Vulnerability detection method and device

Abstract

The invention provides a vulnerability detection method and device. Through the application, under the condition of detecting whether the vulnerability caused by redundant operation exists in the application program or not, for example, under the condition of detecting whether the dual release vulnerability exists in the application program or not, the head function and the tail function which are used in pairs can be determined in the application program; according to the method, the head function and the tail function which are used in the pairing mode in each pair are independently detected, for example, whether the head function and the tail function which are used in the pairing mode have loopholes of redundant operation or not is detected, for example, whether the head function and the tail function which are used in the pairing mode have double release loopholes or not is detected, and the detection range of each time of detection is narrowed, namely, the detection efficiency is improved. According to the method, the detection range of each time of detection is narrowed into the head function and the tail function which are used in pairs, so that the problem of path explosion can be avoided as far as possible, the detection efficiency is improved as far as possible, and system resources consumed in the detection process are reduced as far as possible.

Description

Technical Field

[0001] This application relates to the field of computer technologies, and in particular, to a vulnerability detection method and apparatus. Background Art

[0002] In application programs developed via the C / C++ computer programming language, there are often a large number of error handling logics customized by developers. The error handling logic is used to roll back to the state before a certain operation is executed when an error occurs during the execution of the application program (for example, the state of system resources, etc., and system resources include memory, etc.).

[0003] However, since the error handling logic is customized by developers and the error handling logic is often very complex, there are often many vulnerabilities in the error handling logic, which affects the normal operation of the application program.

[0004] Thus, before the application program leaves the factory, it is often necessary to detect vulnerabilities in the error handling logic of the application program. Summary of the Invention

[0005] This application discloses a vulnerability detection method and apparatus.

[0006] In a first aspect, this application discloses a vulnerability detection method, the method including: obtaining a target function name pair, where the target function name pair includes a first head function name and a first tail function name used by the application program, the head function corresponding to the first head function name has the function of calling a resource application function and has the function of calling a resource release function, the tail function corresponding to the first tail function name has the function of calling a resource release function, the resource application function is used to apply for system resources, and the resource release function is used to release the system resources that have been applied for through the resource application function; detecting whether there is a double release vulnerability in the first head function corresponding to the first head function name and the first tail function corresponding to the first tail function name in the application program.

[0007] In a second aspect, this application discloses a vulnerability detection apparatus, the apparatus including: an obtaining module, configured to obtain a target function name pair, where the target function name pair includes a first head function name and a first tail function name used by the application program, the head function corresponding to the first head function name has the function of calling a resource application function and has the function of calling a resource release function, the tail function corresponding to the first tail function name has the function of calling a resource release function, the resource application function is used to apply for system resources, and the resource release function is used to release the system resources that have been applied for through the resource application function; a detecting module, configured to detect whether there is a double release vulnerability in the first head function corresponding to the first head function name and the first tail function corresponding to the first tail function name in the application program.

[0008] In a third aspect, the present application shows an electronic device, which includes: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the method shown in any of the aforementioned aspects.

[0009] In a fourth aspect, the present application shows a non-temporary computer-readable storage medium, which, when the instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to perform the method shown in any of the aforementioned aspects.

[0010] In a fifth aspect, the present application shows a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to perform the method shown in any of the aforementioned aspects.

[0011] Compared with the prior art, this application has the following advantages:

[0012] In this application, a target function name pair is obtained. The target function name pair includes the first header function name and the first tail function name used by the application. The header function corresponding to the first header function name has the function of calling the resource application function and the function of calling the resource release function. The tail function corresponding to the first tail function name has the function of calling the resource release function. The resource application function is used to apply for system resources, and the resource release function is used to release the system resources applied for by the resource application function. The first header function corresponding to the first header function name and the first tail function corresponding to the first tail function name in the application are detected to determine whether there is a double release vulnerability.

[0013] Through the present application, when detecting whether there are vulnerabilities caused by redundant operations in an application, for example, when detecting whether there is a double release vulnerability in an application, the paired head function and tail function can be determined in the application, and each pair of paired head function and tail function can be detected separately, for example, detecting whether there are redundant operation vulnerabilities in the paired head function and tail function, for example, detecting whether there are double release vulnerabilities in the paired head function and tail function, etc., thereby narrowing the detection scope of each detection, that is, narrowing the detection scope of each detection to the two functions of the paired head function and tail function, so that the path explosion problem can be avoided as much as possible, so as to improve the detection efficiency as much as possible and reduce the system resources consumed in the detection process. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 This is a flowchart of the steps of a vulnerability detection method of the present application.

[0015] Figure 2 This is a flowchart of the steps of a method for obtaining a target function name pair in this application.

[0016] Figure 3 It is a flowchart of the steps of a method for obtaining an initial function name pair in the present application.

[0017] Figure 4 It is a flowchart of the steps of a method for determining the function of a head function in the present application.

[0018] Figure 5 It is a flowchart of the steps of a method for determining the function of a tail function in the present application.

[0019] Figure 6 It is a flowchart of the steps of a method for detecting vulnerabilities in the present application.

[0020] Figure 7 It is a flowchart of the steps of a method for indexing a head function and a tail function in the present application.

[0021] Figure 8 It is a block diagram of the structure of a vulnerability detection device in the present application.

[0022] Figure 9 It is a block diagram of the structure of a device in the present application. Detailed implementation manners

[0023] To make the above objects, features, and advantages of the present application more obvious and understandable, the present application will be further described in detail below with reference to the accompanying drawings and specific implementation manners.

[0024] Many specific details are set forth in the following description in order to provide a thorough understanding of this specification. However, this specification can be implemented in many other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the connotation of this specification. Therefore, this specification is not limited by the specific implementations disclosed below.

[0025] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments and are not intended to limit one or more embodiments of this specification. The singular forms "a", "the", and "said" used in one or more embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more of the associated listed items.

[0026] Currently, most of the methods for detecting vulnerabilities in the error handling logic of application programs focus on the missing operations in the error handling logic. For example, detecting whether there are missing operations in the error handling logic, and the missing operations can be understood as the operations that should have been in the error handling logic but actually do not exist.

[0027] For example, since the error handling logic is used to roll back to the state before a certain operation is executed when an error occurs during the running of the application, there should be a statement in the error handling logic to call the "resource release function". By executing this statement to call the "resource release function", the system resources (such as memory resources, etc.) allocated for the operation before the operation is executed can be released, so as to achieve rolling back to the state before the operation is executed. However, if such a statement does not exist in the error handling logic, the "resource release function" cannot be called, and thus the system resources allocated for the operation before the operation is executed cannot be released, and it is impossible to roll back to the state before the operation is executed, which may lead to memory leakage and further cause the application to fail to run properly.

[0028] Therefore, in the case where there are missing operations in the error handling logic, the developer can be prompted to make up for the missing operations in the error handling logic, so that there are no longer missing operations in all the error handling logics in the application.

[0029] Subsequently, when there are no longer missing operations in all the error handling logics in the application, the application can be shipped out for installation and use by the general users.

[0030] However, after the general users installed and used the application, feedback from the general users was received again: the application crashed from time to time during operation.

[0031] In view of this, the inventor also tried to analyze the reason why "the application crashed from time to time when there were no missing operations in all the error handling logics in the application".

[0032] For example, the inventor analyzed the stack information of the application when "the application crashed when there were no missing operations in all the error handling logics in the application" and found that the application performed two release operations on a certain system resource continuously, that is, double-free, and it was the double-free that caused the application to crash.

[0033] Among them, the later release operation in the two consecutive release operations on a certain system resource is a redundant operation, not a missing operation. At present, most of the vulnerability detection methods for the error handling logic in the application focus on the missing operations in the error handling logic. Therefore, the current vulnerability detection methods for the error handling logic in the application fail to detect the two consecutive release operations on a certain system resource.

[0034] In view of this, a vulnerability detection method focusing on redundant operations in error handling logic is proposed to detect whether there is a situation where a system resource is released twice continuously in the error handling logic. In the case where a system resource is released twice continuously in the error handling logic, it prompts the developer to update the error handling logic in a timely manner so that the error handling logic no longer has the situation of releasing the system resource twice continuously.

[0035] Among them, the vulnerability detection method focusing on redundant operations in error handling logic can adopt static analysis methods, and static analysis methods can include taint tracking methods or symbolic execution analysis methods, etc.

[0036] For example, an application program can be executed through symbolic expressions, that is, the operations performed by the application program are simulated with symbols: symbolic values are used instead of actual data, and symbolic values are used as inputs; the variables of the application program are represented as symbolic expressions; the output calculated by the application program is represented as a function of the input symbolic values.

[0037] In one example, the application program can be abstracted and represented by symbols; then all possible input values are constructed, and each possible input value is used as an input to start the execution. The result of each step of the execution is represented by a logical or mathematical expression of the input value, constant, and other variables until the return statement at the end of the application program or the predefined analysis jump-out condition is satisfied.

