Code symbol execution method and device, storage medium and computer equipment
By classifying and semantically updating parameters within the loop body, the problem of semantic information loss during symbolic execution is solved, thereby improving the detection accuracy and efficiency of symbolic execution.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-14
- Publication Date
- 2026-04-17
AI Technical Summary
In symbolic execution, the loss of semantic information in the loop body makes it difficult to detect program defects. Existing technologies discard semantic information when the loop body cannot be fully expanded, resulting in poor symbolic execution performance.
By classifying the parameters inside the loop body, semantic information of basic inductive variables and associated parameters is obtained, and these semantics are updated after the loop exits so that they can be used for symbolic execution of subsequent code.
It significantly improves the accuracy of symbolic execution, enabling better detection of memory safety defects such as memory leaks and uninitialized variables, and reducing false positives and false negatives.
Smart Images
Figure CN121880152A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer technology, and in particular to code symbolic execution methods, apparatus, storage media, and computer devices. Background Technology
[0002] Static program analysis (SMA) refers to the method of analyzing a program without actually running it. Symbolic execution is a technique in the field of static program analysis that uses abstract symbols to replace precise values as program inputs and then derives the output results.
[0003] When performing symbolic execution, if the program contains loops and the number of loop executions is high, the number of symbolic execution paths may increase rapidly with the number of loop executions, leading to technical problems such as a significant increase in analysis time or even making the analysis unexecutable.
[0004] To overcome this problem, related technologies often directly abandon some symbolic execution paths. In cases where it is impossible to fully expand the loop body, the semantic information of many variables inside the loop body is abandoned. After exiting the loop, the loss of a large amount of semantic information leads to many program defects that are difficult to detect, making it difficult for symbolic execution to achieve the expected results. Summary of the Invention
[0005] This application provides a code symbolic execution method, apparatus, storage medium, and computer device. It can classify various parameters inside a loop body, extract semantics based on the classification results, and update the latest semantics of the relevant parameters after the loop body exits. These updated latest semantics can be used for symbolic execution of the code after the loop body, so that more program defects can be detected through symbolic execution, achieving the expected effect of symbolic execution. This solves the technical problem in related technologies that it is difficult to achieve the expected effect of symbolic execution due to the loss of semantic information of many parameters inside the loop body.
[0006] According to one aspect of the embodiments of this application, a code symbol execution method is provided, the method comprising:
[0007] Obtain the target code, which includes the target loop body;
[0008] The target code is parsed to obtain the corresponding target abstract syntax tree and target data flow graph;
[0009] Based on the target abstract syntax tree, symbolic execution is performed along the target data flow graph until the loop entry point of the target loop body is reached.
[0010] Obtain the current value of the basic inductive variable of the target loop body, where the basic inductive variable is the loop index of the target loop body;
[0011] If the current value does not meet the preset loop exit condition, symbolic execution is performed on the target loop body based on the current value to obtain the first semantic information of the associated parameters. The associated parameters include at least one of extended inductive variables, loop variables, and loop invariants. The extended inductive variables are variables in the target loop body that have a mapping relationship with the basic inductive variables. The loop invariants are invariants in the target loop body that do not change due to changes in the loop index. The loop variables are other parameters in the target loop body that are different from the basic inductive variables, the extended inductive variables, and the loop invariants.
[0012] If the current value meets the preset loop exit condition and the preset loop exit condition is inconsistent with the loop termination condition of the target loop body, the target value of the basic inductive variable and the second semantic information of the associated parameter are determined based on the loop termination condition and the first semantic information of the associated parameter.
[0013] Exiting the target loop, based on the second semantic information of the target value and the associated parameter, symbolic execution is performed on the code in the target code located after the target loop to obtain the symbolic execution result corresponding to the target code.
[0014] According to one aspect of the embodiments of this application, a code symbol execution apparatus is provided, the apparatus comprising:
[0015] The code acquisition module is used to acquire target code, which includes a target loop body.
[0016] The code parsing module is used to parse the target code to obtain the corresponding target abstract syntax tree and target data flow graph;
[0017] The loop symbol execution module is used to perform the following operations:
[0018] Based on the target abstract syntax tree, symbolic execution is performed along the target data flow graph until the loop entry point of the target loop body is reached.
[0019] Obtain the current value of the basic inductive variable of the target loop body, where the basic inductive variable is the loop index of the target loop body;
[0020] If the current value does not meet the preset loop exit condition, symbolic execution is performed on the target loop body based on the current value to obtain the first semantic information of the associated parameters. The associated parameters include at least one of extended inductive variables, loop variables, and loop invariants. The extended inductive variables are variables in the target loop body that have a mapping relationship with the basic inductive variables. The loop invariants are invariants in the target loop body that do not change due to changes in the loop index. The loop variables are other parameters in the target loop body that are different from the basic inductive variables, the extended inductive variables, and the loop invariants.
[0021] If the current value meets the preset loop exit condition and the preset loop exit condition is inconsistent with the loop termination condition of the target loop body, the target value of the basic inductive variable and the second semantic information of the associated parameter are determined based on the loop termination condition and the first semantic information of the associated parameter.
[0022] The procedural symbolic execution module is used to exit the target loop body, and based on the second semantic information of the target value and the associated parameters, perform symbolic execution on the code located after the target loop body in the target code to obtain the symbolic execution result corresponding to the target code.
[0023] According to one aspect of the embodiments of this application, a computer device is provided, the computer device including a processor and a memory, the memory storing at least one instruction, at least one program, a code set or an instruction set, the at least one instruction, the at least one program, the code set or instruction set being loaded and executed by the processor to implement the above-described symbolic code execution method.
[0024] According to one aspect of the embodiments of this application, a computer-readable storage medium is provided, wherein the storage medium stores at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by a processor to implement the above-described symbolic code execution method.
[0025] According to one aspect of the embodiments of this application, a computer program product is provided, the computer program product including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, causing the computer device to perform to implement the above-described symbolic code execution method.
[0026] The technical solution provided in this application can bring the following beneficial effects:
[0027] This application provides a code symbolic execution method, apparatus, storage medium, and computer device. This application is applicable to the field of static program analysis. Through in-depth analysis of the semantic information of various parameters in the target loop body, it can effectively reduce the loss of semantic information after exiting the target loop body, thereby improving the symbolic execution effect.
