Time-type memory security detection method, apparatus, and computing device cluster

Abstract

A time-type memory security detection method, comprising: on the basis of a source code, obtaining a plurality of analysis units each comprising a function or a function group; performing state analysis on the state of a memory block to which a pointer in the analysis units points, wherein the plurality of analysis units comprise a first analysis unit and a second analysis unit, the first analysis unit contains a function call statement used for calling the second analysis unit, and when the function call statement is being analyzed, digest information of the second analysis unit is used to perform state analysis on the state of the memory block to which the pointer associated with the function call statement points, the digest information of the analysis unit being used for describing the memory state of the memory block to which an entry and exit pointer in the analysis units points when the memory block enters and exits the analysis units; and, according to a state analysis result corresponding to the analysis units, generating digest information of the analysis units, and obtaining a detection result related to time-type memory problems in the analysis units. Thus, the resource overhead and the false and missing report rate are reduced during detection of time-type memory problems.

Description

A time-based memory security detection method, device, and computing device cluster

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of China on July 26, 2023, with application number 202310929124.7 and application name “A time-based memory security detection method, device and computing device cluster”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of information technology (IT), and in particular to a time-based memory security detection method, apparatus, and computing device cluster. Background Art

[0003] Currently, a large portion of the vulnerabilities addressed in annual updates for operating systems, browsers, and other products are caused by memory safety issues. Memory safety issues can include timing-related issues (such as memory leaks, use-after-free, and double-free). Timing-related memory issues refer to memory safety issues caused by violations of safe timing rules during memory operations, such as memory leaks, double-free, and use-after-free. In the industry-recognized Common Weakness Enumeration (CWE) top issue analysis, use-after-free issues (including double-free) ranked 7th, and memory leaks ranked 36th. This shows that timing-related memory issues are a significant industry challenge. However, software programs and applications susceptible to timing-related memory issues, including network equipment, operating system kernels, browsers, audio and video processing, and databases, have grown in size over decades and face strong security demands. This places high demands on the resource overhead and false positive rate required to detect timing-related memory issues. Therefore, reducing resource overhead and false negative rate when detecting timing-related memory issues is a pressing technical challenge.

[0004] Summary of the Invention

[0005] The present application provides a time-related memory security detection method, apparatus, computing device cluster, computer storage medium, and computer product, which can reduce resource overhead and false alarm rate when detecting time-related memory problems.

[0006] In a first aspect, the present application provides a method for detecting time-related memory safety, comprising: obtaining multiple analysis units based on source code, each analysis unit including a function or a function group; performing state analysis on the state of the memory block pointed to by a pointer in the analysis unit, wherein the multiple analysis units include a first analysis unit and a second analysis unit, the first analysis unit including a function call statement for calling the second analysis unit; upon analyzing the function call statement, using summary information from the second analysis unit, performing state analysis on the state of the memory block pointed to by the pointer associated with the function call statement; the summary information of the analysis unit is used to describe the memory state of the memory block pointed to by the input and output pointers in the analysis unit when entering and exiting the analysis unit; generating summary information for the analysis unit based on the state analysis results corresponding to the analysis unit, and obtaining detection results related to time-related memory issues in the analysis unit. Exemplarily, the input and output pointers can be pointers associated with formal parameters, global variables, and return values. Exemplarily, the source code can be, but is not limited to, code written by developers.

[0007] In this way, when detecting time-related memory issues, by partitioning the source code, the memory behavior between different analysis units can be decoupled. This allows for separate analysis of whether time-related memory issues exist in each analysis unit, avoiding global analysis and thus reducing resource overhead. Furthermore, by using the summary information of the analysis unit, calling behavior exists between analysis units, and when analyzing the caller, the summary information of the callee can be directly queried without having to analyze the internal memory behavior of the callee, reducing the amount of analysis and improving analysis efficiency. At the same time, during the detection process, the summary information can be used to analyze memory behavior across analysis units, thus enabling cross-analysis unit memory behavior detection and reducing the false positive rate. Furthermore, the summary information of the analysis unit includes the status of the memory blocks corresponding to the pointers associated with formal parameters, global variables, and return values. This allows the summary information to include all information about the analysis unit's interaction with the outside world, thereby reducing the loss between the summary information of the analysis unit and the actual memory behavior within the analysis unit.

[0008] In one possible implementation, performing a state analysis on the state of the memory block pointed to by the pointer in the analysis unit includes iteratively performing a state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein, during a current iteration, summary information generated in a previous iteration is used to perform a state analysis on the state of the memory block pointed to by the pointer in the analysis unit. Exemplarily, the current iteration may be the most recent iteration. For example, if the most recent iteration is the fifth iteration, then the fifth iteration is the current iteration. Furthermore, if the current iteration is the i-th iteration, then the previous iteration is the i-1-th iteration.

[0009] Based on the state analysis results corresponding to the state analysis, summary information of the analysis unit is generated, and detection results related to time-related memory problems in the analysis unit are obtained, including: during the iteration process, based on the state analysis results obtained in the current round of iteration, identifying time-related memory problems existing in the analysis unit and updating the summary information of the analysis unit; and, when the summary information of multiple analysis units will no longer be updated, the time-related memory problems existing in multiple analysis units identified during the last round of iteration are used as the final detection results.

[0010] In this way, through iterative analysis, the summary information of all analysis units can eventually reach a stable state, that is, they are no longer updated. At this time, since no benefits can be obtained from the iteration, it can be ended. At the same time, it can be considered that the summary information generated by the last iteration is correct, so the time-related memory problems identified at this time are also accurate. In this way, the time-related memory problems identified during the last round of iterations are used as the final detection results, which can improve the accuracy of the detection. In addition, by constructing the summary information and iteratively using the summary information obtained in the previous round, it is not necessary to construct a call graph that describes the call relationship between all analysis units, which eliminates the need to consider the analysis order between the analysis units. At the same time, since global pointer analysis is required to construct the call graph, the resource overhead consumed is relatively large. However, in this application, since there is no need to construct a call graph, the resource overhead can be greatly reduced.

[0011] In one possible implementation, a state analysis is performed on the state of the memory block pointed to by the pointer in the analysis unit, including: based on a preset state transition rule, traversing the statements in the analysis unit, and performing a state analysis on the state of the memory block pointed to by the pointer in the analysis unit. The state transition rule is used to describe the state change rule of the memory block pointed to by the first pointer when the first pointer is assigned a value or the first pointer is used. In this way, by traversing the statements in the analysis unit according to the state transition rule, the state analysis of the memory block pointed to by the pointer can be achieved. In addition, during the analysis process, memory allocation points, memory release points, and memory use points can be identified through function statements, thereby solving the time-related memory problems of repeated release and reuse after release.

[0012] In one possible implementation, based on the state analysis result corresponding to the state analysis, a time-related memory problem existing in the analysis unit is identified, specifically including: when the state analysis result indicates that the state of the memory block is a terminated state, determining that the statements related to the memory block in the analysis unit have a time-related memory problem, and, based on the type of the terminated state, determining the error type and error statement, wherein the terminated state is used to indicate that the memory block is not used correctly, the error type includes: one or more of repeated release, memory leak, and reuse after release, and the error statement includes: one or more of memory allocation statement, memory use statement, and memory release statement; when the state analysis result indicates that the state of the memory block is an intermediate state, determining that the statements related to the memory block in the analysis unit do not have a time-related memory problem, and the intermediate state is used to indicate that the memory block is being used correctly. Thus, the state analysis result can be used to analyze whether there is a time-related memory problem.

[0013] In a possible implementation, the summary information of the analysis unit includes summary information of pointers associated with formal parameters, global variables, and return values ​​in the analysis unit, where the pointers associated with formal parameters, global variables, and return values ​​include the second pointer.

[0014] The summary information of the second pointer includes one or more of the following: the identifier of the second pointer, the position of the formal parameters, global variables or return values ​​associated with the second pointer in the analysis unit, the relationship between the second pointer and the formal parameters, global variables and return values ​​in the analysis unit, the state of the memory block pointed to by the second pointer when entering or exiting the analysis unit, or the alias and non-alias relationship between the second pointer and the pointers associated with the formal parameters, global variables and return values ​​in the analysis unit other than the second pointer. In this way, the summary information can include all the information of the analysis unit interacting with the outside world, thereby reducing the loss between the summary information of the analysis unit and the actual memory behavior within the analysis unit.

[0015] In one possible implementation, the input and output pointers in the analysis unit may include one or more of the following: pointers associated with formal parameters or return values ​​and brought into or out of the analysis unit, or global variables, or pointers associated with global variables and brought into or out of the analysis unit by global variables. This allows the summary information to include all information about the analysis unit's interactions with the outside world, thereby reducing the loss between the analysis unit's summary information and the actual memory behavior within the analysis unit.

[0016] In one possible implementation, before analyzing the state of the memory block pointed to by the pointer in the analysis unit, the method further includes: if multiple branches in the control flow graph of the analysis unit point to the same node, normalizing the states of the memory blocks pointed to by the pointers from the multiple branches. This ensures that the states of the memory blocks pointed to by the pointers from these branches are unique, reducing the false positive rate.

[0017] In one possible implementation, the states of the memory blocks pointed to by pointers from multiple different branches are normalized. Specifically, this includes converting ordinal pointers in the multiple different branches into null pointers. The state of the memory blocks pointed to by the null pointers can be any state. This achieves state normalization.

[0018] In a possible implementation, before analyzing the state of the memory block pointed to by the pointer in the analysis unit, the method further includes: eliminating redundant paths in the analysis unit, thereby improving detection efficiency and reducing false positive rate.