[0038] However, as the scale of the error handling logic in the application program continues to increase, the number of conditional branches and deeply nested loops in the error handling logic of the application program also continues to increase. On this basis, symbolic execution can automatically generate test data for path traversal, but the executed paths are not targeted, and an exhaustive search is performed on possible paths. Therefore, in the case where the trigger path of double release in the error handling logic of the application program is very long, there is a path explosion problem, resulting in low detection efficiency and a large amount of system resources consumed during the detection process.

[0039] Among them, regarding path explosion, assume that there are multiple consecutive conditional judgment statements in the error handling logic of an application. A conditional judgment statement has two branches, yes and no, and each branch performs different actions. For example, at least one branch executes the next conditional judgment statement. The next conditional judgment statement also has two branches, yes and no, and each branch performs different actions. For example, at least one branch executes another conditional judgment statement. Another conditional judgment statement also has two branches, yes and no, and each branch performs different actions. For example, at least one branch executes another conditional judgment statement, and so on. It can be seen that there are many executable paths in the error handling logic of the application. Secondly, as the scale of the error handling logic in the application continues to increase, for example, the number of conditional judgment statements will increase accordingly. For each additional conditional judgment statement, the number of executable paths in the error handling logic of the application may double. It can be seen that as the scale of the error handling logic in the application continues to increase, the number of executable paths will increase in a power series of 2. For example, when there are N conditional judgment statements, there may be at most 2 to the power of N executable paths, and all executable paths need to be executed for vulnerability detection. However, under the constraints of limited time and system resources, it is often impossible to execute all the executable paths, thus failing to meet the requirements of accuracy and comprehensiveness of vulnerability detection, that is, the path explosion problem occurs.

[0040] Therefore, in order to avoid the path explosion problem as much as possible, so as to improve the detection efficiency as much as possible and reduce the system resources consumed during the detection process, the solution of this application is proposed.

[0041] Among them, before introducing the solution of this application, the technical terms that the solution of this application may involve are first explained.

[0042] CFG: Control-Flow-Graph, control flow graph.

[0043] Fuzzing: Fuzzy testing.

[0044] Double-free: Double free vulnerability.

[0045] UAF: Use-after-free, use-after-free vulnerability.

[0046] Function pair: Function name pair.

[0047] Lead function: The leading function in the function name pair.

[0048] Follower function: The trailing function in the function name pair.

[0049] Cross-checking: Cross-check.

[0050] Specifically, refer to Figure 1 , which shows a vulnerability detection method of the present application. This method is applied to an electronic device and includes:

[0051] In step S101, obtain a pair of target function names. The pair of target function names includes a first head function name and a first tail function name used by the application. The head function corresponding to the first head function name has the function of calling a resource application function and the function of calling a resource release function. The tail function corresponding to the first tail function name has the function of calling a resource release function. The resource application function is used to apply for system resources, and the resource release function is used to release the system resources that have been applied for through the resource application function.

[0052] System resources may include memory, video memory, core units in a GPU (Graphics Processing Unit), and / or global variables, etc. Thus, the resource application function is used to apply for a segment of memory, apply for a segment of cache, apply for at least one GPU core unit, and / or apply for (or initialize) global variables, etc.

[0053] The resource release function is used to release the system resources that have been applied for through the resource application function. For example, release a segment of memory that has been applied for by the resource application function, release a segment of cache that has been applied for by the resource application function, release the GPU core unit that has been applied for by the resource application function, and / or release the (initialized) global variables that have been applied for by the resource application function, etc.

[0054] Among them, the head function corresponding to the first head function name in the pair of target function names is used in the application, and the tail function corresponding to the first tail function name in the pair of target function names is used.

[0055] Among them, the head function corresponding to the first head function name and the tail function corresponding to the first tail function name in a pair of target functions are often used in pairs. For example, other functions in the application often apply for corresponding system resources by calling the first head function, and when resource recycling is required, the first tail function is called to specifically release the system resources that have been applied for by the first head function.

[0056] "The header function corresponding to the first header function name has the function of calling the resource application function and the function of calling the resource release function" can be understood as follows: When the header function corresponding to the first header function name is called, the header function corresponding to the first header function name will call the resource application function to apply for multiple system resources. After that, the header function corresponding to the first header function name may or may not call the resource release function. For example, in the case where all system resources among multiple system resources are successfully applied for after calling the header function corresponding to the first header function name, it often indicates that the application for multiple system resources is successful, and the header function corresponding to the first header function name often does not call the resource release function. Or, in the case where not all system resources among multiple system resources are successfully applied for after calling the header function corresponding to the first header function name, or in the case where all system resources among multiple system resources are successfully applied for after calling the header function corresponding to the first header function name, but other errors occur during the execution of the application program, the header function corresponding to the first header function name often calls the resource release function to release the applied system resources for state rollback to the state before calling the header function corresponding to the first function name.

[0057] In addition, "the tail function corresponding to the first tail function name has the function of calling the resource release function" can be understood as follows: In the case where not all system resources among multiple system resources are successfully applied for after calling the header function corresponding to the first header function name, or in the case where all system resources among multiple system resources are successfully applied for after calling the header function corresponding to the first header function name, but other errors occur during the execution of the application program, the tail function corresponding to the first tail function name may or may not be called.

[0058] In the case where the tail function corresponding to the first tail function name is not called, the tail function corresponding to the first tail function name will not call the resource release function to attempt to release the applied system resources.

[0059] Or, in the case where not all system resources among multiple system resources are successfully applied for after calling the header function corresponding to the first header function name, the header function corresponding to the first header function name returns a failure response. In the case where the caller gets the failure response, the tail function corresponding to the first tail function name that will be called is called, causing the tail function corresponding to the first tail function name to be called.

[0060] Accordingly, when the tail function corresponding to the first tail function name is called, the tail function corresponding to the first tail function name will attempt to execute the processing logic in the tail function corresponding to the first tail function name. Since there may be conditional constraints in the processing logic, there may be two cases at this time. The tail function corresponding to the first tail function name can successfully call the resource release function to release the system resources that have been applied for, or the tail function corresponding to the first tail function name cannot successfully call the resource release function and thus cannot release the system resources that have been applied for.

[0061] Among them, the acquisition method of obtaining the target function pair can be referred to in the embodiments Figure 2 shown later and will not be elaborated here.

[0062] In step S102, it is detected whether there is a double release vulnerability in the first head function corresponding to the first head function name and the first tail function corresponding to the first tail function name in the application program.

[0063] In this application, in the application program, the first head function corresponding to the first head function name and the first tail function corresponding to the first tail function name can be indexed. The first head function corresponding to the indexed first head function name can be all the first head functions corresponding to the first head function name in the application program, and the first tail function corresponding to the indexed first tail function name can be all the first tail functions corresponding to the first tail function name in the application program. Then, it can be detected whether there is a double release vulnerability in the first head function corresponding to the first head function name and the first tail function corresponding to the first tail function name in the application program.

[0064] This step can specifically be referred to in the embodiments Figure 6 shown later and will not be elaborated here.

[0065] In this application, the target function pair is obtained. The target function pair includes the first head function name and the first tail function name used by the application program. The head function corresponding to the first head function name has the function of calling the resource application function and the function of calling the resource release function. The tail function corresponding to the first tail function name has the function of calling the resource release function. The resource application function is used to apply for system resources, and the resource release function is used to release the system resources that have been applied for through the resource application function. It is detected whether there is a double release vulnerability in the first head function corresponding to the first head function name and the first tail function corresponding to the first tail function name in the application program.

[0066] Through this application, when detecting whether there are vulnerabilities of redundant operations in an application program, for example, when detecting whether there is a double-free vulnerability in the application program, the head function and the tail function used in pairs can be determined in the application program. For each pair of the head function and the tail function used in pairs, separate detection is performed. For example, it is detected whether there are vulnerabilities caused by redundant operations in the head function and the tail function used in pairs. For example, it is detected whether there is a double-free vulnerability in the head function and the tail function used in pairs, etc. The detection scope for each detection is narrowed, that is, the detection scope for each detection is narrowed to these two functions, namely, the head function and the tail function used in pairs, so as to avoid the path explosion problem as much as possible, and to improve the detection efficiency as much as possible and reduce the system resources consumed during the detection process.

[0067] In another embodiment of this application, refer to Figure 2 , step S101 includes;

[0068] In step S201, an initial function name pair is obtained. The initial function name pair includes a second head function name and a second tail function name used in the application program. The head function corresponding to the second head function name is at least used for applying for content, and the tail function corresponding to the second tail function name is used to release the content applied for by the head function corresponding to the second head function name.