[0028] Specifically, upon encountering the loop entry point of the target loop body, the current value of the basic inductive variable can be extracted, and the target value of the basic inductive variable, i.e., the semantic information of the basic inductive variable, can be determined based on the loop termination condition. Subsequently, by partially expanding the target loop body, the first semantic information of related parameters such as the extended inductive variable, loop variable, and loop invariant within the target loop body can be extracted. After the target loop body is forcibly exited, the second semantic information of the related parameters can be determined based on the loop termination condition. Obviously, in this embodiment, after exiting the target loop body, the semantic information of the basic inductive variable and related parameters is obtained. This semantic information is still used for symbolic execution of subsequent code after the target loop body is exited, thereby reducing the semantics lost due to incomplete execution of the target loop body. The semantic information of the basic inductive variable and related parameters is used for symbolic execution of subsequent code, which can significantly improve the detection accuracy of assignment-sensitive memory safety defects such as memory leaks, uninitialized variables, and null pointer dereferencing in the target code, and comprehensively improve the symbolic execution effect. Attached Figure Description
[0029] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0030] Figure 1 This is a schematic diagram of a loop widening scheme in the related art provided in one embodiment of this application;
[0031] Figure 2 This is a schematic diagram of an application runtime environment provided in one embodiment of this application;
[0032] Figure 3 This is a flowchart of a code symbol execution method provided in one embodiment of this application;
[0033] Figure 4 This is a flowchart of a method for obtaining target value and second semantic information provided in one embodiment of this application;
[0034] Figure 5 This is a schematic diagram of the code symbol execution process provided in one embodiment of this application;
[0035] Figure 6 This is a schematic diagram comparing the symbol execution process of an embodiment of this application with related technologies, provided by one embodiment of this application.
[0036] Figure 7 This is a block diagram of a code symbol execution device provided in one embodiment of this application;
[0037] Figure 8 This is a structural block diagram of a computer device provided in one embodiment of this application. Detailed Implementation
[0038] Before detailing the code symbolic execution method of this application, the embodiments of this application briefly describe the symbolic execution methods of related technologies:
[0039] Please refer to the following text, which illustrates exemplary code proposed in an embodiment of this application. The code consists of 20 lines, as follows:
[0040]
[0041]
[0042] During symbolic execution, for the aforementioned example code, a data flow graph and abstract syntax tree are first established for the top-level root function `test`. Symbolic execution is then performed based on the data flow graph and abstract syntax tree. After each step is completed, the state of the parameters in the code is updated. Specifically:
[0043] Enter the function test;
[0044] Execute the code in Line 5 to initialize arrayCross and set its value to nullptr;
[0045] Execute the code in Line 6 to initialize the parameter s and set its value to 0;
[0046] Execute the for statement in Line 7 (enter the loop body), initialize the parameter i, and set its corresponding value to 0;
[0047] Execute the for loop control statement: if the condition i < 100 is true, jump to Line 8;
[0048] Execute the code in Line 8 to allocate memory space for the local variable newArray and set the state of the pointer newArray to "allocated";
[0049] Executing Line 13, arrayCross points to the memory space allocated to newArray, and the state of the pointer arrayCross is set to "allocated";
[0050] Executing Line 14 sets the value of the first element of the array, arrayCross[0], to 0;
[0051] Execute the code in Line 15, update the parameter s, assign the value 0 corresponding to i to s, and set the value of s to 0;
[0052] The `i++` operation in the `for` loop is executed, setting the value of `i` to 1.
[0053] The control statement of the for loop is executed. The condition i < 100 is met, so jump to Line 8.
[0054] Repeat the loop until the value of i is 100. The loop control condition i < 100 is false, and jump to Line 17.
[0055] Execute Line 17. At this point, the value of s is 99, so the branch condition s<99 is false, and execute Line 20.
[0056] Before exiting the test function after executing the code in Line 20, it was discovered that the pointer variable arrarCross was in the "allocated" state, generating a memory leak report.
[0057] The aforementioned example code includes a for loop body, which needs to be executed 100 times before exiting normally. Excessive loop execution can lead to path explosion. Path explosion occurs when branching statements in a program cause the current path to branch into new paths, resulting in an exponential increase in the height of the binary tree and causing the paths to grow "exponentially," thus causing "path explosion." Path explosion significantly increases the cost of symbolic execution, making it even difficult to implement. To address this problem, the following technical solutions can be used when performing symbolic execution on code including loop bodies:
[0058] Technical Solution 1: Limiting Loop Iterations. This solution only iterates a limited number of times within the loop body. Unexecuted loops are not further executed, and the semantics of parameters generated by unexecuted loops are discarded. The semantics of parameters within the loop are also discarded after exiting the loop. While this solution avoids fully expanding the loop, significantly reducing analysis time, the discarding of a large amount of semantics prevents the discovery of code defects that can only be identified based on these semantics, thus failing to achieve the expected symbolic execution.
[0059] Technical Solution Two: Loop Unrolling. Loop unrolling uses a heuristic algorithm to select the number of iterations and fully unrolls loops with small iteration counts. However, when the number of iterations is unknown at compile time or the number of iterations is too large for full unrolling, it is not substantially different from Technical Solution One and will also lose a lot of semantics.
[0060] Technical Solution 3: Loop Widening. Loop widening technology uses safe abstraction and approximate analysis to analyze the impact of loop iterations on the state of parameters within the loop during loop execution. This ensures efficient and scalable loop analysis, improving code execution coverage.
[0061] Please refer to Figure 1 The diagram illustrates a loop widening scheme in related technologies. The difference between loop widening and loop unrolling lies in the fact that, when the loop count is unknown at compile time or the loop count is too large for full unrolling, loop widening can collect the active parameter states and constant semantics within the loop body. Furthermore, it can exit the loop without fully unrolling the loop body, preserving the semantics of constant variables. The preserved constant semantics can be used for symbolic execution of other code following the loop body. Compared to technical solutions one and two, loop widening can preserve the semantics of constants after the loop body is exited; however, it still loses the semantics of many other parameters within the loop body. Therefore, it can still lead to omissions of assignment-sensitive memory safety defects such as memory leaks, uninitialized variables, and null pointer dereferencing, as well as incorrect symbolic execution results.
[0062] Taking the aforementioned exemplary code as an example, if loop widening is used, the critical point of loop control is analyzed as i == 100, resulting in two paths: i < 100 and i >= 100. On the path where i >= 100, loop widening can only clear the semantics of parameters other than constants. This leads to the "allocated" information of the local variable pointer type arrayCross being cleared when executing Line 16. When executing Line 20, the memory leak cannot be detected, and a symbolic execution result indicating a memory leak cannot be generated, thus resulting in the omission of a memory safety defect.
[0063] In summary, when performing symbolic execution, if loops are not fully unrolled, the related technologies will suffer significant loss of semantic information about the parameters within the loop body, leading to missed code defects and erroneous symbolic execution results. Therefore, this application provides a code symbolic execution method that can obtain a large amount of semantic information about the parameters within the loop body without requiring full loop unrolling, thereby significantly improving the accuracy of symbolic execution. In many cases, avoiding full loop unrolling can also reduce the computational cost and time complexity of symbolic execution.
