Code analysis path pruning method and device, equipment and storage medium

Abstract

The invention provides a code analysis path pruning method and device, equipment and a storage medium, and the method comprises the steps: extracting to-be-analyzed code control flow information, splitting a composite conditional statement, generating a control flow diagram corresponding to a to-be-analyzed code, enabling a node block of the control flow diagram to represent an execution unit or a condition judgment unit, the edge represents the path direction of the control flow; marking the condition judgment unit needing to be tracked as a recording unit; traversing the control flow diagram in a multi-branch parallel mode, performing normalization processing on statements in the traversing process, maintaining all possible condition states if the condition statements of a certain recording unit are traversed in a single branch for the first time, otherwise, querying the value of the condition state corresponding to the condition statement from a dynamic maintenance list; pruning and recording out-degree edges, which do not accord with the condition state, of the unit; and for the condition that the conditional statement appears for the first time and is not pruned after query, generating a copy of the dynamic maintenance list for independent updating and query in subsequent branch condition states.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of code analysis, and in particular to a code analysis path pruning method and device, equipment and a storage medium. BACKGROUND

[0002] Code analysis refers to the review of source code by automated tools or manual inspection. With the increasing size of software systems, especially for complex systems developed using C / C++ in industrial applications, the complexity and diversity of the syntax itself become an important challenge for code analysis and defect detection.

[0003] In related technologies, static analysis tools are often used for comprehensive code analysis. However, when facing complex syntax structures such as multi-layer nested loops, recursive calls or conditional branches, the number of control flow paths grows exponentially, leading to computational difficulties. The time complexity of traditional full-path traversal analysis can reach O(2^n) in theory. For example, in code with nested if(A) {if(B) {...}} conditional statements, the number of branch paths grows exponentially with the nesting depth. The computation time required for exhaustive path analysis of particularly complex code can exceed the acceptable range for engineering. To balance efficiency and accuracy, existing tools have to compromise on complex path analysis, resulting in a high false negative rate. In addition, existing code analysis sequences explore and parallel explore coexist. However, the data storage method of the global state table leads to thread contention when parallel processing, and completely independent storage will result in a large storage overhead.

[0004] In summary, the existing technology lacks a solution that uses a multi-branch parallel traversal method to prune the control flow graph, implements pruning of impossible execution paths in code paths based on rules for clear conditional statements, and creates a dynamically maintained list copy to record independently when a new branch is generated. SUMMARY

[0005] The present application aims to provide a code analysis path pruning method, device, equipment and storage medium, which aims to solve the above problems in the prior art.

[0006] According to a first aspect of an embodiment of the present application, a code analysis path pruning method is provided, comprising: extracting the control flow information of the code to be analyzed and splitting the composite conditional statements to generate a control flow graph corresponding to the code to be analyzed, wherein the node block of the control flow graph represents an execution unit or a conditional judgment unit, and the edge represents the path direction of the control flow; marking the conditional judgment unit to be tracked as a record unit; The control flow graph is traversed in a multi-branch parallel mode, and the conditional statements used in the traversal process are normalized, and in a single branch, if the conditional statement of a certain record unit is first appeared, all possible conditional states are maintained, otherwise, the value of the conditional state corresponding to the conditional statement is queried from the dynamically maintained list, and the out-degree edges of the record unit inconsistent with the conditional state are pruned; For the case that the conditional statement is first appeared and not pruned after the query, a copy of the dynamically maintained list is generated, and the copy is used for independent update and query in the subsequent branch conditional state.

[0007] According to a second aspect of the embodiment of the present application, a code analysis path pruning device is provided, comprising: A control flow graph generation module is configured to extract the control flow information of the code to be analyzed and split the composite conditional statement, and generate the control flow graph corresponding to the code to be analyzed, wherein the node block of the control flow graph represents an execution unit or a conditional judgment unit, and the edge represents the path direction of the control flow; A tracking marking module is configured to mark the conditional judgment unit to be tracked as a record unit; A traversal pruning module is configured to traverse the control flow graph in a multi-branch parallel mode, and the conditional statements used in the traversal process are normalized, and in a single branch, if the conditional statement of a certain record unit is first appeared, all possible conditional states are maintained, otherwise, the value of the conditional state corresponding to the conditional statement is queried from the dynamically maintained list, and the out-degree edges of the record unit inconsistent with the conditional state are pruned; A list update module is configured to, for the case that the conditional statement is first appeared and not pruned after the query, generate a copy of the dynamically maintained list, and use the copy for independent update and query in the subsequent branch conditional state. According to a third aspect of the embodiment of the present application, an electronic device is provided, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, and when the computer program is executed by the processor, the steps of the code analysis path pruning method provided by the first aspect of the present disclosure are implemented.