[0069] In this application, there is a call statement in the application program that calls the head function corresponding to the second head function name. The call statement has the second head function name. That is, the application program calls the head function corresponding to the second head function name through the second head function name. Thus, it can be understood that the second head function name is the head function name used in the application program.

[0070] In one embodiment, the head function corresponding to the second head function name may have the function of calling a resource application function and the function of calling a resource release function. In this case, the head function corresponding to the second head function name can be used to apply for system resources and can be used to release resources.

[0071] For example, if the head function corresponding to the second head function name has the function of calling a resource release function, the head function corresponding to the second head function name often also has the function of calling a resource application function. Thus, if the head function corresponding to the second head function name can be used to release resources, the head function corresponding to the second head function name can also be used to apply for system resources.

[0072] However, in another embodiment, the head function corresponding to the second head function name may not have the function of calling a resource application function and may not have the function of calling a resource release function. In this case, the head function corresponding to the second head function name is not used to apply for system resources and is not used to release system resources.

[0073] For example, a resource application function is used to apply for system resources. For example, system resources may include memory, video memory, core units in the GPU, and / or global variables, etc. Thus, the resource application function is used to apply for a segment of memory, apply for a cache, apply for at least one GPU core unit, and / or apply for (or initialize) global variables, etc.

[0074] However, the header function corresponding to the second header function name may sometimes be used to apply for a "lock", or to increment a count, rather than to apply for system resources.

[0075] It can be seen that although the header function corresponding to the second header function name is used to apply for content, it is not used to apply for system resources (content includes system resources, and also includes locks and cumulative counts, etc.).

[0076] Correspondingly, in the present application, there is a call statement in the application program that calls the tail function corresponding to the second tail function name. This call statement has the second tail function name. That is, the application program calls the tail function corresponding to the second tail function name through the second tail function name. Thus, it can be understood that the second tail function name is the tail function name used by the application program.

[0077] In one embodiment, the tail function corresponding to the second tail function name may have the function of calling a resource release function. In this case, the tail function corresponding to the second tail function name can be used to release system resources.

[0078] However, in another embodiment, the tail function corresponding to the second tail function name may not have the function of calling a resource release function. In this case, the tail function corresponding to the second tail function name is not used to release system resources.

[0079] For example, a resource release function is used to release system resources. For example, system resources may include memory, video memory, core units in the GPU, and / or global variables, etc. Thus, the resource release function is used to release a segment of memory that has been applied for by the resource application function, to release a cache that has been applied for by the resource application function, to release the GPU core units that have been applied for by the resource application function, and / or to release the (or initialized) global variables that have been applied for by the resource application function.

[0080] However, the tail function corresponding to the second tail function name may sometimes be used to release a "lock", or to set a count to 0, rather than to release system resources.

[0081] It can be seen that although the header function corresponding to the second header function name is used to release the applied content, it is not used to release the applied system resources (content includes system resources, and also includes locks and cumulative counts, etc.).

[0082] Thus, given the initial function name pair, the target function pair can be determined from the initial function pair. That is, it can be determined whether the head function corresponding to the second head function name in the initial function pair has the function of calling the resource release function, and it can be determined whether the tail function corresponding to the second tail function name in the initial function pair has the function of calling the resource release function. Specifically, it can be done through the following steps S202 to S203.

[0083] That is, for any initial function name pair, the process of the following steps S202 to S203 can be executed, and the same applies to each of the other initial function pairs.

[0084] Among them, the obtaining method of the initial function name pair can be referred to in the Figure 3 embodiment shown later, which will not be elaborated here.

[0085] In step S202, in the application program, it is determined whether the second head function corresponding to the second head function name in the initial function name pair has the function of calling the resource release function, and it is determined whether the second tail function corresponding to the second tail function name in the initial function name pair has the function of calling the resource release function.

[0086] In the application program of this application, the head function and the tail function are used in pairs. For example, after the caller (another function) of the head function calls the head function to apply for system resources, the application program can then use the system resources applied for by the head function. Subsequently, when the application program no longer needs to use the system resources applied for by the head function, the caller will call the tail function to release the system resources applied for by the head function.

[0087] Thus, when determining whether the second head function corresponding to the second head function name in the initial function name pair has the function of calling the resource release function, it can be determined whether the function name of the second head function corresponding to the second head function name in the initial function name pair calls the resource release function.

[0088] In the case where the function name of the second head function corresponding to the second head function name in the initial function name pair calls the resource release function, it can be determined that the second head function corresponding to the second head function name in the initial function name pair has the function of calling the resource release function, or, in the case where the function name of the second head function corresponding to the second head function name in the initial function name pair does not call the resource release function, it can be determined that the second head function corresponding to the second head function name in the initial function name pair does not have the function of calling the resource release function. Specifically, it can be referred to in the Figure 4 embodiment shown later, which will not be elaborated here.

[0089] In the case where the function name of the resource release function is called by the second tail function corresponding to the second tail function name in the initial function name pair, it can be determined that the second tail function corresponding to the second tail function name in the initial function name pair has the function of calling the resource release function; or, in the case where the function name of the resource release function is not called by the second tail function corresponding to the second tail function name in the initial function name pair, it can be determined that the second tail function corresponding to the second tail function name in the initial function name pair does not have the function of calling the resource release function. Specifically, reference can be made to the embodiments shown in Figure 5 as follows, which will not be elaborated here.

[0090] If the second head function has the function of calling the resource release function, and the second tail function has the function of calling the resource release function, in step S203, the target function name pair is obtained according to the initial function name pair.

[0091] For example, the initial function name pair can be directly used as the target function name pair. The second head function name in the initial function pair can be regarded as the first head function name in the target function name pair, and the second tail function name in the initial function pair can be regarded as the first tail function name in the target function name pair.

[0092] Or, if the second head function does not have the function of calling the resource release function, or the second tail function does not have the function of calling the resource release function, the target function name pair is not obtained according to the initial function name pair, that is, the initial function name pair is not the target function name pair, and the process for the initial function name pair can be ended.

[0093] In another embodiment of the present application, referring to Figure 3 , step S201 includes:

[0094] In step S301, a first correspondence relationship between the keyword about the application content and the keyword about the release content is obtained.

[0095] The first correspondence relationship can be set in advance, etc. For example, it can be the keywords that technicians have statistically used in advance within the company, within the field, or within the industry in the scenario of developing application programs when applying for content. The keywords that are usually used when applying for content can be understood as: the keywords about the application content in the function name of the caller (another function) that calls the function for the application content, etc.

[0096] Then, for any keyword about the application content that is statistically obtained, since it is used for the application content, there is often a corresponding situation of releasing content subsequently. Thus, it is also possible to statistically obtain the keywords that are usually used when releasing content. The keywords that are usually used when releasing content can be understood as: the keywords about releasing content that exist in the function name of the caller (another function) of the function corresponding to releasing content that is called when calling the function for the application content, etc. Then, form a corresponding table entry by combining the keyword about the application content with the keyword about the releasing content corresponding to the keyword about the application content, and store it in the first correspondence.

[0097] Among them, the caller of the function for the application content and the caller of the function corresponding to releasing content that is called when calling the function for the application content can be the same caller.

[0098] For each of the other keywords about the application content that is statistically obtained, perform the above operations in the same way.

[0099] In one embodiment, the first correspondence can be seen in the following table. Of course, it can be understood that the first correspondence can be updated according to actual needs subsequently, such as adding, deleting, or modifying, etc.

[0100]

[0101]

[0102] For any function name used by the application program, the process of steps S302 to S304 can be executed. For each of the other function names used by the application program, it is the same.

[0103] In step S302, for any function name used by the application program, determine whether the characters in the function name include the keywords in the first correspondence.

[0104] In this application, each keyword in the first correspondence can be matched with the characters in the function name in turn.

[0105] If a certain keyword in the first correspondence matches successfully (i.e., is the same) with the characters in the function name, it can be determined that the characters in the function name include the keywords in the first correspondence, and then step S303 can be executed.

[0106] Or, if each keyword in the first correspondence does not match successfully (i.e., is different) with the characters in the function name respectively, it can be determined that the characters in the function name do not include the keywords in the first correspondence, and then the process for the function name can be ended.

[0107] When the characters in the function name include a keyword in the first correspondence relationship, in step S303, the function names to be matched are screened from the function names used in the application. The characters in the function names to be matched include the keyword corresponding to the one keyword in the first correspondence relationship, and the characters between the function name and the function name to be matched, other than the one keyword and the keyword corresponding to the one keyword, are the same.

[0108] In this application, when the characters in the function name include a keyword in the first correspondence relationship, the keyword corresponding to the one keyword can be found in the first correspondence relationship. Then, among the other function names used in the application except for the function name, the function names whose characters include "the keyword corresponding to the one keyword" are searched. Then, it is determined whether the characters between the function name and the function name found, other than the one keyword and the keyword corresponding to the one keyword, are the same. When the characters between the function name and the function name found, other than the one keyword and the keyword corresponding to the one keyword, are the same, the function name found can be determined as the function name to be matched.

