Code accessibility analysis method and device, electronic equipment, product and storage medium

Abstract

The invention provides a code reachability analysis method and device, electronic equipment, a product and a storage medium, and relates to the technical field of code analysis. The method comprises the following steps: compiling a source code to obtain an intermediate expression instruction set; determining a function instruction set from the intermediate expression instruction set, and replacing an abstract variable name of each function instruction in the function instruction set with an actual class name to obtain a materialized function instruction set; obtaining a materialized function instruction information set based on the calling information of each materialized function instruction in the materialized function instruction set; and determining the accessibility of each function in the source code based on a matching result of each piece of materialized function instruction information in the materialized function instruction information set and each piece of preset dangerous function instruction information in the preset dangerous function instruction information set. According to the method, the defect that high-precision and high-efficiency code reachability analysis cannot be provided when an existing analysis method faces complex language characteristics in modern programming languages can be overcome.

Description

Technical Field

[0001] The present invention relates to the field of code analysis technology, and in particular to a code reachability analysis method, device, electronic equipment, product and storage medium. Background Art

[0002] In modern software development, with the widespread use of object-oriented programming languages, many advanced features have been introduced into programming languages, such as inheritance, polymorphism, and generics, which means that programs are becoming more and more complex. If these advanced features are not analyzed in depth, potential security risks and logical errors may exist in the code. Existing technologies usually rely on static analysis techniques such as control flow graph analysis, data flow analysis, and symbolic execution analysis to analyze advanced features in programming languages.

[0003] However, these existing technologies also have certain defects. For example, control flow graph analysis technology has low accuracy when dealing with polymorphism and indirect calls; data flow analysis technology has difficulty dealing with complex reference relationships, especially dynamic types and polymorphism; symbolic execution analysis technology cannot cope with the analysis needs of large-scale projects in terms of path explosion and state space expansion. It can be seen that the existing technology cannot provide high-precision and high-efficiency code reachability analysis when faced with complex language features in modern programming languages, which may lead to potential vulnerabilities in the program not being discovered in a timely manner. Summary of the invention

[0004] The present invention provides a code reachability analysis method, device, electronic device, product and storage medium to solve the defect that the prior art cannot provide high-precision and high-efficiency code reachability analysis when facing the complex language characteristics of modern programming languages.

[0005] The present invention provides a code reachability analysis method, comprising: Obtaining source code, compiling the source code to obtain an intermediate expression instruction set; Determine a function instruction set from the intermediate expression instruction set, replace the abstract variable name of each function instruction in the function instruction set with the actual class name to obtain a specific function instruction set; any function instruction in the function instruction set represents the execution logic of the function in the source code; Based on the calling information of each specific function instruction in the specific function instruction set, a specific function instruction information set is obtained, wherein any specific function instruction information in the specific function instruction information set represents the execution logic of the function in the source code and the calling information of the function; Based on the matching results of each concrete function instruction information in the concrete function instruction information set and each preset dangerous function instruction information in the preset dangerous function instruction information set, the reachability of each function in the source code is determined.

[0006] According to a code reachability analysis method provided by the present invention, before obtaining the specific function instruction information set based on the call information of each specific function instruction in the specific function instruction set, the method includes: Based on the type information and parameter transfer path of each concrete function instruction in the concrete function instruction set, calling information of each concrete function instruction in the concrete function instruction set is determined.

[0007] According to a code reachability analysis method provided by the present invention, the type information of the specific function instruction includes a local function type, an inherited function type or an overloaded function type; the call information of the specific function instruction includes independent call information, inheritance chain call information or polymorphic call information; The calling information of any of the specific function instructions is determined based on the following method: If the type information of the specific function instruction is a local function type, determining the call information of the specific function instruction as independent call information; If the type information of the specific function instruction is an inherited function type, determining the calling information of the specific function instruction as inheritance chain calling information; If the type information of the specific function instruction is an overloaded function type, the calling information of the specific function instruction is determined to be polymorphic calling information.

[0008] According to a code reachability analysis method provided by the present invention, after determining the call information of each concrete function instruction in the concrete function instruction set, the method further includes: Classify and mark each concrete function instruction in the concrete function instruction set based on the calling information of each concrete function instruction in the concrete function instruction set.

