C language memory security detection method based on source code instrumentation

Abstract

The invention provides a source code instrumentation-based C language memory security detection method. The method comprises the following steps of: obtaining an original C language source code; analyzing and instrumenting the original C language code to generate an instrumented C language code and an instrumentation report; compiling and executing the instrumented C language code; and linking the runtime detection library to detect the security of the memory. According to the source code instrumentation-based C language memory security detection method provided by the invention, the original C language code is subjected to instrumentation before compiling, and the memory security is detected during running, so that efficient memory security detection is realized.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of network information security technology, and in particular to a C language memory security detection method based on source code instrumentation. Background Art

[0002] Memory safety issues are one of the main causes of software defects and security vulnerabilities, especially in C language programs.

[0003] Currently, the main solutions for detecting memory safety issues include using static analysis tools or dynamic analysis tools. Static analysis tools such as Coverity, Clang Static Analyzer, and SCA tools can be used to detect potential memory errors through code analysis. However, static analysis tools can only perform static analysis, have a high false positive rate, cannot detect memory problems that only occur at runtime, and have limited detection capabilities for complex pointer operations and dynamic memory allocation scenarios. Dynamic analysis tools such as Valgrind and AddressSanitizer can also be used to monitor memory operations while the program is running. However, the use of dynamic analysis tools usually requires specific compilation options or recompilation, has limited support for old development environments with low-version compilers, has a high performance overhead, and is not suitable for use in production environments.

[0004] Therefore, it is necessary to provide a C language memory safety detection method based on source code instrumentation to solve the above problems. Summary of the Invention

[0005] The present invention provides a C language memory safety detection method based on source code insertion, which inserts the original C language code before compilation and detects the memory safety during runtime, thereby achieving efficient memory safety detection.

[0006] An embodiment of the present invention provides a C language memory security detection method for source code instrumentation, comprising:

[0007] Get the original C language source code;

[0008] Analyzing and instrumenting the original C language code to generate instrumented C language code and an instrumentation report;

[0009] Compile and execute the C language code after the instrumentation;

[0010] Link with the runtime instrumentation library to perform memory safety checks.

[0011] Preferably, analyzing the original C language code includes:

[0012] Pointer dereference matching, matching all pointer dereference expressions of the form *ptr, distinguishing between read and write operations based on the context of the expression, and extracting the dereferenced pointer expression and access size information;

[0013] Array access matching, matching array index expressions such as array[index], analyzing index expressions, identifying out-of-bounds accesses, and extracting array base address and element size information;

[0014] Memory allocation function matching, matching memory allocation function calls, extracting allocation size parameters, and identifying the assignment target of the allocation result. The memory allocation functions include malloc, calloc, and realloc.

[0015] Memory release function matching, matching free function calls, extracting the released pointer parameters, and checking for potential double release risks;

[0016] Variable declaration matching, matching local and global variable declarations, distinguishing different storage types, extracting variable name, type, and size information. The storage types include automatic, static, and external.

[0017] Preferably, analyzing the original C language code further comprises:

[0018] A recursive AST visitor is used to traverse the original C language code structure, identify the scope of each variable declaration, insert variable registration code at the beginning of the scope, insert variable deregistration code at the end of the scope, and maintain the mapping relationship between variables and scopes.

[0019] Preferably, the memory security detection includes:

[0020] Record the starting address and size of the memory block and the storage memory type, and save the location information of the source code. The memory types include heap memory, stack memory, and global memory. The location information of the source code includes the file name and line number of the source code.

[0021] When the memory block is heap memory, the allocation and release status of the memory block is recorded.

[0022] Preferably, the memory security detection further includes:

[0023] Detect the following memory errors: whether the global variable buffer overflows, whether the stack variable buffer overflows, whether the heap variable buffer overflows, whether it is used after release, and whether it is used after return.

[0024] Preferably, the memory security detection further includes memory read and write checking, verifying whether the access address has been allocated, and checking whether the access range is within a valid memory block;

[0025] When the memory block is heap memory, verify whether the memory block has been released;

[0026] When the memory block is stack memory, verify whether the variable is within the valid life cycle.

[0027] Preferably, the memory security detection also includes memory error type determination, determining the error type according to the memory block status and access type, distinguishing different levels of error severity, and providing detailed error context information.

[0028] Preferably, the memory security detection further includes processing memory check results, recording check results and error information, deciding whether to terminate the program according to the configuration, and calling a user-defined error handling callback.