[0109] In step S304, an initial function name pair is obtained according to the function name and the function name to be matched.

[0110] For example, the function name and the function name to be matched can be combined to obtain an initialized function pair.

[0111] Among them, in one embodiment, if the characters in the function name include the keyword about the application content in the first correspondence relationship, then the function name to be matched includes the keyword about the release content in the first correspondence relationship. In this way, the function name can be the second head function name, and the function name to be matched can be the second tail function name.

[0112] Or, in another embodiment, if the characters in the function name include the keyword about the release content in the first correspondence relationship, then the function name to be matched includes the keyword about the application content in the first correspondence relationship. In this way, the function name can be the second tail function name, and the function name to be matched can be the second head function name.

[0113] In another embodiment of this application, refer to Figure 4 , the process of determining whether the second head function corresponding to the second head function name in the initial function name pair in step S202 has the function of calling a resource release function may include:

[0114] In step S401, in the application, the function name called by the second head function corresponding to the second head function name in the initial function name pair is obtained.

[0115] In this application, the source code of an application can be converted into LLVM intermediate code using the LLVM compiler, and then the call relationships between all functions inside the application can be analyzed based on the LLVM intermediate code.

[0116] In this way, by means of the call relationships between all functions inside the application, the function name of the function called by the second head function corresponding to the second head function name in the initial function name pair can be obtained.

[0117] In step S402, a first function name list is obtained. The first function name list stores the function names of multiple functions for releasing system resources.

[0118] The first function name list can be set in advance. For example, technicians can pre-statistically analyze the function names of functions for releasing system resources that are usually used in the scenario of developing applications within the company, in this field, or in this industry, and store the statistically analyzed function names of functions for releasing system resources in the first function name list for later use.

[0119] In this way, in an embodiment of this application, a pre-set first function name list can be obtained, and then step S403 can be executed.

[0120] In another embodiment of this application, sometimes when developers are developing an application, sometimes in a component or model, for a function to be implemented, multiple types of system resources need to be applied for. For example, both a section of memory and a GPU core unit need to be applied for. Then, both a memory application function and a GPU core unit application function need to be called. For this reason, for the convenience of development, sometimes developers will develop a new resource application function. The new resource application function calls the memory application function and the GPU core unit application function. That is, the memory application function and the GPU core unit application function are packaged into a new resource application function, and the new resource application function has a function name.

[0121] In addition, a new resource release function corresponding to the new resource application function will also be developed. The new resource release function calls the memory release function and the GPU core unit release function. That is, the memory release function and the GPU core unit release function are packaged into a new resource release function, and the new resource release function has a function name.

[0122] Even more, sometimes according to actual requirements, the new resource application function may be further packaged with another resource application function into yet another resource application function, and yet another resource application function has a function name. And according to actual requirements, the new resource release function may be further packaged with another resource release function into yet another resource release function, and yet another resource release function has a function name.

[0123] It can be seen that the above-mentioned new resource release function and another resource release function should also be regarded as functions for releasing system resources. Thus, the function names of the above-mentioned new resource release function and another resource release function need to be stored in the first function name list to complete the first function name list.

[0124] In view of this, after obtaining the first function name list in step S402, step S403 may not be executed first. Instead, the following processes 11) to 13) can be executed first, and then step S403 can be executed.

[0125] 11) For any function name used by the application, search for this function name in the first function name list.

[0126] If this function name is found in the second function name list, execute step 12). Or, if this function name is not found in the second function name list, end the process for this function name.

[0127] 12) If this function name is found in the second function name list, among the function names used by the application, determine the function names of the callers that directly call and indirectly call this function name (the calling function calls this function name).

[0128] Among them, by virtue of the call relationship between all functions within the application, the function name of a calling function that directly calls this function name can be determined (where the input parameters input by this calling function to the resource release function corresponding to this function name are the same as the actual input parameters obtained by the resource release function corresponding to this function name), and the function name of another calling function that directly calls this calling function can be determined (where the input parameters input by another calling function to this calling function are the same as the actual input parameters obtained by this calling function). And so on, tracing upwards until the function names of all calling functions that directly call and indirectly call this function name are found.

[0129] 13) Store the function names of the calling functions that directly call and indirectly call this function name in the first function name list.

[0130] In step S403, search for the function name called by the second head function corresponding to the second head function name in the initial function name pair in the first function name list.

[0131] In this application, each function name in the first function name list can be respectively matched with the function name called by the second head function corresponding to the second head function name in the initial function name pair.

[0132] If a function name in the first function name list successfully matches the function name of the second head function call corresponding to the second head function name in the initial function name pair (for example, they are the same), it indicates that the function name of the second head function call corresponding to the second head function name in the initial function name pair is found in the first function name list, and then step S404 can be executed.

[0133] Alternatively, if each function name in the first function name list does not successfully match the function name of the second head function call corresponding to the second head function name in the initial function name pair (for example, they are different), it indicates that the function name of the second head function call corresponding to the second head function name in the initial function name pair is not found in the first function name list, and then step S405 can be executed.

[0134] In the case where the function name of the second head function call corresponding to the second head function name in the initial function name pair is found in the first function name list, in step S404, it is determined that the second head function corresponding to the second head function name in the initial function name pair has the function of calling a resource release function.

[0135] In the case where the function name of the second head function call corresponding to the second head function name in the initial function name pair is not found in the first function name list, in step S405, it is determined that the second head function corresponding to the second head function name in the initial function name pair does not have the function of calling a resource release function.

[0136] In another embodiment of the present application, referring to Figure 5 , the process of determining whether the second tail function corresponding to the second tail function name in the initial function name pair has the function of calling a resource release function in step S202 may include:

[0137] In step S501, in the application program, obtain the function name of the second tail function call corresponding to the second tail function name in the initial function name pair.

[0138] In the present application, the source code of the application program can be converted into LLVM intermediate code by using the LLVM compiler, and then the call relationship between all functions inside the application program can be analyzed according to the LLVM intermediate code.

[0139] In this way, by virtue of the call relationship between all functions inside the application program, the function name of the function called by the second tail function corresponding to the second tail function name in the initial function name pair can be obtained.

[0140] In step S502, obtain the first function name list, which stores the function names of multiple functions for releasing system resources.

[0141] The first function name list can be set in advance. For example, it can be the function names of functions for releasing system resources that technicians have previously counted within the company, within the field, or within the industry in the scenario of developing application programs. The counted function names of functions for releasing system resources are stored in the first function name list for later use.

[0142] Thus, in an embodiment of the present application, the first function name list set in advance can be obtained, and then step S503 can be executed.

[0143] In another embodiment of the present application, sometimes when developers are developing application programs, sometimes in a component or model, multiple types of system resources need to be applied for a function to be implemented. For example, both a section of memory and a GPU core unit need to be applied for. Then, both the memory application function and the GPU core unit application function need to be called. For this reason, for the convenience of development, sometimes developers will develop a new resource application function. The new resource application function calls the memory application function and the GPU core unit application function. That is, the memory application function and the GPU core unit application function are packaged into a new resource application function, and the new resource application function has a function name.

[0144] In addition, a new resource release function corresponding to the new resource application function will also be developed. The new resource release function calls the memory release function and the GPU core unit release function. That is, the memory release function and the GPU core unit release function are packaged into a new resource release function, and the new resource release function has a function name.

[0145] Even more, sometimes according to actual needs, the new resource application function may be packaged with another resource application function into yet another resource application function, and yet another resource application function has a function name. And according to actual needs, the new resource release function may also be packaged with another resource release function into yet another resource release function, and yet another resource release function has a function name.

[0146] It can be seen that the new resource release functions and yet another resource release functions mentioned above should also be regarded as functions for releasing system resources. Thus, the function names of the new resource release functions and yet another resource release functions mentioned above need to be stored in the first function name list to complete the first function name list.

[0147] In view of this, after obtaining the first function name list in step S502, step S503 may not be executed first. Instead, the following processes 21) - 23) can be executed first, and then step S503 can be executed.

[0148] 21) For any function name used by the application, search for the function name in the first function name list.

[0149] If the function name is found in the second function name list, execute step 12). Or, if the function name is not found in the second function name list, end the process for this function name.

[0150] 22) If the function name is found in the second function name list, among the function names used by the application, determine the function names of the calling functions that directly call and indirectly call this function name (the calling function calls this function name).

[0151] Among them, by virtue of the call relationships between all functions within the application, the function name of a calling function that directly calls this function name can be determined (where the input parameters that the calling function inputs to the resource release function corresponding to this function name are the same as the input parameters actually obtained by the resource release function corresponding to this function name), and the function name of another calling function that directly calls this calling function can be determined (where the input parameters that the other calling function inputs to this calling function are the same as the input parameters actually obtained by this calling function), and so on, tracing upwards until the function names of all calling functions that directly call and indirectly call this function name are found.