[0008] According to a fourth aspect of the embodiment of the present application, a computer readable storage medium is provided, and information transmission is implemented by storing an implementation program on the computer readable storage medium, and when the program is executed by the processor, the steps of the code analysis path pruning method provided by the first aspect of the present disclosure are implemented.

[0009] The technical scheme provided by the embodiment of the present application has the following beneficial effects: a code analysis mode based on control flow graph path pruning is provided, pruning logic based on conditional state is used, and invalid paths are not analyzed, so that the efficiency of code analysis is improved to support deep analysis of more complex codes; a multi-branch parallel mode is used to traverse the control flow graph to accelerate covering different paths, and a copy generation mode is used to maintain an independent database when a new branch is generated, so that the complexity of thread contention caused by global state storage is reduced while avoiding excessive repeated data recording.

[0010] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0011] In order to more clearly illustrate the technical solutions in the one or more embodiments of the present specification or the prior art, the drawings needed in the embodiment or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments described in the present specification, and other drawings can be obtained by those skilled in the art without creative labor.

[0012] Figure 1 is a flowchart of the code analysis path pruning method of the embodiment of the present application; Figure 2 is a schematic diagram of the control flow graph of the second embodiment of the present application; Figure 3 is a schematic diagram of the pruning process of the second embodiment of the present application; Figure 4 is a schematic diagram of the control flow graph of the third embodiment of the present application; Figure 5 is a schematic diagram of the pruning process of the third embodiment of the present application; Figure 6 is a schematic diagram of the code analysis path pruning device of the embodiment of the present application; Figure 7 is a schematic diagram of the electronic device of the embodiment of the present application. DETAILED DESCRIPTION

[0013] In order to enable those skilled in the art to better understand the technical solutions in the one or more embodiments of the present specification, the technical solutions in the one or more embodiments of the present specification will be described clearly and completely below with reference to the drawings in the one or more embodiments of the present specification. Obviously, the described embodiments are only some embodiments of the present specification, not all embodiments. Based on the one or more embodiments of the present specification, all other embodiments obtained by those skilled in the art without creative labor should belong to the protection scope of the present document.

[0014] Method embodiment one According to the embodiment of the present application, a code analysis path pruning method is provided, Figure 1 is a flow chart of the code analysis path pruning method of the embodiment of the present application, as Figure 1 shown, the code analysis path pruning method according to the embodiment of the present application specifically includes: In step S110, the control flow information of the code to be analyzed is extracted and the compound conditional statement is split to generate the control flow graph corresponding to the code to be analyzed, wherein the node block of the control flow graph represents an execution unit or a conditional judgment unit, and the edge represents the path direction of the control flow, specifically including: Using a static analysis tool to identify the lexical syntax structure and control flow logic in the code to be analyzed to generate an initial flow graph; Splitting the and logical statement and the or logical statement in the initial flow graph into independent conditional statements to generate corresponding conditional judgment units to replace the original compound conditional units, the and logical statement is in the form of A&&B, all conditions are true at the same time, the or logical statement is in the form of A||B, and the whole is true if any condition is true, in the embodiment of the present application, the A conditional statement judgment and the B conditional statement judgment are split respectively; All node blocks except the conditional judgment units are used as execution units, the execution units are used for logical judgment and execution under other normal conditions, the execution result corresponding to the execution unit can update the related values in the record unit, the node block is referred to as BLOCK; In the embodiment of the present application, the flow graph is in the form of CFG.