[0029] Preferably, the memory safety detection includes: pre-allocating a fixed-size memory block array, and quickly allocating and releasing a memory block structure to reduce the memory allocation overhead of the object.

[0030] Preferably, the memory security detection further includes:

[0031] Hierarchical memory management, a tiered memory pool system with different sizes. Different types of data use dedicated memory pools, and new pools are automatically expanded when the pool is full.

[0032] Delay the release and batch reclaim of memory, reuse the memory, and clean up the memory uniformly at the end.

[0033] Compared with the prior art, the technical solution of the embodiment of the present invention has the following beneficial effects:

[0034] An embodiment of the present invention provides a C language memory safety detection method based on source code instrumentation, comprising: obtaining original C language source code; analyzing and instrumenting the original C language code to generate instrumented C language code and an instrumentation report; compiling and executing the instrumented C language code; linking a runtime detection library to detect memory safety, instrumenting the original C language code before compilation, and detecting memory safety at runtime, thereby achieving efficient memory safety detection;

[0035] Furthermore, the analysis of the original C language code includes: pointer dereference matching, matching all pointer dereference expressions of the form *ptr, distinguishing between read operations and write operations according to the context of the expression, and extracting the dereferenced pointer expression and access size information; array access matching, matching array index expressions of the form array[index], analyzing the index expression, identifying out-of-bounds access, and extracting the array base address and element size information; memory allocation function matching, matching calls to memory allocation functions, extracting allocation size parameters, and identifying the assignment target of the allocation result. The memory allocation functions include malloc, calloc, and realloc; memory release function matching, matching free function calls, extracting released pointer parameters, and checking whether there is a potential double release risk; variable declaration matching, matching local variable and global variable declarations, distinguishing between different storage types, and extracting variable name, type, and size information. The storage types include automatic, static, and external. A variety of expression patterns are used to match specific structures in the C language code, thereby achieving effective identification of the insertion location.

[0036] Furthermore, the starting address and size of the memory block and the storage memory type are recorded, and the location information of the source code is saved. The memory types include heap memory, stack memory and global memory, and the location information of the source code includes the file name and line number of the source code; when the memory block is heap memory, the allocation and release status of the memory block are recorded, and a memory checking mechanism is established to verify the legality of all memory accesses. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention, not all embodiments. Those skilled in the art can also derive other drawings based on these drawings without inventive effort.

[0038] Figure 1 A schematic diagram of a flow chart of a C language memory security detection method based on source code instrumentation provided by one embodiment of the present invention;

[0039] Figure 2 A schematic flow chart of a C language memory security detection method based on source code instrumentation provided in another embodiment of the present invention;

[0040] Figure 3 A schematic flow chart of a C language memory security detection method based on source code instrumentation is provided as another embodiment of the present invention. DETAILED DESCRIPTION

[0041] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0042] The technical solution of the present invention is described in detail below with reference to specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0043] Based on the problems existing in the prior art, an embodiment of the present invention provides a C language memory safety detection method based on source code instrumentation, which implements efficient memory safety detection by instrumenting the original C language code before compilation and detecting memory safety at runtime.

[0044] Figure 1 A flow chart of a C language memory security detection method based on source code instrumentation is provided for one embodiment of the present invention. Figure 1 , provides a C language memory safety detection method based on source code instrumentation, including:

[0045] Step S101: Obtain original C language source code;

[0046] Step S102: Analyze and instrument the original C language code to generate instrumented C language code and an instrumentation report;

[0047] Step S103: compile and execute the C language code after the insertion;

[0048] Step S104: linking a runtime detection library to detect memory safety.

[0049] Specifically, the runtime detection library is the core component that actually performs memory detection. It provides a series of memory operation-related detection functions and participates in the construction of other programs in the form of source code or library.

[0050] Figure 2 A flow chart of a C language memory security detection method based on source code instrumentation is provided as another embodiment of the present invention. Figure 2 , provides a C language memory safety detection method based on source code instrumentation, including:

[0051] Step S201: Obtain original C language source code;

[0052] Step S202: Analyze and instrument the original C language code to generate instrumented C language code and an instrumentation report;

[0053] Step S203: pointer dereference matching, matching all pointer dereference expressions of the form *ptr, distinguishing between read and write operations based on the context of the expression, and extracting the dereferenced pointer expression and access size information;

[0054] Step S204: Array access matching, matching array index expressions of the form array[index], analyzing the index expressions, identifying out-of-bounds accesses, and extracting array base address and element size information;

[0055] Step S205: matching memory allocation functions, matching memory allocation function calls, extracting allocation size parameters, and identifying the assignment target of the allocation result. The memory allocation functions include malloc, calloc, and realloc.