[0064] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings. It should be noted that all data used in the embodiments of this application has been fully authorized by the relevant parties before use.
[0065] Please refer to Figure 2 This diagram illustrates an application runtime environment provided in one embodiment of this application under an exemplary implementation. The application runtime environment may include: terminal 10 and server 20.
[0066] Terminal 10 includes, but is not limited to, electronic devices such as mobile phones, computers, smart voice interaction devices, smart home appliances, in-vehicle terminals, game consoles, e-book readers, multimedia playback devices, and wearable devices. Application clients can be installed on terminal 10.
[0067] In this embodiment, the application described above can be any application that runs a symbolic code execution service and supports symbolic code execution. Typically, this application is a security application. Of course, besides security applications, other types of applications can also run symbolic code execution services and support symbolic code execution. For example, news applications, social applications, search applications, interactive entertainment applications, browser applications, shopping applications, content sharing applications, virtual reality (VR) applications, augmented reality (AR) applications, etc., are not limited in this embodiment. Optionally, the terminal 10 runs a client of the above-mentioned application.
[0068] Server 20 provides background services to clients of applications in terminal 10. For example, server 20 can be a background server for the aforementioned applications. Server 20 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Optionally, server 20 can simultaneously provide background services to applications in multiple terminals 10.
[0069] Optionally, terminal 10 and server 20 can communicate with each other via network 30. Terminal 10 and server 20 can be directly or indirectly connected via wired or wireless communication, which is not limited herein.
[0070] Please refer to Figure 3 The diagram illustrates a flowchart of a code symbol execution method according to an exemplary embodiment. This method can be applied to a computer device, which refers to an electronic device capable of data computation and processing. For example, the execution entity for each step can be... Figure 2The relevant devices in the application's runtime environment are shown. This method may include the following steps:
[0071] Step S301. Obtain the target code, which includes the target loop body.
[0072] This application does not limit the target code; it can be any code including a loop body. For example, the target code can be source code, IR, binary code, assembly code, etc. IR can be understood as a low-level programming language within a compiler framework, serving as an intermediate representation during the compilation process to represent programs written in high-level languages. The target loop body can be any loop body in the target code. This application does not limit the specific logic within the loop body, the loop termination condition, the number of loop bodies, or the position of the loop body, and this does not affect the implementation of the inventive concept of this application.
[0073] Step S302. Parse the target code to obtain the corresponding target abstract syntax tree and target data flow graph; based on the target abstract syntax tree, perform symbolic execution along the target data flow graph until the loop entry of the target loop body is reached.
[0074] Abstract syntax trees (ASTs) and data flow graphs are two important concepts in compiler design. An AST is a tree-like data structure used to represent the syntactic structure of code. Each node represents a construct in the code, such as an expression, statement, or declaration. ASTs are typically built during the compiler's syntax analysis phase for subsequent semantic analysis, optimization, and code generation. A data flow graph is a graphical representation used to show the flow and operations of variables in code. Data flow graphs are particularly useful during the compiler's optimization phase because they help analyze the program's control flow and data dependencies.
[0075] This application does not limit the generation process of the target abstract syntax tree and the target data flow graph; these can be automatically implemented based on a compiler or an engine with symbolic execution capabilities. The process of performing symbolic execution along the target data flow graph based on the target abstract syntax tree until the loop entry point of the target loop body is consistent with related technologies and will not be elaborated upon here.
[0076] Step S303. Obtain the current value of the basic inductive variable of the target loop body, wherein the basic inductive variable is the loop index of the target loop body.
[0077] The basic inductive variable is a variable within the target loop body that is updated with a fixed step size in each iteration. Therefore, the basic inductive variable can be understood as the loop index of the target loop body, used to control the number of iterations and track the current iteration process. Taking the aforementioned exemplary code as an example, parameter i is the basic inductive variable. In the aforementioned exemplary code, the current value of parameter i obtained in step S303 is 0, which can also be understood as the initial value.
[0078] Step S304. If the current value does not meet the preset loop exit condition, perform symbolic execution on the target loop body based on the current value to obtain the first semantic information of the associated parameters. The associated parameters include at least one of extended inductive variables, loop variables, and loop invariants. The extended inductive variables are variables in the target loop body that have a mapping relationship with the basic inductive variables. The loop invariants are invariants in the target loop body that do not change due to changes in the loop index. The loop variables are other parameters in the target loop body that are different from the basic inductive variables, the extended inductive variables, and the loop invariants.
[0079] If the loop count is known at compile time and is not very large, allowing for full expansion, this embodiment of the application can fully expand the target loop body, thereby performing symbolic execution of the code following the target loop body without any semantic loss. This process is consistent with related technologies and will not be elaborated here. However, if full expansion is not suitable, for example, when the loop termination condition indicates a particularly large loop count, the symbolic execution method of this embodiment differs significantly from related technologies. When full expansion is not suitable, the target loop body can be exited once the current value meets the preset loop exit condition, without needing to satisfy the loop termination condition.
[0080] In one exemplary embodiment, if the number of iterations indicated by the loop termination condition of the target loop exceeds a preset threshold, a preset loop exit condition is determined, wherein the number of iterations indicated by the preset loop exit condition is less than the number of iterations indicated by the loop termination condition. Taking the aforementioned exemplary code as an example, the preset loop exit condition can be i greater than or equal to 3, and the loop termination condition can be i greater than or equal to 100. Of course, this application does not limit the method for determining the preset loop exit condition and does not constitute an obstacle to implementation.
[0081] If the current value does not meet the preset loop exit condition, the target loop body needs to be executed. During this process, the first semantic information of the associated parameters and the current value of the basic inductive variable are continuously updated. In this embodiment, the associated parameters include at least one of extended inductive variables, loop variables, and loop invariants. These associated parameters are described in detail below:
[0082] Extended inductive variables: Extended inductive variables are variables in the target loop that have a mapping relationship with the basic inductive variables. As a parameter in the target loop, the extended inductive variable is updated in each iteration based on the semantics of the basic inductive variable or other extended inductive variables. Update methods include linear updates, polynomial updates, or nonlinear updates.
[0083] Linear Update: The semantics (value) of the extended inductive variable is updated linearly in each iteration. For example, x = a*i + b, where i is the base inductive variable or another extended inductive variable, and a and b are constants. In each iteration, the value of the extended inductive variable x is updated linearly according to the change in i.