[0009] According to a code reachability analysis method provided by the present invention, the reachability of each function in the source code is determined based on the matching results of each specific function instruction information in the specific function instruction information set and each preset dangerous function instruction information in the preset dangerous function instruction information set, including: If the specific function instruction information in the specific function instruction information set matches the preset dangerous function instruction information in the preset dangerous function instruction information set, then determining the specific function instruction information to be analyzed; Analyze the specific function instruction information to be analyzed to obtain a reachability analysis result; The reachability analysis result is used to determine the reachability of the function represented by the specific function instruction information to be analyzed in the source code.

[0010] According to a code reachability analysis method provided by the present invention, the reachability analysis result includes the location information of the function represented by the concrete function instruction information to be analyzed in the source code, the execution logic risk prompt and the call information risk prompt.

[0011] The present invention also provides a code reachability analysis device, comprising: A compiling module, which is used to obtain source code, compile the source code, and obtain an intermediate expression instruction set; A concrete function instruction set determination module is used to determine a function instruction set from the intermediate expression instruction set, and replace the abstract variable name of each function instruction in the function instruction set with an actual class name to obtain a concrete function instruction set; any function instruction in the function instruction set represents the execution logic of the function in the source code; A specific function instruction information set determination module, which is used to obtain a specific function instruction information set based on the calling information of each specific function instruction in the specific function instruction set, wherein any specific function instruction information in the specific function instruction information set represents the execution logic of the function in the source code and the calling information of the function; A reachability analysis module is used to determine the reachability of each function in the source code based on the matching results of each specific function instruction information in the specific function instruction information set and each preset dangerous function instruction information in the preset dangerous function instruction information set.

[0012] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the code reachability analysis method described above is implemented.

[0013] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the code reachability analysis method described in any one of the above methods is implemented.

[0014] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the code reachability analysis method described above is implemented.

[0015] The code reachability analysis method, device, electronic device, product and storage medium provided by the present invention include obtaining source code, compiling the source code to obtain an intermediate expression instruction set; determining a function instruction set from the intermediate expression instruction set, replacing the abstract variable name of each function instruction in the function instruction set with an actual class name to obtain a concrete function instruction set; any function instruction in the function instruction set represents the execution logic of the function in the source code; based on the call information of each concrete function instruction in the concrete function instruction set, a concrete function instruction information set is obtained, and any concrete function instruction information in the concrete function instruction information set represents the execution logic of the function in the source code and the call information of the function; based on the matching results of each concrete function instruction information in the concrete function instruction information set and each preset dangerous function instruction information in the preset dangerous function instruction information set, the reachability of each function in the source code is determined. The present invention introduces the intermediate expression technology to convert the complex code structure into an intermediate layer data structure that is easy to analyze, and provides an effective solution to the problem that the existing code reachability analysis technology is insufficient in precision when processing the advanced features of modern programming languages. Specifically, the present invention concretizes the function instruction set in the intermediate expression, that is, replaces the abstract variable name of each function instruction with the actual class name, eliminates the uncertainty caused by dynamic type and polymorphism, clarifies the actual call target of the function, and not only greatly improves the accuracy of code analysis, but also simplifies the analysis logic and improves the execution efficiency. Further, by constructing a concrete function instruction information set, the execution logic and call information of each function in the source code are completely mapped to the concrete structure of the intermediate expression, realizing the function of quickly tracing back from the analysis result to the source code, and then being able to efficiently and accurately determine the reachability of each function in the source code, ensuring that no potential call path is missed in complex inheritance and polymorphic call scenarios; in addition, each concrete function instruction information is matched with each preset dangerous function instruction information in the preset dangerous function instruction information set, and the potential dangerous call path is quickly identified, thereby providing reliable support for code vulnerability detection and security assessment. Compared with the prior art, the present invention not only improves the analysis accuracy and efficiency, but also enhances the traceability of the source code, and provides a practical technical basis for code reachability analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1It is a flow chart of the code reachability analysis method provided by the present invention.