[0056] Step S206: matching memory release functions, matching free function calls, extracting released pointer parameters, and checking whether there is a potential double release risk;

[0057] Step S207: Variable declaration matching, matching local variable and global variable declarations, distinguishing different storage types, extracting variable name, type and size information, the storage types include automatic, static, and external;

[0058] Step S208: compile and execute the C language code after the insertion;

[0059] Step S209: Linking a runtime detection library to detect memory safety.

[0060] Specifically, a double free error occurs when the same memory block is released by calling the free() function multiple times. This error is detected by marking the type of the memory block. A memory block that has been released is marked as FREED (an internal state enumeration value). Freeing it again will result in a double free error.

[0061] In a specific implementation, the analyzing the original C language code further includes:

[0062] A recursive AST (Abstract Syntax Tree) accessor is used to traverse the original C language code structure, identify the scope of each variable declaration, insert variable registration code at the beginning of the scope, insert variable deregistration code at the end of the scope, and maintain the mapping relationship between variables and scopes.

[0063] Figure 3A flow chart of a C language memory security detection method based on source code instrumentation is provided as another embodiment of the present invention. Figure 3 , provides a C language memory safety detection method based on source code instrumentation, including:

[0064] Step S301: Obtain original C language source code;

[0065] Step S302: Analyze and instrument the original C language code to generate instrumented C language code and an instrumentation report;

[0066] Step S303: compile and execute the C language code after the stub;

[0067] Step S304: linking a runtime detection library to detect memory safety;

[0068] Step S305: Record the starting address and size of the memory block and the storage memory type, and save the location information of the source code. The memory types include heap memory, stack memory, and global memory. The location information of the source code includes the file name and line number of the source code. When the memory block is heap memory, record the allocation and release status of the memory block.

[0069] Step S306: Detect the following memory errors: whether the global variable buffer overflows, whether the stack variable buffer overflows, whether the heap variable buffer overflows, whether it is used after release, and whether it is used after return;

[0070] Step S307: Memory read and write check to verify whether the access address has been allocated and whether the access range is within a valid memory block; if the memory block is heap memory, verify whether the memory block has been released; if the memory block is stack memory, verify whether the variable is within the valid life cycle;

[0071] Step S308: Memory error type determination, determining the error type based on the memory block status and access type, distinguishing different levels of error severity, and providing detailed error context information;

[0072] Step S309: Process the memory check result, record the check result and error information, decide whether to terminate the program according to the configuration, and call the user-defined error handling callback;

[0073] Step S310: pre-allocate a fixed-size memory block array, quickly allocate and release the memory block structure, so as to reduce the memory allocation overhead of the object;

[0074] Step S311: Hierarchical memory management, a memory pool system with hierarchical sizes, dedicated memory pools for different types of data, and automatic expansion of new pools when the pool is full; delayed release and batch recovery of memory, multiplexing of memory, and unified cleanup of memory at the end.

[0075] Specifically, stack memory is allocated by the system. You only need to record the address and scope. Entering the scope means allocating stack memory, and leaving the scope means releasing stack memory.

[0076] Specifically, global variables are located in the data segment or BSS segment of the program process space. They are valid throughout the life cycle of the process and their scope is usually the entire program.

[0077] Specifically, it uses a self-balancing tree to achieve efficient memory block lookup, supporting fast insertion, search, and deletion operations. The use of a memory pool improves memory allocation and release efficiency, reducing system memory fragmentation. Based on the input memory address, access size, and operation type, it locates the memory block to which the address belongs, verifies the memory block status, checks whether the access range is within the valid boundaries, determines the check result, and finally generates a detailed report based on error conditions. The memory block status includes whether it is allocated or released, and the check result can be either pass or error.

[0078] In summary, an embodiment of the present invention provides a C language memory safety detection method based on source code instrumentation, comprising: obtaining original C language source code; analyzing and instrumenting the original C language code to generate instrumented C language code and an instrumentation report; compiling and executing the instrumented C language code; and linking a runtime detection library to detect memory safety. By instrumenting the original C language code before compilation and detecting memory safety at runtime, efficient memory safety detection is achieved.