[0015] In step S120, the conditional judgment unit to be tracked is marked as a record unit, specifically including: In the cross-function and function, if the frequency of the conditional statement corresponding to the conditional judgment unit is higher than the first preset threshold, or the frequency of the variable in the conditional statement in the processing of the execution unit is higher than the second preset threshold, the corresponding conditional judgment unit is marked as a record unit; The marking process is equivalent to a preprocessing process before pruning execution, that is, the information that the BLOCK appears multiple times in the initial traversal is the key information that may be used for pruning, preferably, whether the variable value in the conditional statement is modified can also be used as a condition for whether to track; the conditional judgment units other than the record unit are not pruned, judged or recorded.

[0016] In step S130, the control flow graph is traversed in a multi-branch parallel manner, the conditional statements used in the traversal process are normalized, and in a single branch, if the conditional statement of a certain record unit is first appeared, all possible condition states are maintained, otherwise, the value of the condition state corresponding to the conditional statement is queried from the dynamically maintained list, and the out-degree edge of the record unit that does not match the condition state is pruned, which specifically includes: Starting from the entry unit of the control flow graph, the traversal is performed in a multi-branch parallel manner, that is, if there are true and false condition states for the same unit, a new branch is generated to explore all possible paths, and subsequent pruning removes unnecessary code branches to prevent the parallel processing amount from being too large, and each branch is executed independently.

[0017] The conditional statement expression generally includes the following operators: >, >=, <, <=, ==,!=, which results in a slow rate in the subsequent query process, and therefore, the normalization process is designed as follows: The conditional statements with the operators >, >= and <= in the node block are normalized to conditional statements with the operator <, wherein the conditional statements with the original operators >= and <= need to take the opposite polarity of the condition state; the conditional statements with the operator!= in the node block are normalized to conditional statements with the operator ==, and the polarity of the condition state is taken opposite; The normalized conditional statements are used for updating and querying in all scenarios in the traversal process, and the normalization logic is shown in Table 1, which essentially normalizes the conditional expression. It should be noted that the normalization logic in other similar cases is also within the scope of protection of the present application: Table 1. Normalization processing rules

[0018] If a certain conditional language is first appeared in a single branch, the related data is not stored in the dynamically maintained list before that, all possible condition states are obtained for subsequent generation of a copy, and the record of the condition state value is used as the basis for subsequent pruning query; The condition state corresponding to the conditional statement is the Boolean value of the conditional expression, and the basic pruning logic is that if BLOCK0 has determined that the condition state of A conditional statement is false, and the value of the variable in the conditional statement has not changed or has not caused the change of the condition state, then the current BLOCK3 cannot determine that A conditional statement is true, and the out-degree edge true is pruned.

[0019] In step S140, for the case that the conditional statement is first appeared and not pruned after query, a copy of the dynamically maintained list is generated, and the copy is used for independent updating and querying in each branch condition state, which specifically includes: When a single branch reaches a certain record unit, if the conditional statement is the first occurrence or the query is not pruned, a new branch is generated based on the out-degree edge of the record unit, a copy identical to the original dynamic maintenance list is generated, and the copy is used as the dynamic maintenance list independent of the conditional state of each branch; The above two cases show that there are true and false conditional states for the out-degree edge at this time, that is, a new branch will be generated, and the recorded information will change in the subsequent execution process, but the recorded information is exactly the same before this time, so a copy identical to the original dynamic maintenance list is generated for independent updating of each branch, and the two branches can both use the copy, preferably, one of them can also be selected to continue using the original dynamic maintenance list; for the case that the conditional statement is not the first occurrence and does not need to be pruned, it may be that the compiler cannot determine or there are other complex situations; Since the conditional judgment unit generally has only two out-degree edges, if the out-degree edge needs to be pruned, it indicates that a new branch is not generated temporarily, and a copy is not needed to continue updating; It should be noted that the copy is generated only for the case that the current single branch is not pruned, and the code analysis path obtained before this time is unique, and for the case that different branches reach the same unit before the record unit, the copy generation rule is not applicable; In the traversal process, the dynamic maintenance list is used to update and query the storage content, wherein the storage content includes the current traversal path, the value of the variable in the conditional statement, and the value of the conditional state; the value of the variable is used to update the value of the conditional state, and it should be noted that in the embodiment of the application, the value of the variable is not limited to a numerical value, but can also be a state or a description of a relationship; In the embodiment of the application, a database capable of meeting the adaptive index type is used as the dynamic maintenance list, such as Redis, PostgreSQL, Oracle, etc. In the traversal process, the hotness flag is used to control the sorting in the dynamic maintenance list, the frequency of the conditional statement being queried is used as the value of the hotness flag, and the storage order of the conditional statement is arranged from high to low according to the value of the hotness flag; in the embodiment of the application, the value of the variable in the conditional statement and the value of the conditional state are stored in a sub-table, and the columns in the sub-table are used to store the conditional expression in the conditional statement, the corresponding conditional state and the value of the corresponding variable in turn, and the conditional expression is similar to the key of the query. The traversal path is only the node that the current dynamic maintenance list has traversed, and is not used as a condition for pruning, and the content of the hotness flag is stored independently.