[0018] Figure 2 It is a structural schematic diagram of the code reachability analysis device provided by the present invention.

[0019] Figure 3 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] With the widespread use of modern programming languages, especially the widespread use of advanced features in object-oriented programming languages, the complexity of code is increasing. Many codes commonly have features such as inheritance, polymorphism, and dynamic typing. Although these features improve the flexibility and reusability of the code, they also bring huge challenges to the static analysis of the code, especially the code reachability analysis.

[0022] During the long-term research and analysis of code security, the applicant discovered that the commonly used analysis methods in the prior art, such as control flow graph analysis technology, data flow analysis technology, and symbolic execution analysis technology, although they play a role in processing these advanced features, still have certain limitations, that is, when performing reachability analysis on codes containing advanced features, they often cannot provide high-precision results, especially when dealing with large and complex projects. This lack of precision directly affects the reliability of code reachability analysis, especially in security analysis scenarios, it is easy to miss potential dangerous call paths, resulting in incomplete code vulnerability detection results. For example, control flow graph analysis technology is difficult to accurately process polymorphism and indirect calls, data flow analysis technology is not accurate enough when processing complex reference relationships, and symbolic execution analysis technology is limited by path explosion and state space expansion problems. The present invention is proposed based on this technical bias, aiming to overcome the above-mentioned deficiencies and provide more reliable technical support for code vulnerability detection and security assessment.

[0023] In view of the above problems, the present invention proposes the following embodiments.

[0024] Figure 1 It is a flowchart of the code reachability analysis method provided by the present invention, such as Figure 1 As shown, the method includes the following: Step 110, obtaining source code, compiling the source code, and obtaining an intermediate expression instruction set.

[0025] It should be noted that the compilation here does not directly generate executable files or target codes, but generates intermediate representations (IR). IR is an abstract representation that lies between source code and machine code. It contains both the high-level logical structure of the source code and removes language-specific syntax details. The compiler translates the source code into an intermediate representation instruction set. The instructions in the intermediate representation instruction set are simplified and structured program representations that facilitate further static analysis. Each instruction in the intermediate representation usually corresponds to an operation, such as variable assignment, function call, or conditional judgment.

[0026] Here, IR is the intermediate-level representation generated during program compilation. It is an abstract data form independent of the specific programming language and hardware platform. The intermediate expression instruction set is a specific implementation of the intermediate expression.

[0027] Step 120, determine a function instruction set from the intermediate expression instruction set, replace the abstract variable name of each function instruction in the function instruction set with the actual class name to obtain a concrete function instruction set; any function instruction in the function instruction set represents the execution logic of the function in the source code.

[0028] Here, the abstract variable name of the function instruction refers to a variable identifier in the program that does not have a clear specific type. The abstract variable name needs to be concretized into an actual class name to clarify the function logic and eliminate type uncertainty.

[0029] Here, the intermediate expression instruction set contains all the logic of the source code, including variable assignment, conditional judgment, loop structure, function call and other instructions. The function instruction set is a subset of the intermediate expression instruction set, focusing on the instructions that describe function calls and definitions, which is the key object of code reachability analysis. The concrete function instruction set is a set after the abstract variable name of each function instruction in the function instruction set is replaced with the actual class name. Each concrete function instruction is clearly marked with the actual class name, accurately representing the execution logic and call target of the source code function.

[0030] Step 130, based on the calling information of each specific function instruction in the specific function instruction set, a specific function instruction information set is obtained, wherein any specific function instruction information in the specific function instruction information set represents the execution logic of the function in the source code and the calling information of the function.

[0031] It should be noted that each concrete function instruction information in the concrete function instruction information set contains the execution logic and calling information of each concrete function instruction, and the execution logic and calling information of the concrete function instruction correspond to the execution logic and calling information of the function mapped by the concrete function instruction in the source code, wherein the execution logic refers to the operation logic inside the function, including the executed statements and execution logic; the calling information refers to the relevant information of the function call, including the calling target, parameters, return value, calling path, etc.

[0032] Specifically, through the detailed calling information of each concrete function instruction information, the calling relationship between functions becomes clear, especially in the case of polymorphism and dynamic types, the actual calling target of the function can be clearly identified to avoid misjudgment or missed judgment.