[0152] 23) Store the function names of the calling functions that directly call and indirectly call this function name in the first function name list.

[0153] In step S503, search for the function name called by the second tail function corresponding to the second tail function name in the initial function name pair in the first function name list.

[0154] In this application, each function name in the first function name list can be respectively matched with the function name called by the second head function corresponding to the second head function name in the initial function name pair.

[0155] If a certain function name in the first function name list successfully matches the function name called by the second head function corresponding to the second head function name in the initial function name pair (for example, the two are the same), it means that the function name called by the second head function corresponding to the second head function name in the initial function name pair is found in the first function name list, and then step S404 can be executed.

[0156] Or, if each function name in the first function name list does not successfully match the function name called by the second head function corresponding to the second head function name in the initial function name pair (for example, the two are different), it means that the function name called by the second head function corresponding to the second head function name in the initial function name pair is not found in the first function name list, and then step S405 can be executed.

[0157] When the function name of the second tail function call corresponding to the second tail function name in the initial function name pair is found in the first function name list, in step S504, it is determined that the second tail function corresponding to the second tail function name in the initial function name pair has the function of calling the resource release function.

[0158] When the function name of the second tail function call corresponding to the second tail function name in the initial function name pair is not found in the first function name list, in step S505, it is determined that the second tail function corresponding to the second tail function name in the initial function name pair does not have the function of calling the resource release function.

[0159] In another embodiment of the present application, refer to Figure 6 , step S102 includes:

[0160] In step S601, in the application program, index the first head function corresponding to the first head function name and the first tail function corresponding to the first tail function name. Among them, when the first head function is called, the first head function calls the resource application function to apply for multiple system resources, and, when not all of the multiple system resources are successfully applied for, the first head function calls the resource release function, and, the first tail function is called.

[0161] Refer to the explanation of step S101. In the present application, in the first embodiment, when not all of the multiple system resources are successfully applied for after calling the head function corresponding to the first head function name, or, when all of the multiple system resources are successfully applied for after calling the head function corresponding to the first head function name, but other errors occur during the execution of the application program afterwards, the head function corresponding to the first head function name often calls the resource release function to release the applied system resources. In addition, if the tail function corresponding to the first tail function name is not called afterwards, the tail function corresponding to the first tail function name will not call the resource release function to try to release the applied system resources. It can be seen that in this case, there is generally no double release vulnerability.

[0162] However, in the second embodiment, in the case where not all of the system resources among multiple system resources are successfully applied for after calling the header function corresponding to the first header function name, or in the case where all of the system resources among multiple system resources are successfully applied for after calling the header function corresponding to the first header function name, but other errors occur during the execution of the application program, the header function corresponding to the first header function name often calls the resource release function to release the applied system resources. In addition, subsequently, the tail function corresponding to the first tail function name will be called, and the tail function corresponding to the first tail function name may successfully call the resource release function to release the applied system resources. It can be seen that in this case, there may be a double-free vulnerability. For example, in the case where the tail function corresponding to the first tail function name calls the resource release function to release the applied system resources, there will be a double-free vulnerability.

[0163] Thus, in this application, after obtaining the target function name pairs, the target function name pairs involved in the first embodiment can be excluded from each target function name pair, and only the target function name pairs involved in the second embodiment can be indexed. For example, among the header function and the tail function corresponding to the first header function name and the first tail function name in each target function name pair respectively in the application program, the header function and the tail function involved in the first embodiment can be excluded, and only the header function and the tail function involved in the second embodiment can be indexed. That is, the header function corresponding to the first header function name in the target function name pairs involved in the second embodiment and the tail function corresponding to the first tail function name in the application program are indexed.

[0164] Among them, in the application program, the indexing method for indexing the first header function corresponding to the first header function name and the first tail function corresponding to the first tail function name can be referred to the Figure 7 embodiment shown later, and will not be elaborated here.

[0165] Among them, the first header function corresponding to the first header function name indexed in this step is part or all of the first header functions corresponding to the first header function name in the application program. The first tail function corresponding to the first tail function name indexed in this step is part or all of the first tail functions corresponding to the first tail function name in the application program.

[0166] In step S602, it is detected whether there is a double-free vulnerability in the first header function corresponding to the first header function name indexed and the first tail function corresponding to the first tail function name.

[0167] This step can be implemented through the following process, including:

[0168] 6021. Determine whether the first tail function can successfully call the resource release function after the first tail function is called.

[0169] In the second embodiment described in step S601, when not all of the system resources among the multiple system resources are successfully applied for after calling the first header function corresponding to the first header function name, or, when all of the system resources among the multiple system resources are successfully applied for after calling the header function corresponding to the first header function name, but other errors occur during the execution of the application program afterwards, the first header function corresponding to the first header function name often calls the resource release function to release the applied system resources, and subsequently the first tail function corresponding to the first tail function name is called. When the first tail function corresponding to the first tail function name is called, the first tail function corresponding to the first tail function name attempts to execute the processing logic in the first tail function corresponding to the first tail function name. Since there may be conditional constraints in the processing logic, there may be two situations at this time. The first tail function corresponding to the first tail function name can successfully call the resource release function to release the applied system resources, or, the first tail function corresponding to the first tail function name cannot successfully call the resource release function and thus cannot release the applied system resources.

[0170] When the first tail function corresponding to the first tail function name can successfully call the resource release function to release the applied system resources, the first header function corresponding to the first header function name and the first tail function corresponding to the first tail function name will respectively perform resource release operations on the same applied system resource successively, which will lead to a double release vulnerability. Or, when the first tail function corresponding to the first tail function name cannot successfully call the resource release function and thus cannot release the applied system resources, the first header function corresponding to the first header function name will perform a resource release operation on the applied system resource, and the first tail function corresponding to the first tail function name will not perform a resource release operation on the applied system resource, so a double release vulnerability will not be caused.

[0171] Therefore, after step S601, it is necessary to determine whether the first tail function can successfully call the resource release function after the first tail function is called. When the first tail function cannot successfully call the resource release function after the first tail function is called, step 6022 is executed. Or, when the first tail function can successfully call the resource release function after the first tail function is called, step 6023 is executed.

[0172] In one embodiment, the first path constraint (conditional statements and assignment statements) between the function name of the resource release function in the first header function and the return point of the first header function can be collected.

[0173] The second path constraint (judgment conditions in conditional statements and assignment statements) between the first statement in the first tail function and the function name of the resource release function can be collected.

[0174] Then, the first path constraint and the second path constraint are merged to obtain the merged content.

[0175] After that, the symbolic execution solver Z3 is used to process the merged content to determine whether there is a solution for all path constraints in the merged content. If there is a solution for all path constraints in the merged content, it means that after the first tail function is called, the first tail function can successfully call the resource release function. Or, if there is no solution for the path constraints in the merged content, it means that after the first tail function is called, the first tail function cannot successfully call the resource release function.

[0176] For example, in the first head function, conditions are set through assignment statements, and in the first tail function, conditions are checked through conditional statements. Having a solution means that the conditions set by the first head function pass the check of the first tail function, and the first tail function can successfully call the resource release function. Having no solution means that the conditions set by the first head function do not pass the check of the first tail function, and the first tail function cannot successfully call the resource release function.

[0177] For example, in the case where the first tail function corresponding to the first tail function name can successfully call the resource release function to release the system resources that have been applied for, the first head function sets a global variable to 0, indicating that the system resources that have been applied for have been released, and then returns an error. After the common caller of the first head function and the first tail function gets the error returned by the first head function, it calls the first tail function. The first tail function will determine whether this global variable is 0. If it is 0, the release process will be skipped, that is, the second tail function will not follow the program execution path of "calling the resource release function".

[0178] 6022. In the case where the first tail function cannot successfully call the resource release function after the first tail function is called, it is determined that there is no double-free vulnerability between the first head function and the first tail function.

[0179] 6023. In the case where the first tail function can successfully call the resource release function after the first tail function is called, it is determined that there is a double-free vulnerability between the first head function and the first tail function.

[0180] Furthermore, a prompt message can be output to inform the technician that there is a double-free vulnerability between the first head function and the first tail function, so that the technician can update the first head function and the first tail function in a timely manner to eliminate the double-free vulnerability.

[0181] In another embodiment of the present application, referring to Figure 7 , step S601 includes;

[0182] In step S701, in the application program, the candidate head function corresponding to the first head function name and the candidate tail function corresponding to the first tail function name are indexed.

[0183] In step S702, obtain the first logical control flow of the candidate head function corresponding to the first head function name and the second logical control flow of the candidate tail function corresponding to the first tail function name.