[0084] Polynomial update: The update expression is a polynomial function of the base inductive variable or another extended inductive variable. For example, the extended inductive variable x = a*i^2 + b*i + c, where i is the base inductive variable or another extended inductive variable, and a, b, and c are constants.
[0085] Nonlinear update: The update expression is a nonlinear function of the basic inductive variable or another extended inductive variable. For example, the extended inductive variable x = a*sin(i) + b, where i is the basic inductive variable or another extended inductive variable, and a and b are constants.
[0086] Loop invariants: Loop invariants are invariants in the target loop body that do not change with the loop index. As a parameter of a condition or property in a loop, the semantics of a loop invariant remain unchanged at the beginning and end of each loop iteration; for example, it can always be true. They are often used to prove the correctness and termination of a loop.
[0087] Loop variable: The loop variable is any other parameter in the target loop body that is different from the basic inductive variable, the extended inductive variable, and the loop variable.
[0088] For each associated parameter, the corresponding first semantic information includes at least one of the following: semantic information for condition judgment, semantic information for indicating the range of variables, semantic information for indicating branch reachability, and semantic information for indicating memory allocation status.
[0089] Using the aforementioned exemplary code, and taking the preset loop exit condition of i being greater than or equal to 3 as an example, the execution process of step S304 is summarized as follows:
[0090] Entering the target loop body from the code in Line 7: the loop entry point of the for loop, the target loop body is expanded if the preset loop exit condition is not met.
[0091] During the first expansion, i == 0, and the preset loop exit condition is not met.
[0092] Executing the code in Line 7, the semantic information (current value) of the basic inductive variable i is obtained as: i = 0;
[0093] Execute the code in Line 8 to collect semantic information about the loop variable newArray based on the new statement: "allocated";
[0094] Execute the code in Line 13 to collect semantic information about the loop change arrayCross based on the assignment statement: "allocated";
[0095] Execute the code in Line 14 to collect the extended inductive variable arrayCross[0] and its semantic information based on the mapping relationship between the extended inductive variable and the basic inductive variable: arrayCross[0] = 0;
[0096] Execute the code in Line 15 to collect the extended inductive variable "s" and its semantic information based on the mapping relationship between the extended inductive variable and the basic inductive variable: s = i = 0;
[0097] The aforementioned process is repeated for the second and third expansions. After three expansions, the preset loop exit condition is met, and step S304 is no longer executed. Through the three expansions, the current value of the basic inductive variable i becomes 3, i.e., i = 3, which obviously does not yet meet the loop termination condition (i is greater than or equal to 99). The current value of the basic inductive variable i is obtained through the three expansions, i = {0, 1, 2}, and the first semantic information of the expanded inductive variable s is s = {0, 1, 2}.
[0098] Step S305. If the current value meets the preset loop exit condition and the preset loop exit condition is inconsistent with the loop termination condition of the target loop body, determine the target value of the basic inductive variable and the second semantic information of the associated parameter based on the loop termination condition and the first semantic information of the associated parameter.
[0099] Using the previous example, the current value of the basic inductive variable i becomes 3, i.e., i = 3. Obviously, the loop termination condition (i is greater than or equal to 99) is not yet met, but the preset loop exit condition (i is greater than or equal to 3) is met. In this case, step S305 is executed.
[0100] Please refer to Figure 4 The flowchart illustrates a method for obtaining a target value and second semantic information in an embodiment of this application. The step of determining the target value of the basic inductive variable and the second semantic information of the associated parameter based on the loop termination condition and the first semantic information of the associated parameter includes:
[0101] Step S401. Clear the current value of the basic inductive variable.
[0102] The current value of the basic inductive variable is the semantics of the basic inductive variable obtained without fully expanding the target loop body. This semantics is inaccurate, so it is removed.
[0103] Step S402. Determine the target value of the basic inductive variable according to the loop termination condition.
[0104] Unlike related technologies, this embodiment does not discard the semantics of the basic inductive variable after clearing it. Instead, it redetermines the target value of the basic inductive variable based on the loop termination condition and uses it as the latest semantics of the basic inductive variable after exiting the target loop. Taking the aforementioned exemplary code as an example, in step S305, the target value of the basic inductive variable i is i>=100.
[0105] Step S403. If the associated parameter includes the extended inductive variable, based on the target value of the basic inductive variable, update the first semantic information of the extended inductive variable to the corresponding second semantic information.
[0106] Unlike related technologies, this embodiment does not discard the semantics of the extended inductive variable after clearing it. Instead, it redetermines the target value of the basic inductive variable based on the loop termination condition, and then updates the second semantic information of the extended inductive variable based on the mapping relationship between the extended inductive variable and the basic inductive variable (related to the first semantic information of the extended inductive variable). Taking the aforementioned exemplary code as an example, in step S305, the second semantic information of the extended inductive variable s indicates s = i – 1.
[0107] Step S404. Take the first semantic information of the parameters other than the extended inductive variable in the associated parameters as the corresponding second semantic information.
[0108] In this embodiment, the target value and second semantic information of the basic inductive variable and extended inductive variable can be determined based on the loop termination condition. Furthermore, this embodiment proposes that even if the target loop body is not fully expanded, it does not affect the semantic information of the loop invariant and loop variable. Therefore, the first semantic information of the loop variable and loop invariant can be directly used as its second semantic information and will not be discarded after the target loop body exits, but will continue to be used for subsequent symbolic execution. Compared to related technologies that only retain constant semantics after loop widening, this embodiment updates the semantics of the basic inductive variable and extended inductive variable, while retaining the semantics of the loop invariant and loop variable, thereby avoiding a decrease in the accuracy of symbolic execution due to the loss of a large amount of semantics.
[0109] In an exemplary embodiment, before obtaining the current value of the basic inductive variable of the target loop body, the method further includes: determining active parameters based on the target abstract syntax tree and the target data flow graph, wherein the active parameters are parameters used both in the target loop body and in code following the target loop body. Determining the target value of the basic inductive variable and the second semantic information of the associated parameters based on the loop termination condition and the first semantic information of the associated parameters includes: determining the target value of the basic inductive variable based on the loop termination condition if the basic inductive variable belongs to the active parameter; and obtaining the second semantic information of the associated parameter based on the first semantic information of the associated parameter if any associated parameter belongs to the active parameter. In this implementation, only the semantic information of active parameters can be determined. If there are cases in the basic inductive variables, extended inductive variables, loop variables, or loop invariants that are not active parameters, there is no need to process their semantics or obtain their target values or second semantic information, because they are not used in the symbolic execution of subsequent code. By determining the active parameters, the semantic updates or retention of useless parameters of the target loop body are avoided, saving computational and storage resources.