[0033] The specific operation of how to obtain the specific function instruction information set based on the calling information of each specific function instruction can be referred to the following embodiment, which will not be elaborated here.

[0034] Step 140 : Determine the reachability of each function in the source code based on the matching results of each concrete function instruction information in the concrete function instruction information set and each preset dangerous function instruction information in the preset dangerous function instruction information set.

[0035] Here, the preset dangerous function instruction information set contains the information of known potentially dangerous function instructions. Each preset dangerous function instruction information includes possible security vulnerabilities or dangerous behaviors, such as memory leaks, infinite callbacks, and null pointer references. Memory leaks refer to the failure of a function to properly release the allocated memory during operation, resulting in excessive memory resources being occupied, which may eventually cause the program to crash or system performance to degrade. Infinite callbacks refer to the continuous calling of a function or the called function to trigger the same operation again during execution, forming an infinite loop, which may cause a stack overflow or program crash. Null pointer references refer to accessing a pointer that has not been initialized or has been released, which may cause a crash or undefined behavior. The preset dangerous function instruction information set provides information that needs to be paid attention to in security analysis. Through automated analysis and matching, it can timely discover possible security vulnerabilities in the source code.

[0036] Here, function reachability refers to whether the function in the source code can be successfully executed. By determining whether the function is reachable, its security is analyzed, especially whether the function contains potentially dangerous operations.

[0037] The specific operation of determining the reachability of each function in the source code may refer to the following embodiment, which will not be described in detail here.

[0038] The code reachability analysis method provided by the embodiment of the present invention, by introducing the intermediate expression technology, converts the complex code structure into an intermediate layer data structure that is easy to analyze, and provides an effective solution to the problem that the existing code reachability analysis technology is insufficient in precision when processing the advanced features of modern programming languages. Specifically, the present invention eliminates the uncertainty caused by dynamic type and polymorphism by concretizing the function instruction set in the intermediate expression, that is, replacing the abstract variable name of each function instruction with the actual class name, and clarifies the actual call target of the function, which not only greatly improves the accuracy of code analysis, but also simplifies the analysis logic and improves the execution efficiency. Further, by constructing a concrete function instruction information set, the execution logic and call information of each function in the source code are completely mapped to the concrete structure of the intermediate expression, and the function of quickly tracing back from the analysis result to the source code is realized, so that the reachability of each function in the source code can be determined efficiently and accurately, ensuring that no potential call path is missed in complex inheritance and polymorphic call scenarios; in addition, each concrete function instruction information is matched with each preset dangerous function instruction information in the preset dangerous function instruction information set, and the potential dangerous call path is quickly identified, thereby providing reliable support for code vulnerability detection and security assessment. Compared with the existing technology, the present invention not only improves the analysis accuracy and efficiency, but also enhances the traceability of source code, providing a practical technical basis for code reachability analysis.

[0039] Based on any of the above embodiments, in the method, before obtaining the specific function instruction information set based on the call information of each specific function instruction in the specific function instruction set, the method includes: Based on the type information and parameter transfer path of each concrete function instruction in the concrete function instruction set, calling information of each concrete function instruction in the concrete function instruction set is determined.

[0040] It should be noted that the type information of a specific function instruction refers to the specific characteristics and execution method of the function represented by the specific function instruction in the source code. Through this information, the calling method of the function can be inferred; and then the order in which the function is called, the calling relationship between the function and other functions, the parameters passed when the function is called, the return value, etc., can be inferred, and then the calling information of the specific function instruction can be determined.

[0041] Here, the parameter passing path refers to the flow path of the parameters when the function represented by the concrete function instruction is called. It can be value passing or reference passing, depending on the definition and calling method of the function. The parameter passing path is the key to determining the function call context.