[0019] In one possible implementation, eliminating redundant paths in the analysis unit includes one or more of the following:

[0020] In the case where a dominating and post-dominating relationship exists between a memory allocation point and a release point of the memory block pointed to by the second pointer in the analysis unit, determining that it is not necessary to perform reachability determination on the memory block pointed to by the second pointer;

[0021] Alternatively, when the condition in the if statement in the analysis unit is always true, eliminate the branch in the if statement where the condition is false; when the condition in the if statement in the analysis unit is always false, eliminate the branch in the if statement where the condition is true;

[0022] Alternatively, when the condition in the while statement in the analysis unit is always false, eliminate the branch in the while statement where the condition is true;

[0023] Alternatively, when the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement and the condition in the second if statement have the same value, the second if statement is eliminated, and the branch in which the condition in the second if statement is true is added to the branch in which the condition in the first if statement is true, and the branch in which the condition in the second if statement is false is added to the branch in which the condition in the first if statement is false; when the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement and the condition in the second if statement have opposite values, the second if statement is eliminated, and the branch in which the condition in the second if statement is true is added to the branch in which the condition in the first if statement is false, and the branch in which the condition in the second if statement is false is added to the branch in which the condition in the first if statement is true;

[0024] Alternatively, when the result of calling a function in the analysis unit is used as a judgment condition and the judgment condition affects the path reachability judgment, the function is expanded and inlined; when the result of calling a function in the analysis unit is not used as a judgment condition, or the judgment condition does not affect the path reachability judgment, the function is not inlined.

[0025] In one possible implementation, the method further includes: during state analysis of the state of the memory block pointed to by the pointer in the analysis unit, if there are multiple different branches pointing to the same node in the control flow graph of the analysis unit, recording the first state of the memory block corresponding to the node when the first variable transmitted from the first branch of the multiple branches enters the node; based on the recorded first state, traversing the statements in the nodes on the edges associated with the node and not explored in the control flow graph, and performing state analysis on the state of the memory block pointed to by the pointer in the traversed statement. This simplifies the path exploration space, improves path exploration efficiency, and thus improves detection efficiency.

[0026] In a possible implementation, the method further includes: when the second state of the memory block corresponding to the node is inconsistent with the first state when the pointer transmitted from other branches in multiple branches enters the node, the error type and error statement are determined according to the conflict between the first state and the second state. The error type includes: one or more of repeated release, memory leak and reuse after release, and the error statement includes: one or more of memory allocation statement, memory use statement and memory release statement. In this way, by comparing the recorded state with the state of the memory block corresponding to the node when the pointer transmitted from the current branch enters the node, it is possible to know whether there are time-related memory problems in the two branches, thereby improving detection efficiency.

[0027] In one possible implementation, the method further includes: when the pointers transmitted from other branches among multiple branches enter the node, the second state of the memory block corresponding to the node is inconsistent with the first state, and the first state is allocated, adding a null assignment statement in the other branches, and the null assignment statement is used to assign the pointers transmitted from other branches to null. In this way, the states of the memory blocks pointed to by the pointers transmitted from multiple different branches can be normalized, so that the states of the memory blocks pointed to by the pointers transmitted from these branches are unique, thereby reducing the false alarm rate.

[0028] In addition, a prompt message can be output. This prompt message can be used to prompt the user to change the second state to the empty state, or to change the second state to the first state. In this way, the user can normalize the states of the memory blocks pointed to by pointers from multiple different branches based on their needs, thereby resolving the conflict between the first state and the second state.

[0029] In one possible implementation, after obtaining the detection results related to time-related memory issues in the analysis unit, the method further includes: using a constraint solver to correct the detection results, thereby correcting the detection results and further reducing the false positive rate.

[0030] In one possible implementation, the detection results include one or more of the following: a module with a time-related memory problem, or a line of code with a time-related memory problem, or a line or column in the source code of a pointer with a time-related memory problem, or an execution path from a memory allocation point with a time-related memory problem to an error reporting point, where the error reporting point includes a memory usage point or a memory release point.

[0031] In a second aspect, the present application provides a time-related memory security detection device, comprising: a first processing module and a second processing module. The first processing module is configured to obtain a plurality of analysis units based on the source code, wherein the analysis unit includes a function or a function group. The second processing module is configured to perform a state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein the plurality of analysis units include a first analysis unit and a second analysis unit, wherein the first analysis unit includes a function call statement, and the function call statement is used to call the second analysis unit. When the function call statement is analyzed, the summary information of the second analysis unit is used to perform a state analysis on the state of the memory block pointed to by the pointer associated with the function call statement. The summary information of the analysis unit is used to describe the memory state of the memory block pointed to by the input and output pointers in the analysis unit when entering and exiting the analysis unit. The second processing module is also configured to generate summary information of the analysis unit based on the state analysis results corresponding to the analysis unit, and obtain detection results related to time-related memory issues in the analysis unit.

[0032] In one possible implementation, when the second processing module performs state analysis on the state of the memory block pointed to by the pointer in the analysis unit, it is specifically used to: iteratively perform state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein, during the current round of iteration, the summary information generated by the previous iteration is used to perform state analysis on the state of the memory block pointed to by the pointer in the analysis unit.

[0033] When the second processing module generates summary information of the analysis unit based on the state analysis results corresponding to the state analysis and obtains the detection results related to the time-related memory problems in the analysis unit, it is specifically used to: during the iteration process, identify the time-related memory problems existing in the analysis unit based on the state analysis results obtained in the current round of iteration, and update the summary information of the analysis unit; and, when the summary information of multiple analysis units will no longer be updated, use the time-related memory problems existing in multiple analysis units identified in the last round of iteration as the final detection results.

[0034] In one possible implementation, when the second processing module performs state analysis on the state of the memory block pointed to by the pointer in the analysis unit, it is specifically used to: traverse the statements in the analysis unit based on a preset state transition rule, and perform state analysis on the state of the memory block pointed to by the pointer in the analysis unit. The state transition rule is used to describe the state change rule of the memory block pointed to by the first pointer when assigning a value to the first pointer or using the first pointer.

[0035] In one possible implementation, when the second processing module identifies the time-related memory problem existing in the analysis unit based on the state analysis result corresponding to the state analysis, it is specifically used to: when the state analysis result indicates that the state of the memory block is a terminated state, determine that the statements related to the memory block in the analysis unit have a time-related memory problem, and, according to the type of the terminated state, determine the error type and error statement, wherein the terminated state is used to characterize that the memory block is not used correctly, the error type includes: one or more of repeated release, memory leak and reuse after release, and the error statement includes: one or more of memory allocation statement, memory usage statement and memory release statement; when the state analysis result indicates that the state of the memory block is an intermediate state, determine that the statements related to the memory block in the analysis unit do not have a time-related memory problem, and the intermediate state is used to characterize that the memory block is being used correctly.

[0036] In one possible implementation, the summary information of the analysis unit includes summary information of pointers associated with formal parameters, global variables, and return values ​​in the analysis unit, wherein the pointers associated with the formal parameters, global variables, and return values ​​include second pointers. Exemplarily, the pointers associated with the formal parameters, global variables, and return values ​​can be understood as input and output pointers.

[0037] The summary information of the second pointer includes one or more of the following: the identifier of the second pointer, the position of the formal parameters, global variables or return values ​​associated with the second pointer in the analysis unit, the relationship between the second pointer and the formal parameters, global variables and return values ​​in the analysis unit, the state of the memory block pointed to by the second pointer when entering or exiting the analysis unit, or the alias and non-alias relationship between the second pointer and other pointers in the input and output pointers in the analysis unit except the second pointer.

[0038] In one possible implementation, the input and output pointers in the analysis unit may include one or more of the following: a pointer related to a formal parameter or a return value and brought into or out of the analysis unit, or a global variable, or a pointer related to a global variable and brought into or out of the analysis unit by the global variable.

[0039] In one possible implementation, before performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, the second processing module is also used to: when there are multiple different branches pointing to the same node in the control flow graph of the analysis unit, normalize the states of the memory blocks pointed to by the pointers transmitted by multiple different branches.

[0040] In a possible implementation, when normalizing the states of the memory blocks pointed to by the pointers transmitted from the multiple different branches, the second processing module is specifically configured to: convert the wild pointers in the multiple different branches into null pointers.

[0041] In a possible implementation, before performing status analysis on the status of the memory block pointed to by the pointer in the analysis unit, the second processing module is further configured to: eliminate redundant paths in the analysis unit.

[0042] In one possible implementation, eliminating redundant paths in the analysis unit includes one or more of the following:

[0043] In the case where a dominating and post-dominating relationship exists between a memory allocation point and a release point of the memory block pointed to by the second pointer in the analysis unit, determining that it is not necessary to perform reachability determination on the memory block pointed to by the second pointer;

[0044] Alternatively, when the condition in the if statement in the analysis unit is always true, eliminate the branch in the if statement where the condition is false; when the condition in the if statement in the analysis unit is always false, eliminate the branch in the if statement where the condition is true;

[0045] Alternatively, when the condition in the while statement in the analysis unit is always false, eliminate the branch in the while statement where the condition is true;

[0046] Alternatively, when the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement and the condition in the second if statement have the same value, the second if statement is eliminated, and the branch in which the condition in the second if statement is true is added to the branch in which the condition in the first if statement is true, and the branch in which the condition in the second if statement is false is added to the branch in which the condition in the first if statement is false; when the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement and the condition in the second if statement have opposite values, the second if statement is eliminated, and the branch in which the condition in the second if statement is true is added to the branch in which the condition in the first if statement is false, and the branch in which the condition in the second if statement is false is added to the branch in which the condition in the first if statement is true;

[0047] Alternatively, when the result of calling a function in the analysis unit is used as a judgment condition and the judgment condition affects the path reachability judgment, the function is expanded and inlined; when the result of calling a function in the analysis unit is not used as a judgment condition, or the judgment condition does not affect the path reachability judgment, the function is not inlined.

[0048] In one possible implementation, the second processing module is further used to: in the process of performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, when there are multiple different branches pointing to the same node in the control flow graph of the analysis unit, record the first state of the memory block corresponding to the node when the first variable transmitted from the first branch of the multiple branches enters the node; based on the recorded first state, traverse the statements in the nodes on the edges associated with the node and unexplored in the control flow graph, and perform state analysis on the state of the memory block pointed to by the pointer in the traversed statement.

[0049] In one possible implementation, the second processing module is further configured to: when a pointer from another of the multiple branches enters a node and the second state of the memory block corresponding to the node is inconsistent with the first state, determine an error type and an error statement based on the conflict between the first state and the second state. The error type includes one or more of: duplicate free, memory leak, and use-after-free; and the error statement includes one or more of: memory allocation statement, memory usage statement, and memory release statement.