[0020] The method further includes: After the traversal, all code analysis paths after pruning are obtained.

[0021] Method embodiment two The code for Example 2 is as follows: void handleElem(int a, int b) { if (a == b) { deleteElem(); } else { addElem(); } if (a == b) { checkNewElem(); } else { checkNumber(); } } Figure 2 is a schematic diagram of a control flow graph of the second embodiment of the present invention, such as Figure 2 As shown in the figure, the control flow graph CFC structure is shown. If path pruning is not performed during code analysis, any edge may be executed. The original code analysis path has the following four paths, among which B0 is BLOCK0. The others can be obtained similarly: (1) B0 -> B1 -> B3 -> B4 (2) B0 -> B1 -> B3 -> B5 (3) B0 -> B2 -> B3 -> B4 (4) B0 -> B2 -> B3 -> B5 Figure 3 Schematic diagram of the pruning process of the second embodiment of the present invention, Figure 3 As shown in the figure, the reference diagram of the pruning process is shown. The marked units that need to be tracked are BLOCK0 and BLOCK3. Starting from the entry unit BLOCK0, if (a==b), there are two possible conditional states: true and false. At this time, a copy of the dynamic maintenance list is generated, and these two states are recorded in dynamic maintenance list 1 and dynamic maintenance list 2 respectively, resulting in two branches for parallel execution. Record a==b true and other information in the dynamic maintenance list 1 corresponding to branch 1. After executing BLOCK1, reach BLOCK3. If the query a==b is true, it is impossible for BLOCK3 to be false. In this case, prune the out-degree edge of BLOCK3 that is false. Similarly, for branch 2 and the information in the corresponding dynamic maintenance list 2, prune the out-degree edge of BLOCK3 that is true. After conditional pruning, the following two analysis paths are obtained: (1) B0->B1->B3->B4 (2) B0->B2->B3->B5 Method Example 3 The code for Example 3 is as follows: void testConditon(int a, int b, int c, int d) { int p = nullptr; int var; if (a == b) { return; } var = (a>b&&c <d) ? a : b; if (var == a&&a<= b) { var = p; / / False positive dereference of null pointer } return; } Figure 4 Schematic diagram of the control flow diagram of the third embodiment of the present invention, such as Figure 4 As shown in the figure, the control flow graph CFC structure is shown. Example 3 includes compound conditional statements and is therefore split. If path pruning is not performed during code analysis, any edge may be executed, and when var= p will generate a false positive for null pointer dereference; the original code analysis paths have the following 10 paths: (1) B0 -> B9 (2) B0 ->B1 ->B2 ->B4 ->B5 ->B6 ->B7 ->B8 (3) B0 ->B1 ->B2 ->B4 ->B5 ->B6 ->B8 (4) B0 ->B1 ->B2 ->B4 ->B5 ->B8 (5) B0 ->B1 ->B2 ->B3 ->B5 ->B6 ->B7->B8 (6) B0 ->B1 ->B2 ->B3 ->B5 ->B6 ->B8 (7) B0 ->B1 ->B2 ->B3 ->B5 ->B8 (8) B0 ->B1 ->B5 ->B5 ->B6 ->B7 ->B8 (9) B0 -> B1 -> B3 -> B5 -> B8 (10) B0 ->B1->B3 ->B5 ->B6 ->B8 Figure 5 Schematic diagram of the pruning process of the third embodiment of the present invention, Figure 5 As shown, one of the branch pruning processes is shown as a reference diagram, which can show the generation process of the final path B0 ->B1 ->B2 ->B4 ->B5 ->B6 ->B8. The marking units that need to be tracked include b <a、c<d、var == a及a == b对应的BLOCK,当执行到BLOCK2时其中的条件语句为首次出现则产生副本,在左边分支的动态维护列表1中记录c<d true,在右边分支的动态维护列表2中记录c<d false,后续独立记录更新; 基于条件剪枝后,得到的分析路径有如下6条: (1)B0 -> B9 (2) B0 ->B1 ->B2 ->B4 ->B5 ->B6 ->B8 (3) B0 ->B1 ->B2 ->B4 ->B5 ->B8 (4) B0 ->B1 ->B2 ->B3 ->B5 ->B6 ->B8 (5) B0 ->B1 ->B2 ->B3 ->B5 ->B8 (6) B0 -> B1 -> B3 -> B5 -> B8 From the third embodiment of the invention, it can be seen that the path pruning method can avoid going to var = p, the false positive caused by referencing a null pointer can be eliminated.