[0042] The code reachability analysis method provided by the embodiment of the present invention determines the call information of the specific function instruction based on the type information and parameter passing path of the specific function instruction, which can deeply understand the specific characteristics and execution mode of the function represented by each specific function instruction in the source code, and help to clarify the actual call path of the function. In addition, combined with the type information, the parameters and return values ​​passed when the function is called can also be inferred, providing a more detailed and accurate basis for the reachability analysis of the code. Through these steps, the accuracy and efficiency of code analysis can be improved, especially in complex systems and large projects, the uncertainty in the analysis process can be effectively reduced, and potential security risks and code vulnerabilities can be quickly located. This method not only enhances the reliability of code reachability analysis, but also provides strong support for code optimization and vulnerability detection.

[0043] Based on any of the above embodiments, in the method, the type information of the specific function instruction includes a local function type, an inherited function type or an overloaded function type; the call information of the specific function instruction includes independent call information, inheritance chain call information or polymorphic call information; The calling information of any of the specific function instructions is determined based on the following method: If the type information of the specific function instruction is a local function type, determining the call information of the specific function instruction as independent call information; If the type information of the specific function instruction is an inherited function type, determining the calling information of the specific function instruction as inheritance chain calling information; If the type information of the specific function instruction is an overloaded function type, the calling information of the specific function instruction is determined to be polymorphic calling information.

[0044] Here, the local function type refers to an independent function that is not involved in inheritance, is independently defined in the current action, and has no direct connection with other classes or parent classes; if the type information of a specific function instruction shows that it is a local function type, then the call information of the specific function instruction can be directly determined as independent call information, that is, the call of the function represented by the specific function instruction in the source code has no complex dependency relationship with other functions.

[0045] Here, the inherited function type refers to a function that has an inheritance relationship, is not defined in a subclass, and is directly inherited from a parent class or a superclass; if the type information of a concretized function instruction shows that it is an inherited function type, then the calling information of the concretized function instruction can be determined as inheritance chain calling information, and the inheritance chain calling information of the concretized function instruction clearly reflects the source and calling relationship of the function represented by the concretized function instruction in the source code on the inheritance chain.

[0046] Here, the overloaded function type means that there is an inheritance relationship, but the function inherited from the parent class or superclass is redefined in the subclass; if the type information of the concrete function instruction shows that it is an overloaded function type, then the calling information of the concrete function instruction can be determined as polymorphic calling information, and the polymorphic calling information of the concrete function instruction clearly reflects the parameter matching rules and dynamic dispatch results of the overloaded function represented by the concrete function instruction in the source code.

[0047] The code reachability analysis method provided by the embodiment of the present invention realizes accurate analysis and classification of function call relationships by distinguishing the type information of specific function instructions and determining the call information of specific function instructions based on this. According to the call characteristics of different function types, the call information classification is refined to ensure that the call path is clear and accurate, and complex inheritance hierarchies are effectively handled. The inheritance relationship between classes and their call logic are fully displayed, making the code reachability analysis more targeted and accurate, thereby greatly improving the efficiency and reliability of modern programming language code analysis.

[0048] Based on any of the above embodiments, in the method, after determining the calling information of each concrete function instruction in the concrete function instruction set, the method further includes: Classify and mark each concrete function instruction in the concrete function instruction set based on the calling information of each concrete function instruction in the concrete function instruction set.

[0049] It should be noted that classification marking refers to assigning a clear label to each specific function instruction to describe the calling information of the instruction. This marking not only makes it easy to distinguish different calling characteristics, but also significantly improves the efficiency of code analysis and processing.

[0050] Exemplarily, by marking the functions represented by each concrete function instruction in the source code of the concrete function instruction set into three attribute categories: local function, overloaded function and inherited function, the function definition and calling relationship between the subclass and the parent class and the grandparent class is clearly presented; the independent marking of local functions ensures that the function characteristics defined by the subclass itself are accurately captured; the explicit marking of overloaded functions makes the subclass's overriding behavior of the parent class function traceable, facilitating further identification of polymorphic calls; the annotation of inherited functions fully presents the functions inherited from the parent class or superclass, making the calling information of the entire inheritance chain transparent.