[0050] In one possible implementation, the second processing module is further used to: when the second state of the memory block corresponding to the node is inconsistent with the first state when the pointer passed from other branches among multiple branches enters the node, and the first state is allocated, add a null assignment statement in other branches, and the null assignment statement is used to assign the pointer passed from other branches to null; or, output a prompt message, and the prompt message is used to prompt to change the second state to an empty state, or to change the second state to the first state.

[0051] In a possible implementation, after outputting the detection result related to the time-related memory problem in the analysis unit, the second processing module is further configured to: modify the detection result using a constraint solver.

[0052] In one possible implementation, the detection results include one or more of the following: a module with a time-related memory problem, or a line of code with a time-related memory problem, or a line or column in the source code of a pointer with a time-related memory problem, or an execution path from a memory allocation point with a time-related memory problem to an error reporting point, where the error reporting point includes a memory usage point or a memory release point.

[0053] In a third aspect, the present application provides a computing device cluster comprising at least one computing device, each computing device comprising a processor and a memory; the processor of at least one computing device is used to execute instructions stored in the memory of at least one computing device, so that the computing device cluster performs the method described in the first aspect or any possible implementation of the first aspect.

[0054] In a fourth aspect, the present application provides a computer-readable storage medium comprising computer program instructions. When the computer program instructions are executed by a computing device, the computing device performs the method described in the first aspect or any possible implementation of the first aspect; alternatively, when the computer program instructions are executed by a computing device cluster, the computing device cluster performs the method described in the first aspect or any possible implementation of the first aspect. Exemplarily, the computing device cluster may include one or more computing devices.

[0055] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed by a computing device, causes the computing device to perform the method described in the first aspect or any possible implementation of the first aspect; or, when executed by a computing device cluster, causes the computing device cluster to perform the method described in the first aspect or any possible implementation of the first aspect. Exemplarily, the computing device cluster may include one or more computing devices.

[0056] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] The following is a brief introduction to the drawings required for describing the embodiments or prior art.

[0058] FIG1 is a schematic diagram of the architecture of a time-related memory problem detection system provided by an embodiment of the present application;

[0059] FIG2 is a schematic diagram of the structure of summary information of a pointer in an analysis unit provided in an embodiment of the present application;

[0060] FIG3 is a schematic diagram of the structure of summary information of a pointer in another analysis unit provided in an embodiment of the present application;

[0061] FIG4 is a schematic diagram of an input-output graph of an analysis unit provided in an embodiment of the present application;

[0062] FIG5 is a schematic diagram of a state transition rule of a memory block provided in an embodiment of the present application;

[0063] FIG6 is a schematic diagram of a control flow chart of an analysis unit provided in an embodiment of the present application;

[0064] FIG7 is a schematic diagram of a control flow chart of another analysis unit provided in an embodiment of the present application;

[0065] FIG8 is a schematic diagram of a function call graph in a source code provided by an embodiment of the present application;

[0066] FIG9 is a schematic diagram of the architecture of another time-related memory problem detection system provided in an embodiment of the present application;

[0067] FIG10 is a comparative schematic diagram of a control flow chart of an analysis unit before and after eliminating redundant paths in the analysis unit provided in an embodiment of the present application;

[0068] FIG11 is a comparative schematic diagram of another control flow chart of the analysis unit before and after eliminating redundant paths in the analysis unit provided by an embodiment of the present application;

[0069] FIG12 is a comparative diagram of whether redundant function expansion is eliminated in a control flow chart of an analysis unit provided in an embodiment of the present application;

[0070] FIG13 is a flow chart of a method for detecting time-related memory problems according to an embodiment of the present application;

[0071] FIG14 is a schematic diagram of the structure of a device for detecting time-related memory problems provided in an embodiment of the present application;

[0072] FIG15 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0073] FIG16 is a schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

[0074] FIG17 is a schematic diagram of the structure of another computing device cluster provided in an embodiment of the present application. DETAILED DESCRIPTION

[0075] The term "and / or" as used herein describes an association between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. The symbol " / " as used herein indicates that the related objects are in an "or" relationship, for example, A / B means either A or B.

[0076] The terms "first" and "second" in this specification and claims are used to distinguish different objects rather than to describe a specific order of objects. For example, "first response message" and "second response message" are used to distinguish different response messages rather than to describe a specific order of response messages.

[0077] In the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be interpreted as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0078] In the description of the embodiments of the present application, unless otherwise specified, "multiple" means two or more, for example, multiple processing units means two or more processing units, etc.; multiple elements means two or more elements, etc.

[0079] First, the relevant technical terms involved in the technical solution provided in this application are introduced.

[0080] (1) Memory safety issues

[0081] When a computer program makes destructive accesses to memory areas, it can cause software errors or security vulnerabilities, known as memory safety issues. These destructive accesses primarily include: null pointer dereference, out-of-bounds read, out-of-bounds write, use-after-free, memory leaks, and double-free. Null pointer dereference, out-of-bounds read, and out-of-bounds write are independent of the order of memory access and are solely related to whether the memory access exceeds spatial constraints. These are known as spatial memory safety issues. Use-after-free, memory leaks, and double-free are strongly related to the order of memory access and are known as temporal memory issues.

[0082] (2) Control flow graph (CFG)

[0083] A control flow graph, also known as a control flow diagram, is an abstract representation of a process or program. It is an abstract data structure used in compilers and maintained internally by the compiler. It represents all the paths that will be traversed during the execution of a program. A control flow graph can be composed of a series of nodes and edges. A node represents a basic block (BB) in the program. Statements within a basic block are executed sequentially, jumping from the last statement of one basic block to the first statement of the next basic block. Edges represent the control flow transfer relationship between basic blocks. Control flow transfers include branching of conditional statements (such as if statements and switch statements), iteration of loop statements, and function calls and returns. The control flow graph connects different basic blocks through these edges, showing the control flow of the program.

[0084] (3) Basic blocks

[0085] A basic block is a sequence of instructions without branches, that is, a group of statements executed continuously.

[0086] (4) Domination and post-dominance

[0087] If all paths from the program starting point to basic block N reach basic block M before reaching basic block N, then basic block M is said to dominate basic block N. For example, if BB1 is required to reach BB2, then BB1 is said to dominate BB2.

[0088] Considering the opposite direction, if all paths from basic block N to the program endpoint reach basic block M before reaching the endpoint, then basic block M post-dominates basic block N.

[0089] (5) Inline expansion

[0090] Inline expansion is an optimization technique that expands the function body directly to the call site. It can be manually specified (such as with the inline keyword) or automatically completed through compilation optimization.

[0091] (6) Alias ​​relationship

[0092] When two pointers p and q point to the same memory area, the allocation, release, and use of p and the allocation, release, and use of q are functionally equivalent, and p and q are said to have an alias relationship.

[0093] (7) Static single assignment (ssa)

[0094] Static single assignment is a feature of the intermediate representation (IR) generated by the compiler, where each variable is assigned a value only once. If the same variable is assigned multiple times in the original program, each variable and its different versions are identified by adding a subscript index to the old variable name.

[0095] (8)phi node

[0096] The phi node is on an IR with the SSA feature. If the current value of a variable i comes from two different previous branches i1 and i2, in order to ensure that each variable is assigned only once, a phi node will be established: i3 = phi(i1, i2) to indicate that i3 may be equal to i1 or i2.

[0097] (9) Declaration Point

[0098] A declaration specifies the type of a variable p but does not define it. For example, "int*p;", "func(int*p);", etc.

[0099] (10) Definition point

[0100] A definition point is a statement that assigns a value to any variable p. For example, "p = malloc(100);", "p = 10;", "p = func(a);", etc.

[0101] (11) Distribution Point

[0102] A definition point is a statement that defines a pointer p using the return value of a memory allocation function. A memory allocation function can also be a user-defined function. For example, "p = malloc(100)".

[0103] (12) Point of use

[0104] A statement that uses the memory block pointed to by pointer p. Memory block usage can be categorized as either load or store. For example, "a = *p" is a load, and "*p = 10;" is a write.

[0105] (13) Release point

[0106] A statement that uses a memory deallocation function to release the memory block pointed to by pointer p. The memory deallocation function can also be a user-defined function, for example: "free(p)".

[0107] (14) Source code

[0108] Source code is a text file written in a programming language that contains instructions and algorithms for implementing specific functions. Source code can be converted into machine language, or bytecode, by a compiler or interpreter so that a computer can execute the program.

[0109] Next, the technical solution provided by this application is introduced.

[0110] Exemplarily, FIG1 shows a schematic diagram of the architecture of a time-related memory problem detection system provided by an embodiment of the present application. As shown in FIG1 , the time-related memory problem detection system 100 may include: a program partitioning module 110 and a summary generation module 120. The program partitioning module 110 is mainly used to divide the source code into independent analysis units. Each analysis unit is mainly composed of a function or a function group. In this way, the memory behavior of each analysis unit is decoupled, so that the calling order between the analysis units can be ignored in the future. In addition, in order to further reduce the coupling between the analysis units, to simplify the summary information generated subsequently and to improve the analysis efficiency and accuracy, multiple functions with strong coupling can be grouped as a function group through the calling relationship between the functions in the source code. For example, when in an if statement in a function, a flag is released when a certain condition is met, and the flag is not released when it is not met, and the definition of the flag comes from a function in the upper layer, then the coupling between the function where the if statement is located and the upper layer function is very strong. By treating the function group consisting of this function and the upper-level function as an analysis unit, it is no longer necessary to analyze the impact of different flag values ​​when generating summary information subsequently, thereby achieving the purpose of simplifying the summary information.