[0022] To sum up, in response to the existing problems, the code analysis path pruning method of this invention proposes a code analysis method based on control flow graph path pruning, explicitly uses pruning logic based on conditional states, and does not analyze invalid paths, thereby improving the efficiency of code analysis to support in-depth analysis of more complex codes, effectively solving the situation where non-constant values ​​cannot be clearly defined and pruning occurs, while avoiding unnecessary misjudgments in the analysis process; during the generation of the control flow graph, the compound conditional statements are effectively split, and the conditional statements are normalized during the traversal process to facilitate logical judgment and query storage; in addition, a multi-branch parallel method is used to traverse the control flow graph to accelerate the coverage of different paths, and an independent database is maintained by generating copies when new branches are generated. While avoiding completely independent recording of excessive duplicate data, the complexity of global state storage causing thread contention is reduced.

[0023] Device embodiment According to an embodiment of the present application, a code analysis path pruning device is provided, Figure 6 is a schematic diagram of the code analysis path pruning device according to an embodiment of the present application, as Figure 6 shown, the code analysis path pruning device according to an embodiment of the present application specifically comprises: a control flow graph generation module 60 configured to extract control flow information of the code to be analyzed and split a composite conditional statement, and generate a control flow graph corresponding to the code to be analyzed, wherein a node block of the control flow graph represents an execution unit or a conditional judgment unit, and an edge represents a path direction of a control flow, and specifically configured to: identify a lexical syntax structure and a control flow logic in the code to be analyzed using a static analysis tool, and generate an initial flow graph; split an and logic statement and an or logic statement in the initial flow graph into independent conditional statements, generate a corresponding conditional judgment unit to replace an original composite conditional unit, and take all node blocks other than the conditional judgment unit as execution units.

[0024] a tracking marking module 62 configured to mark a conditional judgment unit to be tracked as a record unit, and specifically configured to: in a cross-function and function-internal manner, if a condition statement corresponding to a conditional judgment unit appears more than a first preset threshold value, or a variable in the condition statement is processed more than a second preset threshold value in an execution unit, mark the corresponding conditional judgment unit as a record unit.

[0025] a traversal pruning module 64 configured to traverse the control flow graph in a multi-branch parallel manner, and use a condition statement in a normalization process, and in a single branch, if a condition statement of a record unit is first appeared, maintain all possible condition states, otherwise, query a value of a condition state corresponding to the condition statement from a dynamically maintained list, and prune an out-degree edge of the record unit that does not match the condition state, and specifically configured to: normalize a condition statement with an operator of greater than, greater than or equal to, and less than or equal to in a node block to a condition statement with an operator of less than, wherein the condition statement with the original operator of greater than or equal to and less than or equal to needs to take a condition state polarity opposite; normalize a condition statement with an operator of not equal to in a node block to a condition statement with an operator of equal to, and take a condition state polarity opposite; use the condition statement after the normalization process for updating and querying in the traversal process.