[0051] The code reachability analysis method provided by the embodiment of the present invention can not only clarify the calling relationship and inheritance chain between the functions represented by each concrete function instruction in the concrete function instruction set in the source code through classification marking, but also quickly identify polymorphic calls and potential coverage behaviors, laying a solid foundation for subsequent context analysis, vulnerability detection and execution path analysis. In addition, this classification marking also improves the tracking ability of function call behavior, enhances the comprehensiveness and efficiency of analysis, and further improves the practicality and accuracy of code reachability analysis in complex software.

[0052] Based on any of the above embodiments, in the method, determining the reachability of each function in the source code based on the matching results of each specific function instruction information in the specific function instruction information set and each preset dangerous function instruction information in the preset dangerous function instruction information set, includes: If the specific function instruction information in the specific function instruction information set matches the preset dangerous function instruction information in the preset dangerous function instruction information set, then determining the specific function instruction information to be analyzed; Analyze the specific function instruction information to be analyzed to obtain a reachability analysis result; The reachability analysis result is used to determine the reachability of the function represented by the specific function instruction information to be analyzed in the source code.

[0053] Here, the specific function instruction information to be analyzed refers to the specific function instruction information that successfully matches the preset dangerous function instruction information in the preset dangerous function instruction information set, which means that the specific function instruction information may be associated with the preset dangerous function instruction information, and its call logic and security need to be further verified. Successful matching is only a preliminary mark, and the call path, execution logic and potential impact on the overall behavior of the specific function instruction information to be analyzed need to be further analyzed to confirm the actual risk level.

[0054] Exemplarily, the specific function instruction information to be analyzed is analyzed to determine the reachability of the function in the program. Specifically, this analysis process involves an in-depth analysis of the function call path and control flow.

[0055] Exemplarily, when analyzing the concrete function instruction information to be analyzed, if the calling information of the concrete function instruction information to be analyzed is inheritance chain calling information, then it means that the calling information of the function represented by the concrete function instruction information to be analyzed in the source code is also inheritance chain calling information; specifically, if the function in the subclass inherits the function of the parent class, and the version of the function in the subclass in the parent class has a known vulnerability, then the function will be identified and marked as a potentially dangerous function, and then deeply analyzed to determine the reachability analysis result.

[0056] Exemplarily, when analyzing the concrete function instruction information to be analyzed, the parameter transfer path of the function represented by the concrete function instruction information to be analyzed in the source code will also be analyzed. By tracing the parameter transfer process, the type of the actual call of the function can be dynamically determined. If the type of the parameter passed in is uncertain during the transfer process, or the parsing of the dynamic type becomes complicated, the scope of the analysis will be expanded to cover the function call in the parent class or superclass. Especially in the case of polymorphism, the incoming parameters may cause the actual calling behavior of the function to change. In this case, the relevant function call will be marked as "potentially dangerous" to avoid potential vulnerabilities caused by polymorphism or dynamic changes in type. For example, if a function in a parent class or superclass has been marked as a dangerous function, but the type of the actual call cannot be determined due to polymorphic calls, the risk that the function call may bring will be inferred based on the parameter transfer situation, and it will be marked as a "dangerous call". In this way, potential security risks caused by polymorphism or type uncertainty can be effectively identified.

[0057] The code reachability analysis method provided by the embodiment of the present invention can efficiently identify functions that may cause security issues by matching specific function instruction information with preset dangerous function instruction information. By performing reachability analysis on the specific function instruction information to be analyzed, it can be further determined whether the function represented by the specific function instruction information to be analyzed in the source code can be actually called, thereby determining whether there is a vulnerability.

[0058] Based on any of the above embodiments, in this method, the reachability analysis result includes the location information of the function represented by the concrete function instruction information to be analyzed in the source code, the execution logic risk prompt and the call information risk prompt.

[0059] Here, since a synchronous mapping relationship is maintained between each intermediate expression instruction in the intermediate expression instruction set and the code block in the source code, the location information of the function represented by the specific function instruction information to be analyzed in the source code can be determined; this helps developers locate code segments with potential problems and promptly repair possible vulnerabilities.

[0060] Specifically, the execution logic risk prompt refers to the generation of prompt information that the function may trigger an exception or cause a vulnerability in certain circumstances based on the execution path and runtime behavior of the function represented by the specific function instruction information to be analyzed in the source code. For example, a function may cause a memory leak, buffer overflow, or undefined behavior if the input parameters are inappropriate. In this case, the logic risk prompt of the function is generated by analyzing its execution logic.