[0110] Step S306. Exit the target loop body, and based on the second semantic information of the target value and the associated parameter, perform symbolic execution on the code located after the target loop body in the target code to obtain the symbolic execution result corresponding to the target code.
[0111] Taking the aforementioned exemplary code as an example, after the target loop body is exited, the semantic information of the loop change variable arrayCross: "allocated" is retained as the second semantic information. The second semantic information of the extended inductive variable s, indicating s = i - 1, and the target value of the basic inductive variable i, i >= 100, both form new constraints used to analyze the code located after the target loop body in the target code. Therefore, the latest semantics obtained before executing the code in Line 17 include: i >= 100, s = i - 1, arrayCross: "allocated";
[0112] Execute the code in Line 17. Based on i>=100 and s=i-1, determine that the condition s<99 is false, and jump to the code in Line 20.
[0113] Execute the code in Line 20, clean up local variables before exiting the function test, set the state of the loop variable arrayCross to "allocated", generate a memory leak report caused by the variable arrayCross, and use this report as the symbolic execution result corresponding to the target code.
[0114] Please refer to Figure 5 This diagram illustrates the code symbol execution process according to an embodiment of this application. Figure 1 A comparison with the symbolic execution diagrams of the related technologies' loop widening schemes shows that, in the embodiments of this application, when expanding the target loop body, the semantic information of the basic inductive variable, the extended inductive variable, the loop variable, and the loop invariant is calculated, and the relevant semantic information is updated after exiting the target loop body, thereby forming new constraints for subsequent symbolic execution, without discarding a large amount of semantics. This is consistent with... Figure 1 There are significant differences. The embodiments of this application collect semantic information on the basic inductive variables, extended inductive variables based on the basic inductive variables, loop invariants, and loop variables of the target loop body. When the target loop body is not fully expanded, these semantics are updated as much as possible and the accurate semantics are preserved, which effectively reduces semantic loss and improves the detection accuracy of symbolic execution for memory safety defects.
[0115] Clearly, this embodiment employs a more refined strategy when handling the exit of the target loop: it only clears the inaccurate state of the inductive variables (the current value of the basic inductive variable and the first semantic information of the extended inductive variable), rather than conservatively clearing the semantics of all parameters of the target loop except for constant semantics. This strategy preserves more semantics, avoids redundant calculations, and more accurately reflects the actual running state of the program, thereby improving the detection accuracy of assignment-sensitive memory safety defects such as memory leaks, uninitialized variables, and null pointer dereferencing. This not only improves the efficiency of code defect detection but also reduces the possibility of false positives and false negatives.
[0116] The second semantic information used in this application embodiment for symbolic execution of code following the target loop body can include various semantics for conditional judgment, indicating variable range, and indicating branch reachability. This not only improves the understanding and analysis of the target code but also enhances the ability to predict and control the behavior of the target code. In an exemplary embodiment, the symbolic execution of code following the target loop body in the target code, based on the target value of the basic inductive variable and the second semantic information of the associated parameters, to obtain the symbolic execution result corresponding to the target code, includes:
[0117] (1) If the second semantic information of the associated parameter includes semantic information for indicating memory allocation, a symbolic execution result indicating whether there is a memory leak is obtained based on the second semantic information of the associated parameter.
[0118] Taking the aforementioned exemplary code as an example, the state of the loop variable arrayCross is "allocated," which is a semantic information used to indicate the memory allocation status, thereby indicating whether there is a memory leak.
[0119] (2) If the second semantic information of the associated parameter includes semantic information for indicating branch reachability, a symbolic execution result indicating whether there is a branch that is unreachable is obtained based on the second semantic information of the associated parameter.
[0120] Please refer to the following code example:
[0121]
[0122] During the symbolic execution of this code example, the embodiments of this application can retain the false information of the loop invariant flag, and unreachable code can be detected, thereby detecting the dead code of Line 12, that is, Line 12 is dead code and cannot be executed.
[0123] (3) If the second semantic information of the associated parameter includes semantic information for indicating the range of variables, a symbolic execution result indicating whether a null pointer reference defect exists is obtained based on the second semantic information of the associated parameter.
[0124] Please refer to the following code example:
[0125]
[0126]
[0127] Based on this code example, using the symbolic execution method of this application embodiment, the variable range of the associated parameter arrayCross can be obtained as [0, ARRAY_LEN_MAX-1] by partially expanding the target loop body. The variable range of the associated parameter arrayCross is independent of the basic inductive variable i. When Line 13 exits the target loop body, the variable range of the associated parameter arrayCross, [0, ARRAY_LEN_MAX-1], is retained as a second semantic information, which can be used to determine that Line 15 does not have a memory out-of-bounds error and does not have a null pointer reference defect. However, if the loop expansion scheme of related technologies is used directly without using the embodiment of this application, the variable range of arrayCross will be cleared after exiting the target loop body if the target loop body is not fully expanded. In this case, the obtained arrayCross semantic information will be in an empty state. When this semantic information is used to execute Line 15, it will be mistakenly interpreted as a memory out-of-bounds error, thus generating a false alarm of symbolic execution.
[0128] In this embodiment, a preset loop exit condition is used to control the actual number of iterations when the target loop body is not fully expanded. This application does not limit the method for setting the preset loop exit condition and does not constitute an obstacle to implementation. In the preceding text, this embodiment uses i greater than or equal to 3 as the preset loop exit condition. In fact, the preset loop exit condition does not necessarily have to be based on a fixed value; it can also be constructed through simple or complex expressions or algorithms, as long as the purpose of exiting the loop body before it is fully expanded is achieved.
[0129] In one exemplary implementation, the branch execution conditions corresponding to each conditional branch in the target loop body can be obtained; the target branch execution conditions can be determined, wherein the target branch execution conditions are the branch execution conditions related to the basic inductive variables; and the preset loop exit conditions can be determined based on the target branch execution conditions. In this implementation, the preset loop exit conditions can be set with improving code coverage as a constraint. Code coverage refers to the proportion and degree to which code is tested; the resulting proportion is called code coverage. By setting preset loop exit conditions, the basic inductive variables can satisfy as many target branch execution conditions as possible, allowing more branches to be executed, thereby maximizing code coverage.
[0130] Please refer to the following code example:
[0131]
[0132]
[0133] When performing symbolic execution based on this code example, if the preset loop exit condition is i > 2, the target loop will be exited when i > 2, and Line 9 and Line 10 cannot be executed. The target branch execution condition corresponding to Line 9 and Line 10 is Line 8. Therefore, the preset loop exit condition can be set according to i > 2 in Line 8, so that Line 9 and Line 10 can still be executed at least once when i > 2, and then the target loop will exit. For example, the preset loop exit condition can be set to i > 3.
