches pointing to the same node in the control flow chart of the analysis unit, recording the first state of the memory block corresponding to the node when the first variable transmitted from the first branch of the multiple branches enters the node; Based on the recorded first state, statements in nodes on unexplored edges associated with the node in the control flow graph are traversed, and a state analysis is performed on the state of the memory block pointed to by the pointer in the traversed statement.

27. The device according to claim 26, characterized in that The second processing module is further used for: When the second state of the memory block corresponding to the node is inconsistent with the first state when the pointers transmitted from other branches among the multiple branches enter the node, determine the error type and error statement according to the conflict between the first state and the second state; The error reporting types include: one or more of repeated release, memory leak and reuse after release, and the error reporting statements include: one or more of memory allocation statements, memory use statements and memory release statements.

28. The device according to claim 26, characterized in that The second processing module is further used for: When the second state of the memory block corresponding to the node is inconsistent with the first state when the pointer transmitted from other branches among the multiple branches enters the node, and the first state is allocated, adding a null assignment statement in the other branches, wherein the null assignment statement is used to assign the pointer transmitted from the other branches to null; Alternatively, a prompt message is output, where the prompt message is used to prompt that the second state is changed to an empty state, or that the second state is changed to the first state.

29. The device according to any one of claims 16 to 28, characterized in that: After outputting the detection result related to the time memory problem in the source code, the second processing module is further used to: The detection result is corrected using a constraint solver.

30. The device according to any one of claims 16 to 29, characterized in that: The test results include one or more of the following: A module with a time-related memory problem, or a line of code with a time-related memory problem, or a line or column of a pointer in the source code with a time-related memory problem, or an execution path from a memory allocation point with a time-related memory problem to an error reporting point, wherein the error reporting point includes a memory usage point or a memory release point.

31. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1-15.

32. A computer-readable storage medium, characterized in that: The method comprises computer program instructions, and when the instructions are executed by a computing device cluster, the computing device cluster enables the computing device cluster to perform the method according to any one of claims 1 to 15, wherein the computing device cluster comprises at least one computing device.

33. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device cluster, the computing device cluster executes the method according to any one of claims 1 to 15, wherein the computing device cluster includes at least one computing device.

Images