[0061] Exemplarily, the call information risk warning refers to the risk warning information generated based on the call chain of the function represented in the source code by the specific function instruction information to be analyzed. For example, if the function is polymorphic and the type of the parameter passed in is uncertain, a call information risk warning for the function will be generated.

[0062] The code reachability analysis method provided in an embodiment of the present invention can help developers efficiently discover and fix vulnerabilities through the location information of the function represented by the source code, execution logic risk prompts and call information risk prompts provided by the reachability analysis results, thereby improving the security and robustness of the source code.

[0063] The code reachability analysis device provided by the present invention is described below. The code reachability analysis device described below and the code reachability analysis method described above can be referenced to each other.

[0064] FIG2 is a schematic diagram of the structure of a code reachability analysis device provided by the present invention. As shown in FIG2 , the code reachability analysis device includes: A compiling module 210, which is used to obtain source code, compile the source code, and obtain an intermediate expression instruction set; A concrete function instruction set determination module 220 is used to determine a function instruction set from the intermediate expression instruction set, and replace the abstract variable name of each function instruction in the function instruction set with an actual class name to obtain a concrete function instruction set; any function instruction in the function instruction set represents the execution logic of the function in the source code; A specific function instruction information set determining module 230, which is used to obtain a specific function instruction information set based on the calling information of each specific function instruction in the specific function instruction set, wherein any specific function instruction information in the specific function instruction information set represents the execution logic of the function in the source code and the calling information of the function; The reachability analysis module 240 is used to determine the reachability of each function in the source code based on the matching results of each concrete function instruction information in the concrete function instruction information set and each preset dangerous function instruction information in the preset dangerous function instruction information set.

[0065] Figure 3 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 3As shown, the electronic device may include: a processor 310 , a communications interface 320 , a memory 330 and a communication bus 340 , wherein the processor 310 , the communications interface 320 , and the memory 330 communicate with each other via the communication bus 340 . The processor 310 can call the logic instructions in the memory 330 to execute the code reachability analysis method, which includes: obtaining source code, compiling the source code to obtain an intermediate expression instruction set; determining a function instruction set from the intermediate expression instruction set, replacing the abstract variable name of each function instruction in the function instruction set with an actual class name to obtain a concrete function instruction set; any function instruction in the function instruction set represents the execution logic of the function in the source code; based on the calling information of each concrete function instruction in the concrete function instruction set, a concrete function instruction information set is obtained, and any concrete function instruction information in the concrete function instruction information set represents the execution logic of the function in the source code and the calling information of the function; based on the matching results of each concrete function instruction information in the concrete function instruction information set and each preset dangerous function instruction information in the preset dangerous function instruction information set, the reachability of each function in the source code is determined.

[0066] In addition, the logic instructions in the above-mentioned memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0067] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the code reachability analysis method provided by the above methods, which method includes: obtaining source code, compiling the source code, and obtaining an intermediate expression instruction set; determining a function instruction set from the intermediate expression instruction set, replacing the abstract variable name of each function instruction in the function instruction set with an actual class name to obtain a concrete function instruction set; any function instruction in the function instruction set represents the execution logic of the function in the source code; based on the calling information of each concrete function instruction in the concrete function instruction set, a concrete function instruction information set is obtained, and any concrete function instruction information in the concrete function instruction information set represents the execution logic of the function in the source code and the calling information of the function; based on the matching results of each concrete function instruction information in the concrete function instruction information set and each preset dangerous function instruction information in the preset dangerous function instruction information set, the reachability of each function in the source code is determined.

[0068] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the code reachability analysis method provided by the above-mentioned methods, the method comprising: obtaining source code, compiling the source code, and obtaining an intermediate expression instruction set; determining a function instruction set from the intermediate expression instruction set, replacing the abstract variable name of each function instruction in the function instruction set with an actual class name to obtain a concrete function instruction set; any function instruction in the function instruction set represents the execution logic of the function in the source code; based on the calling information of each concrete function instruction in the concrete function instruction set, a concrete function instruction information set is obtained, and any concrete function instruction information in the concrete function instruction information set represents the execution logic of the function in the source code and the calling information of the function; based on the matching results of each concrete function instruction information in the concrete function instruction information set with each preset dangerous function instruction information in the preset dangerous function instruction information set, the reachability of each function in the source code is determined.