[0111] The summary generation module 120 primarily processes each analysis unit divided by the program division module 110 to obtain summary information for each analysis unit and analyze the time-related memory issues present in each analysis unit. The summary information for an analysis unit is used to describe the state of the memory block pointed to by the pointers associated with the formal parameters, global variables, and return values ​​in the analysis unit when entering and exiting the analysis unit. Exemplarily, the memory block state may include: uninitialized (kUninitialized), initialized (kInitialized), null pointer (kNull), allocated (kAllocated), or released (kFreed). For example, "int*p;" only declares p and does not point to any memory block. The memory block pointed to by p is considered to be in the kUninitialized state, and any subsequent use of p is incorrect. "intp = 100;" means that the value of p is 100, which is a variable stored on the stack. This means that p points to a memory area on the stack, and the memory block pointed to by p is considered to be in the kInitialized state. Stack memory is allocated and released by the system, so manually releasing stack memory is incorrect. "int*p = malloc(100);" means that p points to an allocated heap memory block with a length of 100. The memory block pointed to by p is considered to be in the kAllocated state. Heap memory needs to be manually allocated and released, so allocating heap memory without releasing it is incorrect. "free(p);" means that p points to a freed heap memory block. The memory block pointed to by p is in the kFreed state. Since the memory block pointed to by p has been released, any subsequent use of p is incorrect. This design of memory block states can effectively distinguish between stack memory and heap memory. Because programming languages ​​like C don't clearly distinguish between pointer variables and non-pointer variables, developers can write code like "intp = malloc(100)" or "int*p = 10." In the former, although p is an int, it's essentially a pointer to the first address of heap memory with a length of 100 and needs to be released later. In the latter, although p is an int*, it essentially points to a block of stack memory and doesn't need to be released later. Therefore, by designing and identifying this memory block state, it's possible to distinguish between stack memory and heap memory, eliminating the need to consider the distinction between pointer variables and non-pointer variables.

[0112] For summary information, each pointer associated with a formal parameter, a global variable, and a return value in an analysis unit may have a summary information. The summary information of all pointers associated with formal parameters and return values ​​in an analysis unit constitutes the summary information of the analysis unit. The summary information of a pointer can be used to describe the state of the memory block pointed to by the pointer when entering and exiting the analysis unit where the pointer is located. Exemplarily, the pointers associated with formal parameters, global variables, and return values ​​may include: one or more of the pointers related to formal parameters and return values ​​and brought into or out of the analysis unit, or global variables, or pointers brought into or out of the analysis unit by global variables.

[0113] For example, Figure 2 shows a schematic diagram of the data structure of summary information provided in an embodiment of the present application. As shown in Figure 2, the summary information may include: pointerId field, indirectLevelFldAndOffset field, isIn field, isOut field, inStat field, outStat field, mayUseSet field, and mustNoUseSet field.

[0114] The pointerId field is used to give each pointer a unique ID number for distinction.

[0115] The indirectLevelFldAndOffset field contains four parts: offset, fieldId, level, and formalId, which are used to distinguish multi-level pointers and structure members. Offset indicates the offset of the memory area pointed to by the pointer. For example, if intp = malloc(100) points to the first address of the memory block, and intq = p+1, then the offset value of q is 1, indicating that q points to a position with an offset of 1 byte in the memory area. FieldId indicates the domain information. For example, if StructS{int*a, int*b} defines a structure S, Sp = malloc(100) points to the first address of the memory block, then q = pa indicates that q points to the place in the memory area where the domain is a. Based on the definition of S, the ID number of domain a can be inferred and filled into the fieldId field of q. level indicates the level of indirect memory access. For example, if int**p=malloc(100) points to the first address of the memory block, then q=*p indicates a first-level indirect access to p. In this case, the level field of q is 1. If q=**p, it indicates a second-level indirect access. In this case, the level field of q is 2. formalId indicates the position of the pointer in the function parameter and is used to connect the calling function and the called function. For example, in func(p,q), p is the 0th pointer associated with the formal parameter, so the formalId field of p is 0. q is the first pointer associated with the formal parameter, so the formalId field of q is 1.

[0116] Both the isIn field and the isOut field can be true or false. Among them, when the isIn field is true, it means that the memory area pointed to by the pointer has entered the analysis unit. When the isOut field is true, it means that the memory area pointed to by the pointer has exited the analysis unit. In addition, the isIn field and the isOut field can also be true at the same time, indicating that the memory area pointed to by the pointer first entered the analysis unit and then exited the analysis unit. Exemplarily, the isIn field and the isOut field can be used to describe whether the memory area pointed to by the pointer has entered or exited the analysis unit, or both entered and exited the analysis unit. For example: the code of a certain analysis unit is as follows:

[0117] In this code, the memory block pointed to by pointer p both enters and exits the analysis unit. Therefore, the isIn field and isOut field in the summary information of pointer p are both true.

[0118] For the inStat and outStat fields, when isIn = true, inStat indicates the memory block status of the memory area pointed to by the pointer when entering the analysis unit; when isIn = false, the inStat field is the initial value, i.e., kUninitialized. When isOut = true, outStat indicates the memory block status of the memory area pointed to by the pointer when exiting the analysis unit; when isOut = false, the outStat field is the initial value, i.e., kUninitialized. For example, the code for an analysis unit is as follows:

[0119] In this code, the memory block pointed to by pointer p is only used when entering the analysis unit, and memory is allocated to it before entering. Therefore, the isIn field in the summary information of pointer p is true, the isOut field is false, inStat = kAllocated, outStat = kUninitialized. The memory block pointed to by pointer q is also only used when entering the analysis unit, and memory is allocated to it before entering. Therefore, the isIn field in the summary information of pointer q is true, the isOut field is false, inStat = kAllocated, outStat = kUninitialized. The memory block pointed to by pointer r is only used when exiting the analysis unit, and memory is allocated to it before exiting. Therefore, the isIn field in the summary information of pointer r is false, the isOut field is true, inStat = kUninitialized, outStat = kAllocated.

[0120] mayUseSet is used to record the pointerId of all pointers that have an alias relationship with the pointer. It can be obtained by executing an alias analysis algorithm (such as the Anderson algorithm, the Steensgaard algorithm, etc.) on the code within a single analysis unit. For example, the code of an analysis unit is as follows:

[0121] In this code, if p's pointerId=1, q's pointerId=2, and r's pointerId=3, then p's mayUseSet field is {2,3}, q's mayUseSet field is {1,3}, and r's mayUseSet field is {1,2}.

[0122] mustNoUseSet is used to record the pointerIds of all pointers that must not have an alias relationship with a certain pointer. When a memory area pointed to by a pointer is released within an analysis unit, and then the memory area pointed to by another pointer is used, it is necessary to ensure that these two memory areas do not have an alias relationship when entering this analysis unit (otherwise, a use-after-free will occur). For example, the code for an analysis unit is as follows:

[0123] In this code, if p's pointerId=1 and q's pointerId=2, then p's mustNoUseSet field is {2}. Since the alias relationship is bidirectional, q's mustNoUseSet field is {1}.

[0124] It should be understood that FIG2 illustrates only one form of the data structure of summary information. In other embodiments, the data structure of summary information may also have other forms or include more or fewer fields, depending on actual circumstances and is not limited here. For example, the data structure of summary information may also be as shown in FIG3. In FIG3, the data structure of summary information may include: pointerId field, formalId field, isIn field, isOut field, inStat field, and outStat field.

[0125] In this embodiment, the summary generation module 120 may include: multiple input / output pointer extraction modules 121, multiple summary initialization modules 122, and multiple local analysis modules 123. Each input / output pointer extraction module 121, each summary initialization module 122, and each local analysis module 123 are collectively responsible for processing a single analysis unit. Because the memory behavior of different analysis units is decoupled during the program partitioning phase, the calling relationships between analysis units can be directly ignored during the analysis unit processing process, and multiple analysis units can be processed simultaneously and in parallel, thereby improving processing efficiency and reducing analysis time.

[0126] The input and output pointer extraction module 121 is mainly responsible for extracting the pointers associated with the formal parameters, global variables and return values ​​in the analysis unit, so that these pointers can be used to generate summary information later. Among them, the input and output pointers refer to: pointers associated with formal parameters, global variables and return values, which can enter and exit the analysis unit through formal parameters, global variables or return values. Exemplarily, before extraction, the IR with ssa characteristics of the analysis unit can be obtained from the IR with ssa characteristics of the source code obtained by the compiler. Then, the formal parameters and return values ​​of the analysis unit can be extracted from the IR with ssa characteristics of the analysis unit, and then analyzed through constraint relationships (such as: assignment, memory loading, function call, etc.) to extract the pointers associated with the formal parameters, global variables and return values, and clarify the entry or exit direction of each pointer. For example, the code in a certain analysis unit is as follows:

[0127] In the above code, we can first extract the formal parameters, global variables, and return value based on the function description, namely len, p_0, s, and p_2. Len, p_0, and s are formal parameters, u is a global variable, and p_2 is the return value. Then, we traverse all statements in the function and identify the constraints between pointers to construct the input-output graph (in-out graph) shown in Figure 4. In Figure 4, all variables connected by solid arrows (len, p_0, *p_0, **p_0, s, sa, and ub) enter the analysis unit; all variables connected by dashed arrows (*(p_0)_1, q_0, q_1, q_2, *p_2, p_2, sa, and ub) exit the analysis unit. In some embodiments, in addition to using the in-out graph to extract input and output pointers, they can also be extracted by recursive backtracing of formal parameters, global variables, and return values, or by using the assignment graph in the static value-flow (SVF) scheme. The specific method can be determined according to actual conditions and is not limited here.

[0128] The summary initialization module 122 is mainly responsible for initializing the summary information of the input and output pointers extracted from the analysis unit by the input and output pointer extraction module 121. The summary initialization module 122 can initialize a summary information for each input and output pointer.