[0134] Please refer to Figure 6The diagram illustrates a comparison of the symbolic execution process between embodiments of this application and related technologies. The loop unrolling factor in related technologies, equivalent to a preset loop exit condition, is determined based on the number of parameters such as loop invariants, inductive variables, and loop variables. In contrast, the preset loop exit condition in this application is determined based on the target branch execution condition. Furthermore, related technologies can only retain the number of registers after exiting the target loop body, completely failing to obtain the latest semantics of basic inductive variables, extended inductive variables, loop invariants, and loop variables, and thus cannot perform code analysis based on these semantics.
[0135] The following are embodiments of the apparatus of this application, which can be used to execute embodiments of the method of this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the method of this application.
[0136] Please refer to Figure 7 The diagram illustrates a block diagram of a code symbolic execution apparatus according to an exemplary embodiment. This apparatus has the function of implementing the above-described code symbolic execution method; this function can be implemented in hardware or by hardware executing corresponding software. The apparatus can be a computer device or can be disposed within a computer device. The apparatus may include:
[0137] The code acquisition module 701 is used to acquire target code, the target code including a target loop body;
[0138] Code parsing module 702 is used to parse the target code to obtain the corresponding target abstract syntax tree and target data flow graph;
[0139] The loop symbol execution module 703 is used to perform the following operations:
[0140] Based on the target abstract syntax tree, symbolic execution is performed along the target data flow graph until the loop entry point of the target loop body is reached.
[0141] Obtain the current value of the basic inductive variable of the target loop body, where the basic inductive variable is the loop index of the target loop body;
[0142] If the current value does not meet the preset loop exit condition, symbolic execution is performed on the target loop body based on the current value to obtain the first semantic information of the associated parameters. The associated parameters include at least one of extended inductive variables, loop variables, and loop invariants. The extended inductive variables are variables in the target loop body that have a mapping relationship with the basic inductive variables. The loop invariants are invariants in the target loop body that do not change due to changes in the loop index. The loop variables are other parameters in the target loop body that are different from the basic inductive variables, the extended inductive variables, and the loop invariants.
[0143] If the current value meets the preset loop exit condition and the preset loop exit condition is inconsistent with the loop termination condition of the target loop body, the target value of the basic inductive variable and the second semantic information of the associated parameter are determined based on the loop termination condition and the first semantic information of the associated parameter.
[0144] The process-oriented symbolic execution module 704 is used to exit the target loop body, and perform symbolic execution on the code located after the target loop body in the target code based on the second semantic information of the target value and the associated parameters, so as to obtain the symbolic execution result corresponding to the target code.
[0145] In one exemplary embodiment, the loop symbol execution module 703 is configured to perform the following operations: update the current value based on the target loop body; the first semantic information includes at least one of semantic information for condition judgment, semantic information for indicating variable range, semantic information for indicating branch reachability, and semantic information for indicating memory allocation status.
[0146] In one exemplary embodiment, the loop symbol execution module 703 is configured to perform the following operations:
[0147] Clear the current value of the basic inductive variable;
[0148] Based on the loop termination condition, determine the target value of the basic inductive variable;
[0149] When the associated parameter includes the extended inductive variable, the first semantic information of the extended inductive variable is updated to the corresponding second semantic information based on the target value of the basic inductive variable;
[0150] The first semantic information of the parameters other than the extended inductive variable in the associated parameters is taken as the corresponding second semantic information.
[0151] In one exemplary embodiment, the loop symbol execution module 703 is configured to perform the following operations:
[0152] Based on the target abstract syntax tree and the target data flow graph, active parameters are determined, which are parameters used both in the target loop body and in the code following the target loop body;
[0153] If the basic inductive variable belongs to the active parameter, the target value of the basic inductive variable is determined based on the loop termination condition;
[0154] If any associated parameter belongs to the active parameter, the second semantic information of the associated parameter is obtained based on the first semantic information of the associated parameter.
[0155] In one exemplary embodiment, if the number of cycles indicated by the cycle termination condition of the target loop exceeds a preset threshold, a preset loop exit condition is determined, wherein the number of cycles indicated by the preset loop exit condition is less than the number of cycles indicated by the cycle termination condition.
[0156] In one exemplary embodiment, the loop symbol execution module 703 is configured to perform the following operations:
[0157] Obtain the branch execution conditions corresponding to each conditional branch in the target loop body;
[0158] Determine the target branch execution conditions, which are the branch execution conditions related to the basic inductive variables;
[0159] Based on the target branch execution conditions, the preset loop exit conditions are determined.
[0160] In one exemplary embodiment, the procedural symbol execution module 704 is configured to perform the following operations:
[0161] When the second semantic information of the associated parameter includes semantic information for indicating memory allocation, a symbolic execution result indicating whether a memory leak exists is obtained based on the second semantic information of the associated parameter.
[0162] When the second semantic information of the associated parameter includes semantic information for indicating branch reachability, a symbolic execution result indicating whether there is a branch that is unreachable is obtained based on the second semantic information of the associated parameter;
[0163] When the second semantic information of the associated parameter includes semantic information for indicating the range of variables, a symbolic execution result indicating whether a null pointer reference defect exists is obtained based on the second semantic information of the associated parameter.
[0164] It should be noted that the apparatus provided in the above embodiments is only illustrated by the division of the above functional modules when implementing its functions. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.
[0165] Please refer to Figure 8 It illustrates a structural block diagram of a computer device according to an exemplary embodiment for performing the above-described code symbolic execution method. Specifically:
[0166] Computer device 800 includes a central processing unit (CPU) 801, a system memory 804 including random access memory (RAM) 802 and read-only memory (ROM) 803, and a system bus 805 connecting the system memory 804 and the CPU 801. Computer device 800 also includes a basic input / output system (I / O system) 806 that facilitates information transfer between various devices within the computer, and a mass storage device 807 for storing the operating system 813, application programs 814, and other program modules 815.
[0167] The basic input / output system 806 includes a display 808 for displaying information and an input device 809 for user input, such as a mouse or keyboard. Both the display 808 and the input device 809 are connected to the central processing unit 801 via an input / output controller 810 connected to the system bus 805. The basic input / output system 806 may also include the input / output controller 810 for receiving and processing input from multiple other devices such as a keyboard, mouse, or electronic stylus. Similarly, the input / output controller 810 also provides output to a display screen, printer, or other types of output devices.
[0168] Mass storage device 807 is connected to central processing unit 801 via a mass storage controller (not shown) connected to system bus 805. Mass storage device 807 and its associated computer-readable media provide non-volatile storage for computer device 800. That is, mass storage device 807 may include computer-readable media (not shown) such as hard disk or CD-ROM (CompactDisc Read-Only Memory) drive.