[0026] a list updating module 66 configured to, for a condition statement first appeared and not pruned after querying, generate a copy of a dynamically maintained list, and use the copy for independent updating and querying in a subsequent branch condition state, and specifically configured to: When a single branch traverses to a certain record unit, if the conditional statement is the first occurrence or the query is not pruned, a new branch is generated based on the out-degree edge of the record unit, a copy identical to the original dynamic maintenance list is generated, and the copy is used as a dynamic maintenance list independent of the conditional state of each branch; In the traversal process, the storage content is updated and queried through the dynamic maintenance list, wherein the storage content includes the current traversal path, the value of the variable in the conditional statement and the value of the conditional state; In the traversal process, the sorting in the dynamic maintenance list is controlled by using the hotness marking bit, the frequency of querying the conditional statement is used as the value of the hotness marking bit, and the storage order of the conditional statement is arranged from high to low according to the value of the hotness marking bit.

[0027] The device further comprises: The path obtaining module 68 is configured to obtain all the pruned code analysis paths after the traversal.

[0028] To sum up, in view of the existing problems, the code analysis path pruning device is proposed, a code analysis method based on control flow graph path pruning is proposed, the pruning logic based on the conditional state is used, the invalid path is not analyzed, the efficiency of code analysis is improved to support the deep analysis of more complex codes, the situation that the non-constant value cannot be pruned because the exact value cannot be determined is effectively solved, unnecessary misjudgment in the analysis process is avoided, the composite conditional statement is effectively split in the generation process of the control flow graph, and the conditional statement is normalized in the traversal process, so that the logical judgment and query storage are facilitated, in addition, the control flow graph is traversed in a multi-branch parallel mode to accelerate the coverage of different paths, the independent database is maintained by generating a copy when a new branch is generated, while avoiding too much repeated data in completely independent records, the complexity of thread contention caused by global state storage is reduced.

[0029] Electronic device embodiment Figure 7 is a schematic diagram of an electronic device according to an embodiment of the application. The electronic device 700 can include at least one processor 710 and a memory 720. The processor 710 can execute instructions stored in the memory 720. The processor 710 is communicatively connected to the memory 720 through a data bus. In addition to the memory 720, the processor 710 can also be communicatively connected to an input device 730, an output device 740 and a communication device 750 through the data bus.

[0030] The processor 710 can be any conventional processor, such as commercially available CPUs. The processor can also include a graphics processing unit (GPU), a field programmable gate array (FPGA), a system on chip (SOC), an application specific integrated circuit (ASIC), or a combination thereof.

[0031] The memory 720 can be implemented by any type of volatile or nonvolatile storage devices or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read only memory (EEPROM), erasable programmable read only memory (EPROM), programmable read only memory (PROM), read only memory (ROM), magnetic storage, flash memory, magnetic or optical disk.

[0032] In the embodiments of the present disclosure, the memory 720 stores executable instructions, and the processor 710 can read the executable instructions from the memory 720 and execute the instructions to implement all or part of the steps of the code analysis path pruning method of any of the above example embodiments.

[0033] Computer readable storage medium embodiments In addition to the above method and device, the example embodiments of the present disclosure can also be a computer program product or a computer readable storage medium storing the computer program product, the computer program product including computer program instructions executable by a processor to implement all or part of the steps described in the code analysis path pruning method of any of the above example embodiments.

[0034] The computer program product can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++, and conventional procedural programming languages, such as the "C" programming language, or similar programming languages and scripting languages (e.g., Python). The program code can execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server.

[0035] The computer readable storage medium can take the form of one or more combinations of any type of computer readable media. The computer readable medium can be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium can include, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a computer readable storage medium include, for example, a static random access memory (SRAM), an electrically erasable programmable read only memory (EEPROM), a programmable read only memory (PROM), a read only memory (ROM), a magnetic storage, a flash memory, a disk, or an optical disk, or any suitable combination of the foregoing.

[0036] Finally, it should be noted that the above-described embodiments are merely intended to illustrate the technical solutions of the present application, and are not intended to limit the present application; even though the present application has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the above-described embodiments, or equivalently replace some or all of the technical features thereof; and such modifications or replacements do not cause the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A code analysis path pruning method, characterized in that: include: Extracting control flow information of the code to be analyzed and splitting compound conditional statements to generate a control flow graph corresponding to the code to be analyzed, wherein the node blocks of the control flow graph represent execution units or condition judgment units, and the edges represent the path direction of the control flow; Mark the conditional judgment unit that needs to be tracked as a recording unit; The control flow graph is traversed in a multi-branch parallel manner. During the traversal process, conditional statements are normalized. In a single branch, if the conditional statement of a certain record unit appears for the first time, all possible conditional states are maintained. Otherwise, the value of the conditional state corresponding to the conditional statement is queried from a dynamically maintained list, and out-degree edges of the record unit that do not match the conditional state are pruned. For the first appearance of a conditional statement and the situation where no branches are pruned after querying, a copy of the dynamically maintained list is generated, and the copy is used for independent updating and querying under subsequent branch conditional states.