[0079] Furthermore, the analysis of the original C language code includes: pointer dereference matching, matching all pointer dereference expressions of the form *ptr, distinguishing between read operations and write operations according to the context of the expression, and extracting the dereferenced pointer expression and access size information; array access matching, matching array index expressions of the form array[index], analyzing the index expression, identifying out-of-bounds access, and extracting the array base address and element size information; memory allocation function matching, matching calls to memory allocation functions, extracting allocation size parameters, and identifying the assignment target of the allocation result. The memory allocation functions include malloc, calloc, and realloc; memory release function matching, matching free function calls, extracting released pointer parameters, and checking whether there is a potential double release risk; variable declaration matching, matching local variable and global variable declarations, distinguishing between different storage types, and extracting variable name, type, and size information. The storage types include automatic, static, and external. A variety of expression patterns are used to match specific structures in the C language code, thereby achieving effective identification of the insertion location.

[0080] Furthermore, the starting address and size of the memory block and the storage memory type are recorded, and the location information of the source code is saved. The memory types include heap memory, stack memory and global memory, and the location information of the source code includes the file name and line number of the source code; when the memory block is heap memory, the allocation and release status of the memory block are recorded, and a memory checking mechanism is established to verify the legality of all memory accesses.

[0081] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A C language memory security detection method for source code instrumentation, characterized in that: include: Get the original C language source code; Analyzing and instrumenting the original C language code to generate instrumented C language code and an instrumentation report; Compile and execute the C language code after the instrumentation; Link with the runtime instrumentation library to perform memory safety checks.

2. The C language memory security detection method based on source code instrumentation according to claim 1 is characterized in that: The analyzing of the original C language code comprises: Pointer dereference matching, matching all pointer dereference expressions of the form *ptr, distinguishing between read and write operations based on the context of the expression, and extracting the dereferenced pointer expression and access size information; Array access matching, matching array index expressions such as array[index], analyzing index expressions, identifying out-of-bounds accesses, and extracting array base address and element size information; Memory allocation function matching, matching memory allocation function calls, extracting allocation size parameters, and identifying the assignment target of the allocation result. The memory allocation functions include malloc, calloc, and realloc. Memory release function matching, matching free function calls, extracting the released pointer parameters, and checking for potential double release risks; Variable declaration matching, matching local and global variable declarations, distinguishing different storage types, extracting variable name, type, and size information. The storage types include automatic, static, and external.

3. The C language memory security detection method based on source code instrumentation according to claim 1 is characterized in that: The analyzing of the original C language code further comprises: A recursive AST visitor is used to traverse the original C language code structure, identify the scope of each variable declaration, insert variable registration code at the beginning of the scope, insert variable deregistration code at the end of the scope, and maintain the mapping relationship between variables and scopes.

4. The C language memory security detection method based on source code instrumentation according to claim 1 is characterized in that: The memory safety detection includes: Record the starting address and size of the memory block and the storage memory type, and save the location information of the source code. The memory types include heap memory, stack memory, and global memory. The location information of the source code includes the file name and line number of the source code. When the memory block is heap memory, the allocation and release status of the memory block is recorded.

5. The C language memory security detection method based on source code instrumentation according to claim 4 is characterized in that: The memory safety detection further includes: Detect the following memory errors: whether the global variable buffer overflows, whether the stack variable buffer overflows, whether the heap variable buffer overflows, whether it is used after release, and whether it is used after return.

6. The C language memory security detection method based on source code instrumentation according to claim 5 is characterized in that: The memory security detection also includes memory read and write checking, verifying whether the access address has been allocated, and checking whether the access range is within the valid memory block; When the memory block is heap memory, verify whether the memory block has been released; When the memory block is stack memory, verify whether the variable is within the valid life cycle.

7. The C language memory security detection method based on source code instrumentation according to claim 5 is characterized in that: The memory safety detection also includes memory error type determination, determining the error type based on the memory block status and access type, distinguishing different levels of error severity, and providing detailed error context information.

8. The C language memory security detection method based on source code instrumentation according to claim 5 is characterized in that: The memory safety detection also includes processing the memory check results, recording the check results and error information, deciding whether to terminate the program based on the configuration, and calling the user-defined error handling callback.

9. The C language memory security detection method based on source code instrumentation according to claim 1, characterized in that: The memory safety detection includes: pre-allocating a fixed-size memory block array, and quickly allocating and releasing a memory block structure to reduce the memory allocation overhead of the object.

10. The C language memory security detection method based on source code instrumentation according to claim 1, characterized in that: The memory safety detection further includes: Hierarchical memory management, a tiered memory pool system with different sizes. Different types of data use dedicated memory pools, and new pools are automatically expanded when the pool is full. Delay the release and batch reclaim of memory, reuse the memory, and clean up the memory uniformly at the end.

Images