[0169] Without loss of generality, computer-readable media can include computer storage media and communication media. Computer storage media includes volatile and non-volatile, removable and non-removable media implemented using any method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. Computer storage media include RAM, ROM, EPROM (Erasable Programmable Read Only Memory), EEPROM (Electrically Erasable Programmable Read Only Memory), flash memory or other solid-state storage technologies, CD-ROM, DVD (Digital Video Disc) or other optical storage, magnetic tape cassettes, magnetic tape, disk storage, or other magnetic storage devices. Of course, those skilled in the art will recognize that computer storage media are not limited to the above-mentioned types. The system memory 804 and mass storage device 807 described above can be collectively referred to as memory.
[0170] According to various embodiments of this application, the computer device 800 can also be connected to a remote computer on a network, such as the Internet, for operation. That is, the computer device 800 can be connected to a network 812 via a network interface unit 811 connected to the system bus 805, or the network interface unit 811 can be used to connect to other types of networks or remote computer systems (not shown).
[0171] The aforementioned memory also includes a computer program stored in the memory and configured to be executed by one or more processors to implement the aforementioned code symbol execution method.
[0172] In an exemplary embodiment, a computer-readable storage medium is also provided, wherein at least one instruction, at least one program, code set, or instruction set is stored therein, wherein the at least one instruction, at least one program, code set, or instruction set is executed by a processor to implement the code symbolic execution method.
[0173] Specifically, the code symbol execution method includes:
[0174] Obtain the target code, which includes the target loop body;
[0175] The target code is parsed to obtain the corresponding target abstract syntax tree and target data flow graph;
[0176] Based on the target abstract syntax tree, symbolic execution is performed along the target data flow graph until the loop entry point of the target loop body is reached.
[0177] Obtain the current value of the basic inductive variable of the target loop body, where the basic inductive variable is the loop index of the target loop body;
[0178] If the current value does not meet the preset loop exit condition, symbolic execution is performed on the target loop body based on the current value to obtain the first semantic information of the associated parameters. The associated parameters include at least one of extended inductive variables, loop variables, and loop invariants. The extended inductive variables are variables in the target loop body that have a mapping relationship with the basic inductive variables. The loop invariants are invariants in the target loop body that do not change due to changes in the loop index. The loop variables are other parameters in the target loop body that are different from the basic inductive variables, the extended inductive variables, and the loop invariants.
[0179] If the current value meets the preset loop exit condition and the preset loop exit condition is inconsistent with the loop termination condition of the target loop body, the target value of the basic inductive variable and the second semantic information of the associated parameter are determined based on the loop termination condition and the first semantic information of the associated parameter.
[0180] Exiting the target loop, based on the second semantic information of the target value and the associated parameter, symbolic execution is performed on the code in the target code located after the target loop to obtain the symbolic execution result corresponding to the target code.
[0181] In an exemplary embodiment, after performing symbolic execution on the target loop body based on the current value to obtain the first semantic information of the associated parameters when the current value does not meet the preset loop exit condition, the method further includes: updating the current value based on the target loop body;
[0182] The first semantic information includes at least one of the following: semantic information for condition judgment, semantic information for indicating the range of variables, semantic information for indicating branch reachability, and semantic information for indicating memory allocation status.
[0183] In one exemplary implementation, determining the target value of the basic inductive variable and the second semantic information of the associated parameter based on the loop termination condition and the first semantic information of the associated parameter includes:
[0184] Clear the current value of the basic inductive variable;
[0185] Based on the loop termination condition, determine the target value of the basic inductive variable;
[0186] When the associated parameter includes the extended inductive variable, the first semantic information of the extended inductive variable is updated to the corresponding second semantic information based on the target value of the basic inductive variable;
[0187] The first semantic information of the parameters other than the extended inductive variable in the associated parameters is taken as the corresponding second semantic information.
[0188] In one exemplary implementation, before obtaining the current value of the underlying inductive variable of the target loop body, the method further includes:
[0189] Based on the target abstract syntax tree and the target data flow graph, active parameters are determined, which are parameters used both in the target loop body and in the code following the target loop body;
[0190] The determination of the target value of the basic inductive variable and the second semantic information of the associated parameter based on the loop termination condition and the first semantic information of the associated parameter includes:
[0191] If the basic inductive variable belongs to the active parameter, the target value of the basic inductive variable is determined based on the loop termination condition;
[0192] If any associated parameter belongs to the active parameter, the second semantic information of the associated parameter is obtained based on the first semantic information of the associated parameter.
[0193] In one exemplary embodiment, the method further includes:
[0194] If the number of cycles indicated by the cycle termination condition of the target loop exceeds a preset threshold, a preset loop exit condition is determined, wherein the number of cycles indicated by the preset loop exit condition is less than the number of cycles indicated by the cycle termination condition.
[0195] In one exemplary implementation, determining the preset loop exit condition includes:
[0196] Obtain the branch execution conditions corresponding to each conditional branch in the target loop body;
[0197] Determine the target branch execution conditions, which are the branch execution conditions related to the basic inductive variables;
[0198] Based on the target branch execution conditions, the preset loop exit conditions are determined.
[0199] In one exemplary implementation, the symbolic execution of the code following the target loop in the target code, based on the target value of the basic inductive variable and the second semantic information of the associated parameter, to obtain the symbolic execution result corresponding to the target code, includes:
[0200] When the second semantic information of the associated parameter includes semantic information for indicating memory allocation, a symbolic execution result indicating whether a memory leak exists is obtained based on the second semantic information of the associated parameter.
[0201] When the second semantic information of the associated parameter includes semantic information for indicating branch reachability, a symbolic execution result indicating whether there is a branch that is unreachable is obtained based on the second semantic information of the associated parameter;
[0202] When the second semantic information of the associated parameter includes semantic information for indicating the range of variables, a symbolic execution result indicating whether a null pointer reference defect exists is obtained based on the second semantic information of the associated parameter.
[0203] Optionally, the computer-readable storage medium may include: ROM (Read Only Memory), RAM (Random Access Memory), SSD (Solid State Drives), or optical disc, etc. The random access memory may include ReRAM (Resistance Random Access Memory) and DRAM (Dynamic Random Access Memory).
[0204] In an exemplary embodiment, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the aforementioned code symbolic execution method.
[0205] It should be understood that "multiple" as used herein refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. Furthermore, the step numbers described herein are merely illustrative of one possible execution order. In some other embodiments, the steps may not be executed in numerical order, such as two steps with different numbers being executed simultaneously, or two steps with different numbers being executed in the reverse order of the illustration. This application does not limit this.