[0129] For example, using the summary information data structure shown in FIG2 as an example, any input / output pointer can be identified using the pointerId field in the pointer's summary information, where different input / output pointers have different pointerIds. Then, in the pointer's summary information, the indirectLevelFldAndOffset field can be populated based on the analysis results of the input / output parameter extraction module 121. For example, referring again to FIG4 , in the summary information of p_0, the level in the indirectLevelFldAndOffset field is level=0, offset=0, fieldId=0, and formalId=1; *in the summary information of p_0, the level in the indirectLevelFldAndOffset field is level=1, offset=0, fieldId=0, and formalId=1; **in the summary information of p_0, the level in the indirectLevelFldAndOffset field is level=2, offset=0, fieldId=0, and formalId=1; in the summary information of s, the level in the indirectLevelFldAndOffset field is level=0, offset=0, fieldId=0, and formalId=2; in the summary information of sa, the level in the indirectLevelFldAndOffset field is level=1, offset=0, fieldId=1, and formalId=2; and in the summary information of ub, the level in the indirectLevelFldAndOffset field is level=1, offset=0, fieldId=2, and formalId=3. Next, you can assign values ​​to the isIn and isOut fields. When the pointer enters the analysis unit through a formal parameter or a global variable, the isIn field can be assigned a value of true; when the pointer exits the analysis unit through a formal parameter or a return value, the isOut field is assigned a value of true; when the pointer can both enter and exit the analysis unit, the isIn field can be assigned a value of true, and the isOut field is also assigned a value of true. Finally, in the summary information of the pointer, the inStat and outStat fields can be initialized to kUninitialized, and the mayUseSet and mustNoUseSet fields can be initialized to empty. It should be understood that the time for initializing the contents of different fields in the summary information can be determined according to actual conditions and is not limited here.

[0130] The local analysis module 123 is primarily responsible for obtaining the control flow graph (CFG) of the analysis unit from the IR with the SSA feature. Furthermore, the local analysis module 123 is also responsible for traversing the IR along the CFG to obtain each statement, performing state analysis on all pointers in the statement, and identifying code lines with timing memory issues based on the transition analysis results. Furthermore, the module updates the inStat and outStat fields in the summary information initialized by the summary initialization module 122. Regarding state analysis, as shown in FIG5 , FIG5 (A) illustrates the state transition of the memory block pointed to by a pointer when a value is assigned to the pointer, while FIG5 (B), (C), and (D) illustrate the state transition of the memory block pointed to by the pointer when the pointer is used. In Figure 5 (A), after allocating memory for a pointer, the state of the memory block pointed to by the pointer becomes kAllocated; when the pointer is assigned a value of 0, the state of the memory block pointed to by the pointer becomes kNull; when the pointer is assigned a non-zero constant, the state of the memory block pointed to by the pointer becomes kInitialized; when the pointer is assigned a value other than 0, the state of the memory block pointed to by the pointer inherits the state of the right value. For example, for pointer p, when p = malloc(), the state of the memory block pointed to by p becomes kAllocated; when p = 0, the state of the memory block pointed to by p becomes kNull; when p = 5, the state of the memory block pointed to by p becomes kInitialized; and when p = q, the state of the memory block pointed to by p becomes the state of the memory block pointed to by q.

[0131] In (B) of Figure 5, when using a pointer, when the state of the memory block pointed to by the pointer is kUninitialized / kInitialized, if the pointer is an input parameter and the pointer is loaded or written (load / store), the state of the memory block pointed to by the pointer becomes kAllocated. If the pointer is an input parameter and the memory pointed to by the pointer is released, the state of the memory block pointed to by the pointer becomes kFreed. If the pointer is not an input parameter and the pointer is loaded or written (load / store), or the memory pointed to by the pointer is released, since the memory block pointed to by the pointer has not been allocated, there is a problem of using illegal memory, that is, the problem of using after release. If other operations are performed on the pointer, the state of the memory block pointed to by the pointer remains unchanged. For example, if p is an input parameter, when *p=x, a write operation is performed on the memory block pointed to by p, and the state of the memory block pointed to by p becomes kAllocated; when x=*p, a load operation is performed on the memory block pointed to by p, and the state of the memory block pointed to by p becomes kAllocated; when free(p) is called, a release operation is performed on the memory block pointed to by p, and the state of the memory block pointed to by p becomes kFreed.

[0132] In Figure 5 (C), when using a pointer, if the memory block pointed to by the pointer is in the kAllocated state, then if the memory pointed to by the pointer is released, the state of the memory block pointed to by the pointer changes to kFreed. If the program ends at this point, since the memory has already been allocated, directly exiting at this point will result in the memory not being released, leading to a memory leak. If the memory block pointed to by the pointer is loaded, written, or otherwise operated on, the state of the memory block pointed to by the pointer remains unchanged because the memory has already been allocated.

[0133] In Figure 5 (D), when using a pointer, if the state of the memory block pointed to by the pointer is kFreed, if the memory pointed to by the pointer is released, since the memory block is already in the released state, when the memory block pointed to by the pointer is released again, there will be a problem of repeated release. If the memory block pointed to by the pointer is loaded or written, it will be used again. At this time, since the memory block is already in the released state, there will be a problem of reuse after release (i.e., using illegal memory). However, when performing other operations on the memory block pointed to by the pointer, the state of the memory block pointed to by the pointer remains unchanged.

[0134] It should be noted that kUninitialized, kInitialized, kAllocated, kNull, and kFreed in Figure 5 all indicate that the memory block is being used correctly. When the state of the memory block is any of these states, the state of the memory block can be called an "intermediate state." Use after free, double free, and no free in Figure 5 all indicate that the memory block is not being used correctly. When the state of the memory block is any of these states, the state of the memory block can be called a "termination state." Among them, use after free, double free, and no free can be called types of termination states. One type of termination state can correspond to one error type. When the state of a memory block is a "termination state," different types of termination states can have different error types and error statements. For example: when the termination state type is use after free, the error type is use after release, and the error statement is a memory use statement; when the termination state type is double free, the error type is repeated release, and the error statement is a memory release statement; when the termination state type is no free, the error type is memory not released (also known as "memory leak"), and the error statement is a memory allocation statement.

[0135] When analyzing the analysis unit, the local analysis module 123 analyzes the statements in the IR path by path and line by line based on the state transition diagram shown in Figure 5, performs state analysis on each pointer involved in the statement, and identifies the time-related memory problems existing in the analysis unit. For example, when the state analysis of the memory block executed by a certain pointer is no-free, it can be confirmed that the state of the pointer is a termination state. Furthermore, the type of the termination state is no free, so it can be determined that the error type is memory not released, and the error statement is the memory allocation statement of the pointer. In this way, the detection result of the pointer is obtained. When the states of the memory blocks pointed to by other pointers in the analysis unit are all intermediate states after the transfer, the local analysis module 123 can use the detection result it obtains as the result of this analysis.

[0136] In some embodiments, when a variable in an analysis unit has a current value derived from multiple different previous branches within the analysis unit, a phi node is used in the IR of the analysis unit with the SSA feature to process the variable. In this case, during the analysis process, the local analysis module 123 can directly perform error detection by storing and comparing the states of each variable in the phi node, thereby reducing the path exploration space and improving analysis efficiency. When the stored results of the previous branch are inconsistent with the results obtained from the state analysis of the current branch, an error is reported. When reporting an error, the error type and error statement can be determined based on the conflict between the states of the memory blocks pointed to by the pointers transmitted by different branches. For example, as shown in Table 1, when the state of the memory block pointed to by the pointer p_0 transmitted by a recorded branch is kUninitialized, kInitialized, or kFreed, if the state of the memory block pointed to by the pointer p_1 transmitted by a branch is kAllocated, the states corresponding to the two branches are inconsistent, thus causing a conflict. Furthermore, it can be determined from Table 1 that the error type is memory not released, and the error statement is the memory allocation statement of p_1. When the memory block pointed to by pointer p_0 from a recorded branch is in the kAllocated state, if the memory block pointed to by pointer p_1 from a branch is in the kUninitialized, kInitialized, or kFreed state, the states corresponding to the two branches are inconsistent, resulting in a conflict. Furthermore, Table 1 shows that the error type is a duplicate release, and the error statement is the memory release statement for p_0.

[0137] Table 1

[0138] Specifically, after the local analysis module 123 completes the exploration of a path, it can store the state of a variable in the phi node on this path during the exploration process. When the local analysis module 123 explores another path, the local analysis module 123 can explore the path before the phi node and the path after the phi node respectively. When exploring the path before the phi node, the local analysis module 123 can compare the state of the variables in the phi node obtained in this exploration with the state of the variables in the phi node stored when it previously explored other paths. When the two are consistent, it indicates that the state of each variable in the path explored this time is correct, that is, no error is required; when the two are inconsistent, a conflict occurs. Based on the state conflict on the branch at the time of the conflict, an error is reported according to the error type and error statement in Table 1. When exploring the path after the phi node, the local analysis module 123 can only explore the unexplored path without exploring the path that has already been explored. In this way, the path exploration space can be reduced and the analysis efficiency can be improved. Illustratively, when exploring a path, the local analysis module 123 may traverse the statements contained in the nodes on the path, and perform a status analysis on the states of the memory blocks pointed to by the pointers in the traversed statements.

[0139] For example, the code in an analysis unit is as follows:

[0140] The CFG constructed by the above code can be seen in Figure 6. As can be seen from Figure 6, in the above code, memory allocation occurs at nodes BB2 and BB3, and release occurs at node BB7. To ensure that memory usage on each path is legal, all four possible paths in the graph must be explored separately, traversing in depth-first order: nodes 12457, 12467, 13457, and 13467. In practice, after exploring node 12457, one can directly return to node BB4 (assuming the state of node BB4 has been saved) and further explore node 467, without having to start from node 1 and re-explore node 12467. After exploring nodes 12457 and 467, one can return to node BB1 ​​and explore node BB4 along node 134. Comparing the state with the previously saved state of node BB4 confirms the validity of nodes 13457 and 13467. If the comparison reveals inconsistent states, an error can be reported. The overall exploration process is simplified to 12457, 467, 134, and the exploration space is reduced from 2 times per edge to 1 time per edge.

[0141] The above simplification process is only possible if the state of node BB4 can be saved and compared. The state of p in node BB4 could originate from either BB2 or BB3. When processing p, using SSA technology, p in BB2 is renamed to p_1, and p in BB3 is renamed to p_2. A new statement, p_3 = phi(p_1, p_2), is added to BB4, indicating that "when entering BB4 from BB2, p_3 = p_1; when entering BB4 from BB3, p_3 = p_2." During the first traversal, at nodes 12457, the state of p_1 is obtained at node BB4 and saved. The state of p_3 is the same as p_1 and is also saved. During the second traversal, at node 467, the state of p_1, i.e., p_3, at node BB4 is inherited. During the third traversal, at node 134, the state of p_2 is obtained and compared with the previously recorded state of p_1. If the state of p_2 differs from the state of p_1, a conflict occurs, and an error is reported.