2. The method according to claim 1, characterized in that The method further comprises: After the traversal is completed, the entire code analysis path after pruning is obtained.

3. The method according to claim 1, characterized in that The extracting control flow information of the code to be analyzed and splitting the compound conditional statements to generate a control flow graph corresponding to the code to be analyzed specifically includes: Use static analysis tools to identify the lexical structure and control flow logic in the code to be analyzed and generate an initial flow graph; The AND logic statements and OR logic statements in the initial flow graph are split into independent conditional statements, corresponding conditional judgment units are generated to replace the original compound conditional units, and all node blocks except the conditional judgment units are used as the execution units.

4. The method according to claim 1, wherein The step of marking the condition judgment unit to be tracked as a recording unit specifically includes: In cross-functions and within functions, if the frequency of occurrence of a conditional statement corresponding to a conditional judgment unit is higher than a first preset threshold, or the processing frequency of a variable in the conditional statement in the execution unit is higher than a second preset threshold, the corresponding conditional judgment unit is marked as the recording unit.

5. The method according to claim 1, wherein The normalization processing of the conditional statements during the traversal process specifically includes: Normalize the conditional statements in the node block whose operators are greater than, greater than or equal to, and less than or equal to into conditional statements whose operators are less than. For the conditional statements whose original operators are greater than or equal to and less than or equal to, the polarity of the conditional state needs to be inverted. Normalize the conditional statements whose operators are not equal to each other in the node block into conditional statements whose operators are equal to each other, and invert the polarity of the conditional state; Use normalized conditional statements for updates and queries during the traversal process.

6. The method according to claim 1, characterized in that When a conditional statement appears for the first time and is not pruned after querying, generating a copy of the dynamically maintained list and using the copy for independent update and query under subsequent branch condition states specifically includes: When a single branch traverses to a certain record unit, if the conditional statement appears for the first time or has not been pruned after the query, a new branch is generated based on the out-degree edge of the record unit, and a copy that is completely consistent with the original dynamic maintenance list is generated. The copy is used as the dynamic maintenance list with independent conditional states for each branch; During the traversal process, the dynamic maintenance list is used to update and query the stored content, wherein the stored content includes the current traversal path, the values ​​of the variables in the conditional statement, and the value of the conditional state; During the traversal process, the heat mark bit is used to control the sorting in the dynamic maintenance list, and the frequency of conditional statements being queried is counted in real time as the value of the heat mark bit. The storage order of the conditional statements is arranged from high to low according to the value of the heat mark bit.

7. A code analysis path pruning device, characterized in that: include: A control flow graph generation module is used to extract the control flow information of the code to be analyzed and split the compound conditional statements to generate a control flow graph corresponding to the code to be analyzed, wherein the node blocks of the control flow graph represent execution units or condition judgment units, and the edges represent the path direction of the control flow; A tracking marking module is used to mark the condition judgment unit that needs to be tracked as a recording unit; A traversal and pruning module is used to traverse the control flow graph in a multi-branch parallel manner, normalize conditional statements during the traversal process, and maintain all possible conditional states if the conditional statement traversed to a certain record unit appears for the first time in a single branch; otherwise, the value of the conditional state corresponding to the conditional statement is queried from a dynamically maintained list, and out-degree edges of the record unit that do not match the conditional state are pruned; The list update module is used to generate a copy of the dynamically maintained list when the conditional statement appears for the first time and is not pruned after query, and use the copy for independent update and query under subsequent branch condition states.

8. The device according to claim 7, characterized in that The device further comprises: The path acquisition module is used to obtain the entire code analysis path after traversal.

9. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, the steps of the code analysis path pruning method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores an information transmission implementation program, and when the program is executed by a processor, the steps of the code analysis path pruning method according to any one of claims 1 to 6 are implemented.

Images