[0184] In an embodiment of the present application, since there are many functions in the application program, it may be necessary to apply for system resources when implementing each function and release the system resources after the function is completed. Thus, in the application program, the head function corresponding to the same head function name may appear many times at different positions in the application program for corresponding to different functions. Correspondingly, the tail function corresponding to the same tail function name may appear many times at different positions in the application program for corresponding to different functions.

[0185] Thus, in a possible embodiment, there are multiple candidate head functions corresponding to the first head function name indexed in the application program, and multiple candidate tail functions corresponding to the first tail function name; that is, multiple candidate head functions are all head functions used by the application program, and the function names of multiple candidate head functions are the same, and multiple candidate tail functions are all tail functions used by the application program, and the function names of multiple candidate tail functions are the same.

[0186] A head function and a tail function are used in a supporting manner. Among a head function and a tail function used in a supporting manner, the caller who calls the head function and the caller who calls the tail function are the same caller.

[0187] Thus, when obtaining the first logical control flow of the candidate head function corresponding to the first head function name and the second logical control flow of the candidate tail function corresponding to the first tail function name, it is necessary to obtain the logical control flow for the supporting head function and tail function. For example, in the face of multiple candidate head functions and multiple candidate tail functions, this step can be executed in multiple rounds. Each round is for a supporting candidate head function and a candidate tail function, that is, what is obtained in each round is the first logical control flow of the supporting candidate head function and the second logical control flow of the candidate tail function.

[0188] Thus, in an embodiment, this step can be implemented through the following process, including:

[0189] 7021. In the application program, obtain the input parameters input to each candidate head function corresponding to the first head function name, obtain the input parameters input to each candidate tail function corresponding to the first tail function name, obtain the function names of the resource release functions called by each candidate head function corresponding to the first head function name respectively, and obtain the function names of the resource release functions called by each candidate tail function corresponding to the first tail function name respectively.

[0190] Among them, the input parameters of the candidate head function are input by the caller of the candidate head function to the candidate head function. For example, they are input by the caller of the candidate head function to the candidate head function when the caller calls the candidate head function through the function name of the candidate head function, etc.

[0191] In addition, the input parameters of the candidate tail function are input by the caller of the candidate tail function to the candidate tail function. For example, they are input by the caller of the candidate tail function to the candidate tail function when the caller calls the candidate tail function through the function name of the candidate tail function, etc.

[0192] Among them, the function name of the resource release function called by the candidate head function is located inside the candidate head function. In this way, the function name of the resource release function called by the head function can be directly obtained from inside the resource release function called by the head function.

[0193] In addition, the function name of the resource release function called by the candidate tail function is located inside the candidate tail function. In this way, the function name of the resource release function called by the tail function can be directly obtained from inside the resource release function called by the tail function.

[0194] 7022. Among the candidate head functions corresponding to the first head function names and the candidate tail functions corresponding to the first tail function names, determine the candidate head function and the candidate tail function whose input input parameters are the same and the function names of the called resource release functions are the same.

[0195] In this application, if a head function and a tail function are used in a supporting manner, then in the application program, the caller who calls the head function and the caller who calls the tail function are the same caller, and the input parameters input by the caller to the head function are the same as the input parameters input by the caller to the tail function.

[0196] In this way, among the candidate head functions corresponding to the first head function names and the candidate tail functions corresponding to the first tail function names, the candidate head function and the candidate tail function with the same input input parameters and the same function names of the called resource release functions can be used in a supporting manner.

[0197] In this way, when obtaining the logical control flow, the respective logical control flows of the candidate head function and the candidate tail function with the same input input parameters and the same function names of the called resource release functions can be obtained.

[0198] 7023. Obtain the first logical control flow of the determined candidate head function, and obtain the second logical control flow of the determined candidate tail function.

[0199] In step S703, if the first logical control flow and the second logical control flow are used to indicate that when the candidate head function corresponding to the first head function name fails to successfully apply for all of the multiple system resources, the candidate head function corresponding to the first head function name calls the resource release function, and the candidate tail function corresponding to the first tail function name is called, then the candidate head function corresponding to the first head function name is determined as the first head function, and the candidate tail function corresponding to the first tail function name is determined as the first tail function.

[0200] Among them, the first head function can successfully call the resource release function, and the first tail function will be called by the caller of the first tail function. However, the first tail function may or may not be able to successfully call the resource release function.

[0201] It should be noted that for the method embodiments, for the sake of simple description, they are all expressed as a series of action combinations. However, those skilled in the art should know that this application is not limited by the described action sequence, because according to this application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all optional embodiments, and the actions involved are not necessarily required by this application.

[0202] Refer to Figure 8 , which shows a structural block diagram of a vulnerability detection device of this application. The device includes:

[0203] An acquisition module 11, configured to acquire a target function name pair, where the target function name pair includes a first head function name and a first tail function name used by an application. The head function corresponding to the first head function name has the function of calling a resource application function and the function of calling a resource release function. The tail function corresponding to the first tail function name has the function of calling a resource release function. The resource application function is used to apply for system resources, and the resource release function is used to release the system resources that have been applied for through the resource application function;

[0204] A detection module 12, configured to detect whether there is a double release vulnerability in the first head function corresponding to the first head function name and the first tail function corresponding to the first tail function name in the application.

[0205] In an optional implementation manner, the detection module includes:

[0206] An indexing sub-module, which is used to index the first head function corresponding to the first head function name and the first tail function corresponding to the first tail function name in an application program. Wherein, when the first head function is called, the first head function calls a resource application function to apply for multiple system resources, and when not all of the multiple system resources are successfully applied for, the first head function calls a resource release function, and the first tail function is called;

[0207] A detection sub-module, which is used to detect whether there is a double release vulnerability in the first head function corresponding to the indexed first head function name and the first tail function corresponding to the first tail function name.

[0208] In an optional implementation manner, the detection sub-module includes;

[0209] A first determination unit, which is used to determine whether the first tail function can successfully call the resource release function after the first tail function is called;

[0210] A second determination unit, which is used to determine that there is a double release vulnerability in the first head function and the first tail function when the first tail function can successfully call the resource release function after the first tail function is called;

[0211] Or,

[0212] A third determination unit, which is used to determine that there is no double release vulnerability in the first head function and the first tail function when the first tail function cannot successfully call the resource release function after the first tail function is called.

[0213] In an optional implementation manner, the indexing sub-module includes:

[0214] An indexing unit, which is used to index a candidate head function corresponding to the first head function name and a candidate tail function corresponding to the first tail function name in an application program;

[0215] A first acquisition unit, which is used to acquire a first logical control flow of a candidate head function corresponding to the first head function name and a second logical control flow of a candidate tail function corresponding to the first tail function name;

[0216] A first determination unit, which is used to determine the candidate head function corresponding to the first head function name as the first head function and the candidate tail function corresponding to the first tail function name as the first tail function if the first logical control flow and the second logical control flow are used to indicate that when the candidate head function corresponding to the first head function name fails to apply for all of the multiple system resources, the candidate head function corresponding to the first head function name calls the resource release function, and the candidate tail function corresponding to the first tail function name is called.

[0217] In an alternative implementation, there are multiple candidate head functions corresponding to the first head function name, and multiple candidate tail functions corresponding to the first tail function name;

[0218] The first obtaining unit includes:

[0219] A first obtaining subunit, configured to obtain, in an application program, input parameters input to each candidate head function corresponding to the first head function name respectively, obtain input parameters input to each candidate tail function corresponding to the first tail function name respectively, obtain function names of resource release functions called by each candidate head function corresponding to the first head function name respectively, and obtain function names of resource release functions called by each candidate tail function corresponding to the first tail function name respectively;

[0220] A first determining subunit, configured to determine, among each candidate head function corresponding to the first head function name and each candidate tail function corresponding to the first tail function name, candidate head functions and candidate tail functions with the same input input parameters and the same function names of the called resource release functions;

[0221] A second obtaining subunit, configured to obtain a first logical control flow of the determined candidate head function and, obtain a second logical control flow of the determined candidate tail function.

[0222] In an alternative implementation, the obtaining module includes:

[0223] A second obtaining unit, configured to obtain an initial function name pair, where the initial function name pair includes a second head function name and a second tail function name used in an application program, and the head function corresponding to the second head function name is at least used for applying for content, and the tail function corresponding to the second tail function name is used to release the content applied for by the head function corresponding to the second head function name;

[0224] A second determining unit, configured to determine, for any initial function name pair, whether the second head function corresponding to the second head function name in the initial function name pair has the function of calling a resource release function in the application program, and a third determining unit, configured to determine, in the application program, whether the second tail function corresponding to the second tail function name in the initial function name pair has the function of calling a resource release function;

[0225] A third obtaining unit, configured to, if the second head function has the function of calling a resource release function and the second tail function has the function of calling a resource release function, obtain a target function name pair according to the initial function name pair.