[0142] Furthermore, the more paths originally required to be explored, the more significant the reduction in the path exploration space, and the more pronounced the effect. For example, when the CFG constructed from the code of a certain analysis unit is shown in Figure 7, there are originally eight paths required to be explored: 1-2-4-5-7-8-10, 1-2-4-5-7-9-10, 1-2-4-6-7-8-10, 1-2-4-6-7-9-10, 1-3-4-5-7-8-10, 1-3-4-5-7-9-10, 1-3-4-6-7-8-10, 1-3-4-6-7-9-10. When the states of the corresponding variables are stored in both BB4 and BB7 and compared, the number of paths required to be explored becomes four: 1-2-4-5-7-8-10, 7-9-10, 4-6-7, and 1-3-4. At the same time, the path exploration space is reduced from 4 times per edge to 1 time per edge.

[0143] In some embodiments, when a statement of analysis unit A executes a call to analysis unit B and executes subsequent code based on the call result, if the update of the summary of analysis unit B has not been completed at this time, the subsequent analysis results and summary generation of analysis unit A will be affected because the summary information of analysis unit B obtained is inaccurate.

[0144] For example, the code in analysis unit A is as follows:

[0145] The code in analysis unit B is as follows:

[0146] In the above code, a statement in analysis unit A executes a call from analysis unit B to analysis unit B, and the subsequent code is executed based on the call result. If the update of analysis unit B's summary has not yet been completed, the local analysis module 123 used to analyze analysis unit A will, because the summary of funB() is empty, assign q to "other", so the state of the memory block pointed to by q is kInitialized. Next, a load operation is performed in analysis unit A using *q. As can be seen from the state transition diagram shown in Figure 5, an error occurs during the state transition, resulting in an error message. After the update of analysis unit B's summary is completed, when analyzing analysis unit A, q is assigned to p. Therefore, the state of the memory block pointed to by q is the same as the state of the memory block pointed to by p in analysis unit B's summary, namely, kAllocated. Next, a load operation is performed in analysis unit A using *q. Since memory has been allocated for q, the load operation is executed correctly. It can be seen from this that only when the summary information of the callee (ie, the called analysis unit) no longer changes can the correct summary information of the caller be obtained and the correct memory problem be analyzed.

[0147] Therefore, in order to ensure that the summary information of each analysis unit finally obtained is correct and to ensure the correctness of the analysis results, each local analysis module 123 can iteratively analyze the corresponding analysis unit. Among them, in order to obtain the correct summary information, the local analysis module 123 can iterate at most the deepest call level of the analysis unit in the function call graph (callgraph) of the source code. Of course, it can also be more than the deepest call level. The specific number can be determined according to the actual situation and is not limited here. For example, as shown in Figure 8, in the callgraph shown in Figure 8, the analysis units funD and funE do not call other analysis units, so the deepest call levels of both are 0, that is, no iteration is required when analyzing funD and funE, and only one analysis is required at most. The analysis unit funC is the analysis unit funD that is directly called, and does not call other analysis units, so its deepest call level is 1, that is, when analyzing funC, at most one iteration is required. Analysis unit funA can directly call analysis unit funD, or indirectly call analysis unit funC. Therefore, its deepest call level is 2, which means that when analyzing funC, a maximum of 2 iterations are required. Analysis unit funB directly calls analysis units funD and funE, so its deepest call level is 1, which means that when analyzing funB, a maximum of 1 iteration is required. Analysis unit main needs to call analysis units funA and funB, so its deepest call level is the maximum of the deepest call levels of funA and funB plus 1, which is 3. That is, when analyzing main, a maximum of 3 iterations are required.

[0148] It should be understood that, since the memory behavior of each analysis unit is decoupled through the summary technology in this embodiment, the calling order between analysis units can be directly ignored, and the memory problem analysis of all analysis units can be performed simultaneously, thus reducing analysis time and improving analysis efficiency. In addition, since the memory behavior of the analysis unit is fixed, the summary information of the corresponding analysis unit can be directly called during subsequent calls without opening the corresponding analysis unit, which reduces computational overhead and avoids exponential increase in computation. For example, as shown in Figure 8, main, funA, funB, funC, funD, and funE can be analyzed simultaneously in the first round, although only correct summary information for funD and funE is obtained in this round. In the first iteration, all functions are also analyzed simultaneously. On the premise that correct summary information for funD and funE is obtained, correct summary information for funB and funC can be obtained. The iteration is repeated until all correct summary information is obtained in the third iteration. It is worth mentioning that since all analysis units are analyzed in each round, there is no need to construct a call graph like Figure 8. There is no need to know which specific function summary information is correct in each round. The only way to determine whether further iterations are needed is to check whether all summary information obtained in this round is updated compared to all summary information obtained in the previous round. When the summary is no longer updated, new iterations will not bring any benefits.

[0149] In some embodiments, in order to ensure the correctness of the summary information of each analysis unit finally obtained, it can be determined that the correct summary information of all analysis units is obtained when the summary information of all analysis units is no longer updated. At the same time, the memory problem identified at this time can be output as the final detection result. Exemplarily, the final detection result may include: the module with time-related memory problems, the code line with time-related memory problems, the column of the pointer with time-related memory problems in the source code, and one or more items in the execution path from the memory allocation point with time-related memory problems to the error reporting point. Among them, the error reporting point includes the memory usage point or the memory release point.

[0150] The above is an introduction to the time-class memory problem detection system 100 provided by the embodiment of the present application. In actual operation, when there are multiple different branches pointing to the same node in the analysis unit, if the state of the memory block pointed to by the pointers transmitted by these branches is not unique, it is easy to generate erroneous summary information, and the situation of false positives may occur. In addition, there are often redundant paths in the analysis unit, and these redundant paths also often affect the analysis results. In view of this, the embodiment of the present application provides another time-class memory problem detection system.

[0151] For example, FIG9 shows a schematic diagram of the architecture of another time-related memory problem detection system provided by an embodiment of the present application. As shown in FIG9 , the time-related memory problem detection system 900 may include: the program partitioning module 110 and the summary generation module 120 described in FIG1 , as well as a state normalization module 910 and a local optimization module 920. There may be multiple state normalization modules 910 and local optimization modules 920, and one state normalization module 910 may be used to process one analysis unit, and one local optimization module 920 may also be used to process one analysis unit.

[0152] The state normalization module 910 is primarily responsible for normalizing the states of the memory blocks pointed to by the pointers passed by these branches when there are multiple different branches pointing to the same node in the CFG of the analysis unit. It can be defined that when a pointer is a null pointer, the state of the memory block pointed to by the pointer can be any state.

[0153] For example, the code in an analysis unit is as follows:

[0154] In the CFG obtained by the above code, the two branches in the if statement both point to the same node. However, in the if statement, the state of the memory block pointed to by the pointer p passed by the branch when flag = true is kFreed; the state of the memory block pointed to by the pointer p passed by the branch when flag = false is kAllocated. It can be seen that the states of the memory blocks pointed to by the pointers passed by the two branches in the if statement are inconsistent. Therefore, the state of the memory block pointed to by the p pointer in this analysis unit is not unique. At this point, in the above code, state normalization can be achieved by converting wild pointers to null pointers. The converted code is as follows:

[0155] Illegal use of null pointers is a common spatial memory safety issue that can be addressed through methods such as runtime checks for null pointers. Based on this, this embodiment assumes that the issue of illegal use of null pointers is fully resolved, and the state of the memory block pointed to by the null pointer can be considered equivalent to any state. The converted code shows that the memory blocks pointed to by the pointers in both branches of the if statement are both in the kFreed state.

[0156] It should be understood that in addition to automatically normalizing the state, the state normalization module 910 can also inform the developer of the non-uniqueness of the state when multiple branches point to the same node and the states of the memory blocks pointed to by the pointers passed by these branches are not unique, so that the developer can achieve state normalization by standardizing the function interface to constrain the use of pointers.

[0157] For example, the input parameter p of the realloc function shown below is in the states kAllocated, kFreed, and kAllocated when it passes through the three branches, resulting in a non-unique state. This information can be reported to the developer, who can then decide how to handle the situation.

[0158] The local optimization module 920 is primarily used to utilize the IR of the analysis unit with SSA characteristics to eliminate redundant paths in the analysis unit, thereby reducing the false negative rate during subsequent analysis. For example, when redundant unreachable paths exist, if an unreachable path is released and then reused, it may be considered a reachable path, in which case an error will be reported. Eliminating redundant paths can include eliminating one or more of the following: eliminating redundant reachability judgments, eliminating unreachable paths, and eliminating redundant function expansions. These are described below.

[0159] (1) Eliminating redundant reachability judgments

[0160] To eliminate redundant reachability judgments, when both a dominating and post-dominant relationship exists between a memory allocation point and a release point, the memory behavior between these two points can be determined to be reasonable, eliminating the need to perform reachability judgments on multiple paths in the intermediate process. Therefore, when both a dominating and post-dominant relationship exists between the allocation point and the release point of a memory block pointed to by a pointer, the memory block can be marked as not requiring a reachability judgment. This allows subsequent determination that all paths between the allocation point and release point of this memory block are reachable, eliminating the need to perform sequential judgments on the paths between the allocation point and release point of this memory block, thereby improving analysis efficiency.