[0206] In addition, in the specific embodiments of this application, data such as user information are involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.
[0207] The above are merely exemplary embodiments of this application and are not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application shall be included within the protection scope of this application.
Claims
1. A method of code symbol execution, characterized by, The method includes: Obtain the target code, which includes the target loop body; The target code is parsed to obtain the corresponding target abstract syntax tree and target data flow graph; Based on the target abstract syntax tree, symbolic execution is performed along the target data flow graph until the loop entry point of the target loop body is reached. Obtain the current value of the basic inductive variable of the target loop body, where the basic inductive variable is the loop index of the target loop body; If the current value does not meet the preset loop exit condition, symbolic execution is performed on the target loop body based on the current value to obtain the first semantic information of the associated parameters. The associated parameters include at least one of extended inductive variables, loop variables, and loop invariants. The extended inductive variables are variables in the target loop body that have a mapping relationship with the basic inductive variables. The loop invariants are invariants in the target loop body that do not change due to changes in the loop index. The loop variables are other parameters in the target loop body that are different from the basic inductive variables, the extended inductive variables, and the loop invariants. If the current value meets the preset loop exit condition and the preset loop exit condition is inconsistent with the loop termination condition of the target loop body, the target value of the basic inductive variable and the second semantic information of the associated parameter are determined based on the loop termination condition and the first semantic information of the associated parameter. Exiting the target loop, based on the second semantic information of the target value and the associated parameter, symbolic execution is performed on the code in the target code located after the target loop to obtain the symbolic execution result corresponding to the target code.
2. The method of claim 1, wherein, After performing symbolic execution on the target loop body based on the current value to obtain the first semantic information of the associated parameters when the current value does not meet the preset loop exit condition, the method further includes: updating the current value based on the target loop body; The first semantic information includes at least one of semantic information for condition judgment, semantic information for indicating the range of variables, semantic information for indicating branch reachability, and semantic information for indicating memory allocation status.
3. The method according to claim 1 or 2, characterized in that, The determination of the target value of the basic inductive variable and the second semantic information of the associated parameter based on the loop termination condition and the first semantic information of the associated parameter includes: Clear the current value of the basic inductive variable; Based on the loop termination condition, determine the target value of the basic inductive variable; When the associated parameter includes the extended inductive variable, the first semantic information of the extended inductive variable is updated to the corresponding second semantic information based on the target value of the basic inductive variable; The first semantic information of the parameters other than the extended inductive variable in the associated parameters is taken as the corresponding second semantic information.
4. The method of claim 1, wherein, Before obtaining the current value of the underlying inductive variable of the target loop body, the method further includes: Based on the target abstract syntax tree and the target data flow graph, active parameters are determined, which are parameters used both in the target loop body and in the code following the target loop body; The determination of the target value of the basic inductive variable and the second semantic information of the associated parameter based on the loop termination condition and the first semantic information of the associated parameter includes: If the basic inductive variable belongs to the active parameter, the target value of the basic inductive variable is determined based on the loop termination condition; If any associated parameter belongs to the active parameter, the second semantic information of the associated parameter is obtained based on the first semantic information of the associated parameter.
5. The method according to claim 1, characterized in that, The method further includes: If the number of cycles indicated by the cycle termination condition of the target loop exceeds a preset threshold, a preset loop exit condition is determined, wherein the number of cycles indicated by the preset loop exit condition is less than the number of cycles indicated by the cycle termination condition.
6. The method according to claim 5, characterized in that, Determining the preset loop exit condition includes: Obtain the branch execution conditions corresponding to each conditional branch in the target loop body; Determine the target branch execution conditions, which are the branch execution conditions related to the basic inductive variables; Based on the target branch execution conditions, the preset loop exit conditions are determined.
7. The method of claim 2, wherein, Based on the target value of the basic inductive variable and the second semantic information of the associated parameter, symbolic execution is performed on the code following the target loop in the target code to obtain the symbolic execution result corresponding to the target code, including: When the second semantic information of the associated parameter includes semantic information for indicating memory allocation, a symbolic execution result indicating whether a memory leak exists is obtained based on the second semantic information of the associated parameter. When the second semantic information of the associated parameter includes semantic information for indicating branch reachability, a symbolic execution result indicating whether there is a branch that is unreachable is obtained based on the second semantic information of the associated parameter; When the second semantic information of the associated parameter includes semantic information for indicating the range of variables, a symbolic execution result indicating whether a null pointer reference defect exists is obtained based on the second semantic information of the associated parameter.
8. A code symbol execution apparatus, characterized by comprising: The device includes: The code acquisition module is used to acquire target code, which includes a target loop body. The code parsing module is used to parse the target code to obtain the corresponding target abstract syntax tree and target data flow graph; The loop symbol execution module is used to perform the following operations: Based on the target abstract syntax tree, symbolic execution is performed along the target data flow graph until the loop entry point of the target loop body is reached. Obtain the current value of the basic inductive variable of the target loop body, where the basic inductive variable is the loop index of the target loop body; If the current value does not meet the preset loop exit condition, symbolic execution is performed on the target loop body based on the current value to obtain the first semantic information of the associated parameters. The associated parameters include at least one of extended inductive variables, loop variables, and loop invariants. The extended inductive variables are variables in the target loop body that have a mapping relationship with the basic inductive variables. The loop invariants are invariants in the target loop body that do not change due to changes in the loop index. The loop variables are other parameters in the target loop body that are different from the basic inductive variables, the extended inductive variables, and the loop invariants. If the current value meets the preset loop exit condition and the preset loop exit condition is inconsistent with the loop termination condition of the target loop body, the target value of the basic inductive variable and the second semantic information of the associated parameter are determined based on the loop termination condition and the first semantic information of the associated parameter. The procedural symbolic execution module is used to exit the target loop body, and based on the second semantic information of the target value and the associated parameters, perform symbolic execution on the code located after the target loop body in the target code to obtain the symbolic execution result corresponding to the target code.
9. A computer device, comprising: The computer device includes a processor and a memory, the memory storing at least one instruction, at least one program, a code set, or an instruction set, the at least one instruction, the at least one program, the code set, or the instruction set being loaded and executed by the processor to implement the code symbolic execution method as described in any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that, The storage medium stores at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by a processor to implement the code symbolic execution method as described in any one of claims 1 to 7.
11. A computer program product, characterised in that, The computer program product includes computer instructions, the processor of the computer device reads the computer instructions, and the processor of the computer device executes the computer instructions to implement the code symbol execution method as described in any one of claims 1 to 7.