[0226] In an alternative implementation, the second obtaining unit includes:

[0227] A third acquisition subunit, configured to acquire a first correspondence relationship between keywords regarding the application content and keywords regarding the release content;

[0228] A second determination subunit, configured to determine, for any function name used by the application, whether the characters in the function name include keywords in the first correspondence relationship;

[0229] A screening subunit, configured to, in a case where the characters in the function name include a keyword in the first correspondence relationship, screen, from the function names used by the application, function names to be matched, where the characters in the function names to be matched include keywords corresponding to the one keyword in the first correspondence relationship, and the characters between the function name and the function names to be matched, other than the one keyword and the keywords corresponding to the one keyword, are the same;

[0230] A fourth acquisition subunit, configured to acquire an initial function name pair according to the function name and the function names to be matched.

[0231] In an optional implementation manner, the second determination unit includes:

[0232] A fifth acquisition subunit, configured to, in the application, acquire the function name called by the second head function corresponding to the second head function name in the initial function name pair;

[0233] A sixth acquisition subunit, configured to acquire a first function name list, where the first function name list stores function names of multiple functions for releasing system resources;

[0234] A first search subunit, configured to search, in the first function name list, for the function name called by the second head function corresponding to the second head function name in the initial function name pair;

[0235] A third determination subunit, configured to, in a case where the function name called by the second head function corresponding to the second head function name in the initial function name pair is found in the first function name list, determine that the second head function corresponding to the second head function name in the initial function name pair has the function of calling a resource release function.

[0236] In an optional implementation manner, the third determination unit includes:

[0237] A seventh acquisition subunit, configured to, in the application, acquire the function name called by the second tail function corresponding to the second tail function name in the initial function name pair;

[0238] An eighth acquisition subunit, configured to acquire a first function name list, where the first function name list stores function names of multiple functions for releasing system resources;

[0239] The second search sub-unit is used to search the first function name list for the function name of the second last function call corresponding to the second last function name in the initial function name pair;

[0240] The fourth determination sub-unit is used to determine that the second tail function corresponding to the second tail function name in the initial function name pair has the function of calling the resource release function when the function name called by the second tail function corresponding to the second tail function name in the initial function name pair is found in the first function name list.

[0241] In an optional implementation, the second determining unit / the third determining unit further includes:

[0242] A third search subunit is configured to search the first function name list for any function name used by the application;

[0243] a fifth determining subunit, configured to, when the function name is found in the second function name list, determine, from the function names used by the application, function names of calling functions that directly call and indirectly call the function name;

[0244] The storage subunit is used to store the function name of the calling function in the first function name list.

[0245] In this application, a target function name pair is obtained. The target function name pair includes the first header function name and the first tail function name used by the application. The header function corresponding to the first header function name has the function of calling the resource application function and the function of calling the resource release function. The tail function corresponding to the first tail function name has the function of calling the resource release function. The resource application function is used to apply for system resources, and the resource release function is used to release the system resources applied for by the resource application function. The first header function corresponding to the first header function name and the first tail function corresponding to the first tail function name in the application are detected to determine whether there is a double release vulnerability.

[0246] Through the present application, when detecting whether there is a redundant operation vulnerability in an application, for example, when detecting whether there is a double release vulnerability in an application, the paired head function and tail function can be determined in the application, and each pair of paired head function and tail function can be detected separately, for example, detecting whether there is a redundant operation vulnerability in the paired head function and tail function, for example, detecting whether there is a double release vulnerability in the paired head function and tail function, etc., thereby narrowing the detection scope of each detection, that is, narrowing the detection scope of each detection to the two functions of the paired head function and tail function, so that the path explosion problem can be avoided as much as possible, so as to improve the detection efficiency as much as possible and reduce the system resources consumed in the detection process.

[0247] Embodiments of the present application also provide a non-volatile readable storage medium, in which one or more modules (programs) are stored. When the one or more modules are applied to a device, the device can be caused to execute instructions for each method step in the embodiments of the present application.

[0248] Embodiments of the present application provide one or more machine-readable media, on which instructions are stored. When executed by one or more processors, the electronic device is caused to execute the method in one or more of the above embodiments. In the embodiments of the present application, the electronic device includes a server, a gateway, a sub-device, etc., and the sub-device is a device such as an Internet of Things device.

[0249] Embodiments of the present disclosure can be implemented as a device configured with any suitable hardware, firmware, software, or any combination thereof. The device may include a server (cluster), a terminal device such as an IoT device and other electronic devices.

[0250] Figure 9 Exemplary device 1300 that can be used to implement the various embodiments in the present application is schematically shown.

[0251] For one embodiment, Figure 9 Exemplary device 1300 is shown, which has one or more processors 1302, a control module (chipset) 1304 coupled to at least one of the one or more processors 1302, a memory 1306 coupled to the control module 1304, a non-volatile memory (NVM) / storage device 1308 coupled to the control module 1304, one or more input / output devices 1310 coupled to the control module 1304, and a network interface 1312 coupled to the control module 1304.

[0252] Processor 1302 may include one or more single-core or multi-core processors. Processor 1302 may include any combination of a general-purpose processor or a dedicated processor (such as a graphics processor, an application processor, a baseband processor, etc.). In some embodiments, device 1300 can function as a server device such as a gateway in the embodiments of the present application.

[0253] In some embodiments, device 1300 may include one or more computer-readable media (e.g., memory 1306 or NVM / storage device 1308) having instructions 1314 and one or more processors 1302 combined with the one or more computer-readable media and configured to execute the instructions 1314 to implement modules and thus perform the actions in the present disclosure.

[0254] For one embodiment, the control module 1304 may include any suitable interface controller to provide any suitable interface to at least one of the processor(s) 1302 and / or any suitable device or component that communicates with the control module 1304.

[0255] The control module 1304 may include a memory controller module to provide an interface to the memory 1306. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0256] The memory 1306 may be used to load and store data and / or instructions 1314 for the device 1300, for example. For one embodiment, the memory 1306 may include any suitable volatile memory, such as suitable DRAM. In some embodiments, the memory 1306 may include double data rate four synchronous dynamic random access memory (DDR4 SDRAM).

[0257] For one embodiment, the control module 1304 may include one or more input / output controllers to provide an interface to the NVM / storage device 1308 and the input / output device(s) 1310.

[0258] For example, the NVM / storage device 1308 may be used to store data and / or instructions 1314. The NVM / storage device 1308 may include any suitable non-volatile memory (such as flash memory) and / or may include any suitable non-volatile storage device(s) (such as one or more hard disk drives (HDDs), one or more compact discs (CDs) drives, and / or one or more digital versatile discs (DVDs) drives).

[0259] The NVM / storage device 1308 may include storage resources that are physically part of the device on which the device 1300 is mounted, or it may be accessible by the device without being part of the device. For example, the NVM / storage device 1308 may be accessed via the input / output device(s) 1310 over a network.

[0260] The input / output device(s) 1310 may provide an interface for the device 1300 to communicate with any other suitable device. The input / output device 1310 may include communication components, audio components, sensor components, etc. The network interface 1312 may provide an interface for the device 1300 to communicate over one or more networks. The device 1300 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, such as accessing a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G, 5G, etc., or a combination thereof for wireless communication.

[0261] For one embodiment, at least one of the (one or more) processors 1302 may be logically encapsulated with one or more controllers of the control module 1304 (e.g., a memory controller module). For one embodiment, at least one of the (one or more) processors 1302 may be logically encapsulated with one or more controllers of the control module 1304 to form a system-in-package (SiP). For one embodiment, at least one of the (one or more) processors 1302 may be logically integrated with one or more controllers of the control module 1304 on the same die. For one embodiment, at least one of the (one or more) processors 1302 may be logically integrated with one or more controllers of the control module 1304 on the same die to form a system-on-chip (SoC).

[0262] In various embodiments, the device 1300 can be, but is not limited to, a server, a desktop computing device, or a mobile computing device (e.g., a laptop computing device, a handheld computing device, a tablet computer, a netbook, etc.) and other terminal devices. In various embodiments, the device 1300 may have more or fewer components and / or a different architecture. For example, in some embodiments, the device 1300 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touch screen display), a non-volatile memory port, multiple antennas, a graphics chip, an application specific integrated circuit (ASIC), and a speaker.

[0263] An embodiment of the present application provides an electronic device, including: one or more processors; and one or more machine-readable media storing instructions thereon, which, when executed by the one or more processors, cause the electronic device to perform the methods as described in one or more of the present application.

[0264] For the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple. For the related parts, refer to the partial description of the method embodiments.

[0265] Each embodiment in this specification is described in a progressive manner. The key point of each embodiment is to illustrate the differences from other embodiments. For the same or similar parts among the embodiments, refer to each other.