[0161] For example, as shown in (A) of FIG. 10, it shows the CFG of a certain analysis unit. Each node represents a BB. A memory allocation operation is performed at BB1, and a memory release operation is performed at BB7. At the end of BB1, through the judgment of condition a, it branches to two branches, BB2 and BB3 respectively. After converging to BB4, through the judgment of condition b, it branches to two branches, BB5 and BB6 respectively, and finally converges to BB7. The whole process can be regarded as having four paths: BB1→BB2→BB4→BB5→BB7, BB1→BB2→BB4→BB6→BB7, BB1→BB3→BB4→BB5→BB7, and BB1→BB3→BB4→BB6→BB7. To determine whether the memory allocation, usage, and release on each path are reasonable, it is necessary to separately judge the reachability of the four paths. From the CFG, it can be seen that starting from BB1, it will definitely pass through BB7 (BB1 dominates BB7), and to reach BB7, it must first pass through BB1 (BB7 post-dominates BB1). Therefore, the order of memory allocation, usage, and release is reasonable, and reachability judgment is not required for analysis. Based on the dominance and post-dominance relationships, the reachability can be directly judged, and the original four paths can be directly regarded as one path for judgment, as shown in (B) of FIG. 10. After that, the statements on this one path can be analyzed.

[0162] (2) Eliminate unreachable paths

[0163] For eliminating unreachable paths, when there are some definitely unreachable branches in the analysis unit, customized compilation technology can be used to find and eliminate them. These scenarios include judgments on whether a single condition such as if(flag) or while(flag) is always true / false, and judgments on whether two conditions such as if(a) ---- if(b) are always the same, etc. The customized technology mainly includes two parts: the value range propagation algorithm (VRP) for calculating and propagating the value range of variables, and the simplify control flow graph (simplify CFG) algorithm for streamlining and eliminating the CFG.

[0164] Among them, for code of the type "if(i<n)A; else B;", the VRP algorithm can be used to solve and propagate the value range of the judgment object i in the conditional statement to confirm the satisfiability of the judgment condition i<n. If the condition i<n will definitely be satisfied, the simplify CFG algorithm is used to eliminate branch B. If the condition i<n will definitely not be satisfied, the simplify CFG algorithm is used to eliminate branch A. Otherwise, no processing is done.

[0165] For code of the type "while(i<n)A;", the VRP algorithm can be used to solve and propagate the value range of the judgment object i in the conditional statement, and confirm the satisfiability of the judgment condition i < n. If i < n will definitely not be satisfied, the A branch is eliminated using the simplify CFG algorithm; otherwise, no action is taken.

[0166] For code of the type "if(a)A; else B; if(b)C; else D;", the VRP algorithm can be used to solve and propagate the value ranges of the judgment objects a and b in the conditional statement, and confirm the satisfiability of a == b. If it will definitely be satisfied, the A-C branch and the B-D branch are connected using the simplify CFG algorithm; if it will definitely not be satisfied, the A-D branch and the B-C branch are connected using the simplify CFG algorithm; otherwise, no action is taken.

[0167] For example, as shown in (A) of FIG. 11, it shows the CFG of a certain analysis unit, where each node represents a BB, and both BB1 and BB4 use the condition a for branch judgment. Through analysis, it can be seen that there are four paths in the figure: BB1→BB2→BB4→BB5→BB7, BB1→BB2→BB4→BB6→BB7, BB1→BB3→BB4→BB5→BB7, BB1→BB3→BB4→BB6→BB7. However, the two paths BB1→BB2→BB4→BB6→BB7 and BB1→BB3→BB4→BB5→BB7 are definitely unreachable and do not require reachability judgment. Through the VRP algorithm, it can be known that the judgment conditions in BB1 and BB4 are the same. The BB1→BB2 branch is judged at BB4 and will definitely reach BB5 and cannot reach BB6. Using the simplify CFG algorithm, the CFG of this analysis unit can be changed according to the above conclusion. Delete BB4, let BB2 directly point to BB5, and BB3 directly point to BB6. In this way, subsequent work such as summary generation and code generation can be completed based on the new CFG, thereby reducing the number of paths that need to be judged subsequently and improving the analysis efficiency.

[0168] (3) Eliminate redundant function inlining

[0169] For eliminating redundant function inlining, when the function call result is used as a judgment condition and affects reachability analysis, function inlining (i.e., inline, expand the function body here) can be performed; otherwise, no inline is performed.

[0170] For example, as shown in Figure 12 (A), it shows the CFG of a certain analysis unit, where each node represents a BB. In this analysis unit, memory allocation and deallocation occur at BB1 and BB3, respectively. It is necessary to determine the reachability of the path if(funcA(...))→BB1→if(funcB(...))→BB3. This reachability depends on whether the return values ​​of functions funcA(..) and funcB(..) are the same. Therefore, inline expansion is required to clarify the determination result.

[0171] As shown in (B) of Figure 12, it shows the CFG of a certain analysis unit, where each node represents a BB. In this analysis unit, memory allocation and release occur at BB1 and BB4, respectively. To ensure that there is no reuse after release, it is necessary to determine that memory release is not performed at funcA(...); to ensure that there is no memory leak, it is necessary to determine that memory release is performed at funcB(...). The judgment of memory behavior can be obtained through the function summary, and there is no need for inline expansion. Moreover, once inline behavior occurs, the number of paths increases (for example, there are 4 paths after funcA is expanded, because the subsequent funcB(...) and BB4 are 2 paths, the entire CFG becomes 4*2=8 paths), which increases the workload of reachability judgment and brings the risk of false positives (once the reachability judgment is unclear, false positives are likely to occur).

[0172] It should be understood that in the time-based memory problem detection system 900 shown in FIG9 , the state normalization module 910 and the local optimization module 920 can be selected either alone or simultaneously, depending on the actual situation and is not limited here.

[0173] The above is an introduction to the time-related memory problem detection system provided by the embodiment of the present application. Next, based on the above content, a time-related memory security detection method provided by the embodiment of the present application is introduced. Among them, part or all of the content of this method can be referred to the above introduction to the time-related memory problem detection system.

[0174] For example, FIG13 shows a flow chart of a time-based memory security detection method provided by an embodiment of the present application. It is understood that the method can be executed by any device, equipment, platform, or device cluster with computing and processing capabilities. As shown in FIG13 , the time-based memory security detection method may include the following steps:

[0175] S1301. Based on source code, obtain multiple analysis units, where an analysis unit includes a function or a function group.

[0176] In this embodiment, when analyzing the source code for time-related memory problems, multiple analysis units can be obtained from the source code first, for example, by partitioning the source code. This decouples the memory behaviors of each analysis unit, so that the calling order between the analysis units can be ignored in subsequent analysis. Each analysis unit can include a function or a function group. For example, for this step, please refer to the aforementioned introduction to the program partitioning module 110 in the time-related memory problem detection system, which will not be repeated here.

[0177] S1302. Perform a state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein the multiple analysis units include a first analysis unit and a second analysis unit, the first analysis unit includes a function call statement, and the function call statement is used to call the second analysis unit. When the function call statement is analyzed, the summary information of the second analysis unit is used to perform a state analysis on the state of the memory block pointed to by the pointer associated with the function call statement. The summary information of the analysis unit is used to describe the memory state of the memory block pointed to by the input and output pointers in the analysis unit when entering and exiting the analysis unit.

[0178] In this embodiment, after obtaining multiple analysis units, the state of the memory block pointed to by the pointer in any analysis unit can be analyzed. When analyzing a function call statement contained in a certain analysis unit, the summary information of the analysis unit called by the function call statement can be used to analyze the state of the memory block pointed to by the pointer associated with the function call statement (e.g., the pointer assigned by the function call statement, the pointer used by the function call statement, etc.). Input and output pointers can be pointers associated with formal parameters, global variables, and return values. For example, if there is a function call statement p=funB() in analysis unit A, the state of the memory block pointed to by the return value of analysis unit B is directly used as the state of the memory block pointed to by p. Exemplarily, the summary information of the analysis unit is used to describe the memory state of the memory block pointed to by the input and output pointers in the analysis unit when entering and exiting the analysis unit. Exemplarily, the summary information of the second analysis unit can be, but is not limited to, pre-obtained.

[0179] In this embodiment, the summary information of the analysis unit includes: summary information of the input and output pointers in the analysis unit. When the input and output pointers include a second pointer, the summary information of the second pointer may include one or more of the following: the identifier of the second pointer, the position of the formal parameters, global variables or return values ​​associated with the second pointer in the analysis unit, the relationship between the second pointer and the formal parameters, global variables and return values ​​in the analysis unit, the state of the memory block pointed to by the second pointer when entering or exiting the analysis unit, or the alias and non-alias relationship between the second pointer and other pointers in the input and output pointers of the analysis unit except the second pointer. For the data structure of the summary information, please refer to the description in Figures 2 or 3 above, which will not be repeated here. In some embodiments, when the state analysis is performed for the first time on the state of the memory block pointed to by the pointer in a certain analysis unit, the state of the memory block pointed to by the pointer in the summary information of the analysis unit can be empty or a certain initial value. The specific value can be determined according to the actual situation and is not limited here.

[0180] As a possible implementation method, when performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, the statements in the analysis unit can be traversed based on the preset state transition rules, and the state analysis can be performed on the state of the memory block pointed to by the pointer in the analysis unit. Exemplarily, the state transition rule can be the state transition rule shown in Figure 5. Among them, the state transition rule can be used to describe the state change rule of the memory block pointed to by the pointer when assigning a value to a certain pointer or using the pointer. Exemplarily, for the process of performing state analysis based on the state transition rule, please refer to the relevant description in the aforementioned Figure 5 for details, which will not be repeated here. In addition, in this way, during the analysis process, memory allocation points, memory release points and memory usage points can be identified by function statements, so that time-related memory problems related to memory usage points can be solved, such as: repeated release, reuse after release, etc.

[0181] As another possible implementation, when performing state analysis on the memory blocks pointed to by pointers in the analysis unit, a value flow graph can be constructed to characterize the relationships between pointers in the analysis unit, and memory allocation points and memory release points can be identified on the value flow graph. Subsequently, the state analysis of the memory blocks pointed to by pointers in the analysis unit can be performed using the value flow graph, or using the value flow graph and CFG. However, since this method makes it difficult to identify memory usage points, it is difficult to identify time-related memory issues such as repeated release and reuse after release.

[0182] S1303: Generate summary information of the analysis unit according to the status analysis result corresponding to the analysis unit, and obtain detection results related to time-related memory problems in the analysis unit.