[0069] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0070] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0071] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A code reachability analysis method, characterized in that: include: Obtaining source code, compiling the source code to obtain an intermediate expression instruction set; Determine a function instruction set from the intermediate expression instruction set, replace the abstract variable name of each function instruction in the function instruction set with the actual class name to obtain a specific function instruction set; any function instruction in the function instruction set represents the execution logic of the function in the source code; Based on the calling information of each specific function instruction in the specific function instruction set, a specific function instruction information set is obtained, wherein any specific function instruction information in the specific function instruction information set represents the execution logic of the function in the source code and the calling information of the function; Based on the matching results of each concrete function instruction information in the concrete function instruction information set and each preset dangerous function instruction information in the preset dangerous function instruction information set, the reachability of each function in the source code is determined.

2. The code reachability analysis method according to claim 1, characterized in that: Before obtaining the specific function instruction information set based on the calling information of each specific function instruction in the specific function instruction set, the method includes: Based on the type information and parameter transfer path of each concrete function instruction in the concrete function instruction set, calling information of each concrete function instruction in the concrete function instruction set is determined.

3. The code reachability analysis method according to claim 2, characterized in that: The type information of the specific function instruction includes a local function type, an inherited function type or an overloaded function type; the call information of the specific function instruction includes independent call information, inheritance chain call information or polymorphic call information; The calling information of any of the specific function instructions is determined based on the following method: If the type information of the specific function instruction is a local function type, determining the call information of the specific function instruction as independent call information; If the type information of the specific function instruction is an inherited function type, determining the calling information of the specific function instruction as inheritance chain calling information; If the type information of the specific function instruction is an overloaded function type, the calling information of the specific function instruction is determined to be polymorphic calling information.

4. The code reachability analysis method according to claim 2, characterized in that: After determining the calling information of each concrete function instruction in the concrete function instruction set, the method further includes: Classify and mark each concrete function instruction in the concrete function instruction set based on the calling information of each concrete function instruction in the concrete function instruction set.

5. The code reachability analysis method according to claim 1, characterized in that: The determining the reachability of each function in the source code based on the matching results of each specific function instruction information in the specific function instruction information set and each preset dangerous function instruction information in the preset dangerous function instruction information set includes: If the specific function instruction information in the specific function instruction information set matches the preset dangerous function instruction information in the preset dangerous function instruction information set, then determining the specific function instruction information to be analyzed; Analyze the specific function instruction information to be analyzed to obtain a reachability analysis result; The reachability analysis result is used to determine the reachability of the function represented by the specific function instruction information to be analyzed in the source code.

6. The code reachability analysis method according to claim 5, characterized in that: The reachability analysis result includes the location information of the function represented by the concrete function instruction information to be analyzed in the source code, the execution logic risk prompt and the call information risk prompt.

7. A code reachability analysis device, characterized in that: include: A compiling module, which is used to obtain source code, compile the source code, and obtain an intermediate expression instruction set; A concrete function instruction set determination module is used to determine a function instruction set from the intermediate expression instruction set, and replace the abstract variable name of each function instruction in the function instruction set with an actual class name to obtain a concrete function instruction set; any function instruction in the function instruction set represents the execution logic of the function in the source code; A specific function instruction information set determination module, which is used to obtain a specific function instruction information set based on the calling information of each specific function instruction in the specific function instruction set, wherein any specific function instruction information in the specific function instruction information set represents the execution logic of the function in the source code and the calling information of the function; A reachability analysis module is used to determine the reachability of each function in the source code based on the matching results of each specific function instruction information in the specific function instruction information set and each preset dangerous function instruction information in the preset dangerous function instruction information set.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the code reachability analysis method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the code reachability analysis method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the code reachability analysis method according to any one of claims 1 to 6 is implemented.

Images