[0266] Embodiments of the present application are described with reference to the flowcharts and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, and the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable information processing terminal devices to generate a machine, such that the instructions executed by the processor of the computer or other programmable information processing terminal devices generate means for implementing the functions specified in one process Figure 1 one process or multiple processes and / or blocks Figure 1 or means for implementing the functions specified in multiple blocks.

[0267] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable information processing terminal device to work in a specific manner, such that the instructions stored in the computer-readable memory generate a manufactured article including instruction means that implement the functions specified in one process Figure 1 one process or multiple processes and / or blocks Figure 1 or means for implementing the functions specified in multiple blocks.

[0268] These computer program instructions can also be loaded onto a computer or other programmable information processing terminal device, such that a series of operation steps are executed on the computer or other programmable terminal device to generate a computer-implemented process, so that the instructions executed on the computer or other programmable terminal device provide steps for implementing the functions specified in one process Figure 1 one process or multiple processes and / or blocks Figure 1 or means for implementing the functions specified in multiple blocks.

[0269] Although the preferred embodiments of the embodiments of the present application have been described, those skilled in the art can make additional changes and modifications to these embodiments once they learn the basic creative concepts. Therefore, the appended claims are intended to be construed to include the preferred embodiments and all changes and modifications falling within the scope of the embodiments of the present application.

[0270] Finally, it should also be noted that in this text, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or terminal device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or further includes elements inherent to such process, method, article or terminal device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, article or terminal device comprising the element.

[0271] The above has introduced in detail the vulnerability detection method and device provided by this application. Specific examples are used in this text to elaborate on the principle and implementation manner of this application. The description of the above embodiments is only used to help understand the method and its core idea of this application; at the same time, for those of ordinary skill in the art, according to the idea of this application, there will be changes in the specific implementation manner and application scope. In summary, the content of this specification should not be construed as a limitation to this application.

Claims

1. A vulnerability detection method, characterized in that, The method includes: Obtaining a pair of target function names, where the pair of target function names includes a first head function name and a first tail function name used by an application. The head function corresponding to the first head function name has the function of calling a resource application function and the function of calling a resource release function. The tail function corresponding to the first tail function name has the function of calling a resource release function. The resource application function is used to apply for system resources, and the resource release function is used to release the system resources that have been applied for through the resource application function; Detecting whether there is a double-free vulnerability in the first head function corresponding to the first head function name and the first tail function corresponding to the first tail function name in the application.

2. The method according to claim 1, characterized in that, The detecting whether there is a double-free vulnerability in the first head function corresponding to the first head function name and the first tail function corresponding to the first tail function name in the application includes: In the application, indexing the first head function corresponding to the first head function name and the first tail function corresponding to the first tail function name. Wherein, when the first head function is called, the first head function calls a resource application function to apply for multiple system resources. And, when not all of the multiple system resources are successfully applied for, the first head function calls a resource release function, and the first tail function is called; Detecting whether there is a double-free vulnerability in the indexed first head function corresponding to the first head function name and the first tail function corresponding to the first tail function name.

3. The method according to claim 2, characterized in that, The detecting whether there is a double-free vulnerability in the indexed first head function corresponding to the first head function name and the first tail function corresponding to the first tail function name includes; Determining whether the first tail function can successfully call the resource release function after the first tail function is called; When the first tail function can successfully call the resource release function after the first tail function is called, determining that there is a double-free vulnerability in the first head function and the first tail function; Or, When the first tail function cannot successfully call the resource release function after the first tail function is called, determining that there is no double-free vulnerability in the first head function and the first tail function.

4. The method according to claim 2, characterized in that, The indexing the first head function corresponding to the first head function name and the first tail function corresponding to the first tail function name in the application includes: In the application, indexing a candidate head function corresponding to the first head function name and a candidate tail function corresponding to the first tail function name; Obtaining a first logical control flow of the candidate head function corresponding to the first head function name and a second logical control flow of the candidate tail function corresponding to the first tail function name; If the first logical control flow and the second logical control flow indicate that when the candidate head function corresponding to the first head function name fails to apply for all of the multiple system resources, the candidate head function corresponding to the first head function name calls a resource release function, and the candidate tail function corresponding to the first tail function name is called, then determining the candidate head function corresponding to the first head function name as the first head function, and determining the candidate tail function corresponding to the first tail function name as the first tail function.

5. The method according to claim 4, characterized in that, There are multiple candidate head functions corresponding to the first head function name, and multiple candidate tail functions corresponding to the first tail function name; The obtaining of the first logical control flow of the candidate head function corresponding to the first head function name and the second logical control flow of the candidate tail function corresponding to the first tail function name includes: In the application program, obtain the input parameters input to each candidate head function corresponding to the first head function name, obtain the input parameters input to each candidate tail function corresponding to the first tail function name, obtain the function names of the resource release functions called by each candidate head function corresponding to the first head function name respectively, and obtain the function names of the resource release functions called by each candidate tail function corresponding to the first tail function name respectively; Among each candidate head function corresponding to the first head function name and each candidate tail function corresponding to the first tail function name, determine the candidate head function and the candidate tail function with the same input parameters and the same function names of the called resource release functions; Obtain the first logical control flow of the determined candidate head function, and obtain the second logical control flow of the determined candidate tail function.

6. The method according to claim 1, wherein The obtaining of the target function name pair includes: Obtain the initial function name pair, where the initial function name pair includes the second head function name and the second tail function name used in the application program. The head function corresponding to the second head function name is at least used for applying for content, and the tail function corresponding to the second tail function name is used to release the content applied for by the head function corresponding to the second head function name; For any initial function name pair, in the application program, determine whether the second head function corresponding to the second head function name in the initial function name pair has the function of calling a resource release function, and determine whether the second tail function corresponding to the second tail function name in the initial function name pair has the function of calling a resource release function; If the second head function has the function of calling a resource release function and the second tail function has the function of calling a resource release function, obtain the target function name pair according to the initial function name pair.

7. The method according to claim 6, wherein The obtaining of the initial function name pair includes: Obtain the first correspondence between the keyword for applying for content and the keyword for releasing content; For any function name used in the application program, determine whether the characters in the function name include the keywords in the first correspondence; In the case where the characters in the function name include one of the keywords in the first correspondence, screen the function names to be matched in the function names used in the application program. The characters in the function names to be matched include the keywords corresponding to the one keyword in the first correspondence, and the characters between the function name and the function name to be matched, except for the one keyword and the keyword corresponding to the one keyword, are the same; Obtain the initial function name pair according to the function name and the function name to be matched.

8. The method according to claim 6, wherein In the application program, determining whether the second head function corresponding to the second head function name in the initial function name pair has the function of calling a resource release function includes: In the application program, obtain the function name called by the second head function corresponding to the second head function name in the initial function name pair; Obtain the first function name list, and the first function name list stores the function names of multiple functions for releasing system resources; Search for the function name of the second head function call corresponding to the second head function name in the initial function name pair in the first function name list; When the function name of the second head function call corresponding to the second head function name in the initial function name pair is found in the first function name list, determine that the second head function corresponding to the second head function name in the initial function name pair has the function of calling the resource release function.

9. The method according to claim 6, wherein In the application, determine whether the second tail function corresponding to the second tail function name in the initial function name pair has the function of calling the resource release function, including: In the application, obtain the function name of the second tail function call corresponding to the second tail function name in the initial function name pair; Obtain a first function name list, which stores the function names of multiple functions for releasing system resources; Search for the function name of the second tail function call corresponding to the second tail function name in the initial function name pair in the first function name list; When the function name of the second tail function call corresponding to the second tail function name in the initial function name pair is found in the first function name list, determine that the second tail function corresponding to the second tail function name in the initial function name pair has the function of calling the resource release function.

10. The method according to claim 8 or 9, characterized in that After obtaining the first function name list, it further includes: For any function name used by the application, search for the function name in the first function name list; When the function name is found in the second function name list, determine the function names of the calling functions that directly call and indirectly call the function name among the function names used by the application; Store the function names of the calling functions in the first function name list.

11. A vulnerability detection device, characterized in that, The device includes: An acquisition module, configured to acquire a target function name pair, where the target function name pair includes a first head function name and a first tail function name used by the application. The head function corresponding to the first head function name has the function of calling a resource application function and the function of calling a resource release function, and the tail function corresponding to the first tail function name has the function of calling a resource release function. The resource application function is used to apply for system resources, and the resource release function is used to release the system resources that have been applied for through the resource application function; A detection module, configured to detect whether there is a double release vulnerability in the first head function corresponding to the first head function name and the first tail function corresponding to the first tail function name in the application.

12. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method according to any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that, A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it implements the method according to any one of claims 1 to 10.

14. A computer program product, characterized in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device is enabled to execute the method according to any one of claims 1 to 10.

Images