[0183] In this embodiment, after completing the state analysis of a memory block pointed to by a pointer in an analysis unit, the state analysis results can be used to identify whether statements related to that memory block in the analysis unit have time-related memory issues. After completing the state analysis of all memory blocks pointed to by pointers in the analysis unit, the state analysis results can be used to identify the time-related memory issues present in the analysis unit, thereby obtaining a detection result related to the time-related memory issues in the analysis unit. This allows the user to determine the area in the analysis unit where the time-related memory issues exist through the detection results. Exemplarily, the detection results may include one or more of the following: the module with the time-related memory issue, the line of code with the time-related memory issue, the line or column in the source code where the pointer with the time-related memory issue resides, or the execution path from the memory allocation point with the time-related memory issue to the error reporting point. The error reporting point may include a memory usage point or a memory release point. Furthermore, summary information for the analysis unit can be generated based on the state analysis results of the memory blocks executed by the pointers in the analysis unit, allowing for state analysis based on the summary information. For details, please refer to the aforementioned description of the local analysis module 123 and will not be repeated here.

[0184] As a possible implementation method, when the state analysis result indicates that the state of the memory block is a terminated state, it can be determined that the statements related to the memory block in the analysis unit have time-related memory problems. The terminated state is used to indicate that the memory block is not used correctly. At this time, the error type and error statement can be determined based on the type of the terminated state. The error type includes one or more of repeated release, memory leak, and reuse after release, and the error statement includes one or more of memory allocation statement, memory usage statement, and memory release statement. In this way, the code line or statement with time-related memory problems is identified. When the state analysis result indicates that the state of the memory block is an intermediate state, it can be determined that the statements related to the memory block in the analysis unit do not have time-related memory problems. The intermediate state is used to indicate that the memory block is being used correctly.

[0185] Therefore, when detecting time-related memory issues, by partitioning the source code, the memory behavior between different analysis units can be decoupled. This allows for separate analysis of whether time-related memory issues exist in each analysis unit, avoiding global analysis and thus reducing resource overhead. Furthermore, by using the summary information of the analysis unit, calling behavior exists between analysis units, and when analyzing the caller, the summary information of the callee can be directly queried without having to analyze the internal memory behavior of the callee, reducing the amount of analysis and improving analysis efficiency. Simultaneously, during the detection process, the summary information can be used to analyze memory behavior across analysis units, thus enabling cross-analysis unit memory behavior detection and reducing the false positive rate. Furthermore, the summary information of the analysis unit includes the status of the memory blocks corresponding to the pointers associated with formal parameters, global variables, and return values. This allows the summary information to include all information about the analysis unit's interaction with the outside world, thereby reducing the loss between the summary information of the analysis unit and the actual memory behavior within the analysis unit.

[0186] In some embodiments, the aforementioned step of performing state analysis on the memory block pointed to by the pointer in the analysis unit in S1302 may specifically include iteratively performing state analysis on the memory block pointed to by the pointer in the analysis unit. In this case, during the current iteration, the summary information generated in the previous iteration is used to perform state analysis on the memory block pointed to by the pointer in the analysis unit. In this way, accurate summary information can be obtained through iterative analysis. For example, if the analysis units are funA and funB, and funA contains the statement p=funB(), when analyzing funA, the state of p inherits the state of the return value of funB on the right side. However, the state of funB's return value must be obtained from the summary of funB. Because it is difficult to control the order in which the summary information of funA and funB is generated in this iteration, the summary information of funB generated in the previous iteration is used in this iteration. For example, to speed up detection, the state analysis of the memory block pointed to by the pointer in the analysis unit can be performed in parallel iterations. For example, the current round of iteration may be the latest round of iteration. For example, if the latest round of iteration is the 5th round of iteration, then the 5th round is the current round. In addition, if the current round is the i-th round, then the round before the current round is the i-1th round.

[0187] At this point, the aforementioned step of generating summary information for the analysis unit based on the state analysis results corresponding to the state analysis, and obtaining the detection results related to the time-related memory issues in the analysis unit in S1303, may specifically include: identifying the time-related memory issues existing in the analysis unit and updating the summary information of the analysis unit based on the state analysis results obtained in the current iteration; and, if the summary information of multiple analysis units will not be updated, using the time-related memory issues existing in the multiple analysis units identified in the last iteration as the final detection result. Since the summary information of all analysis units is no longer updated, it can be understood that the summary information at this time is correct, and therefore the time-related memory issues identified at this time are also accurate. In this way, using the time-related memory issues identified in the last iteration as the final detection result can improve the accuracy of the detection. In addition, by constructing the summary information and iteratively using the summary information obtained in the previous iteration, it is possible to avoid the need to construct a call graph describing the call relationships between all analysis units, thereby eliminating the need to consider the analysis order between analysis units. At the same time, since building a call graph requires global pointer analysis, it consumes a lot of resources. However, in this application, since there is no need to build a call graph, the resource overhead can be greatly reduced.

[0188] As another possible implementation, in addition to iteratively analyzing multiple analysis units, one analysis unit can be processed first, followed by another. For example, referring to FIG8 , funD can be analyzed first, and then funC can be analyzed after that is analyzed. In other words, each analysis unit can be processed sequentially from the bottom up along the function call graph. Of course, other methods can also be used, depending on the actual situation and are not limited here.

[0189] In some embodiments, before the aforementioned S1302, when there are multiple different branches pointing to the same node in the control flow chart of the analysis unit, the states of the memory blocks pointed to by the pointers passed by the multiple different branches can be normalized. In this way, the states of the memory blocks pointed to by the pointers passed by these branches can be made unique, thereby reducing the false alarm rate. Exemplarily, when normalizing, the wild pointers in multiple different branches can be converted into null pointers. The state of the memory block pointed to by the null pointer can be any state. In addition, a prompt message can also be output to prompt the user to modify the code in the analysis unit, thereby completing the normalization operation. For the normalization process of the memory block state, please refer to the aforementioned introduction to the state normalization module 910 in the time-type memory problem detection system 900, which will not be repeated here.

[0190] In some embodiments, before the aforementioned S1302, redundant paths in the analysis unit may be eliminated to improve detection efficiency and reduce false positives. Eliminating redundant paths in the analysis unit may include one or more of the following:

[0191] In the case where a dominating and post-dominating relationship exists between a memory allocation point and a release point of the memory block pointed to by the second pointer in the analysis unit, determining that it is not necessary to perform reachability determination on the memory block pointed to by the second pointer;

[0192] Alternatively, when the condition in the if statement in the analysis unit is always true (i.e., always established), eliminate the branch in the if statement where the condition is false, that is, eliminate the branch in the if statement where the condition is not established; when the condition in the if statement in the analysis unit is always false (i.e., always not established), eliminate the branch in the if statement where the condition is true, that is, eliminate the branch in the if statement where the condition is established;

[0193] Alternatively, when the condition in the while statement in the analysis unit is always false (i.e., always not true), eliminate the branch in the while statement where the condition is true, that is, eliminate the branch in the if statement where the condition is true;

[0194] Alternatively, if the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement is the same as the condition in the second if statement, the second if statement is eliminated, and the branch in which the condition in the second if statement is true (i.e., the branch in which the condition is satisfied) is added to the branch in which the condition in the first if statement is true, and the branch in which the condition in the second if statement is false (i.e., the branch in which the condition is not satisfied) is added to the branch in which the condition in the first if statement is false; if the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement is the opposite to the condition in the second if statement, the second if statement is eliminated, and the branch in which the condition in the second if statement is true is added to the branch in which the condition in the first if statement is false, and the branch in which the condition in the second if statement is false is added to the branch in which the condition in the first if statement is true;

[0195] Alternatively, if the result of a function call in the analysis unit is used as a judgment condition, and the judgment condition affects the path reachability judgment, the function is expanded and inlined. If the result of a function call in the analysis unit is not used as a judgment condition, or the judgment condition does not affect the path reachability judgment, the function is not inlined. The process of eliminating redundant paths in the analysis unit is detailed in the aforementioned introduction to the local optimization module 920 in the time-related memory problem detection system 900, and will not be repeated here.

[0196] In some embodiments, when performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, if there are multiple different branches pointing to the same node in the control flow graph of the analysis unit, the first state of the memory block corresponding to the node when the first variable transmitted from the first branch of the multiple branches enters the node can be recorded. Then, based on the recorded first state, the statements in the nodes on the edges associated with the node and unexplored in the control flow graph are traversed, and the state analysis of the memory blocks pointed to by the pointers in the traversed statements is performed. This simplifies the path exploration space, improves path exploration efficiency, and thus improves detection efficiency. Among them, when traversing the statements in the nodes on the edges associated with the node and unexplored in the control flow graph and performing state analysis on the state of the memory blocks pointed to by the pointers in the traversed statements, the first state can be compared with the states of the memory blocks pointed to by the pointers transmitted from other branches to confirm whether these branches have time-related memory problems. Please refer to the above introduction to the local analysis module 123 in the time-related memory problem detection system 100 for details, which will not be repeated here.

[0197] In some embodiments, when the second state of the memory block corresponding to the node is inconsistent with the first state when the pointer transmitted from other branches in multiple branches enters the node, the error type and error statement are determined according to the conflict between the first state and the second state. The error type includes: one or more of repeated release, memory leak and reuse after release, and the error statement includes: one or more of memory allocation statement, memory use statement and memory release statement. In this way, by comparing the recorded state with the state of the memory block corresponding to the node when the pointer transmitted from the current branch enters the node, it is possible to know whether there are time-related memory problems in the two branches, thereby improving detection efficiency.

[0198] In some embodiments, when a pointer from another branch among multiple branches enters a node and the second state of the memory block corresponding to the node is inconsistent with the first state, and the first state is allocated, a null assignment statement is added to the other branch to assign the pointer from the other branch to null. This approach normalizes the states of the memory blocks pointed to by pointers from multiple different branches, making the states of the memory blocks pointed to by the pointers from these branches unique and reducing the false positive rate.

[0199] In addition, a prompt message can also be output. This prompt message can be used to prompt the user to change the second state to the empty state, or to change the second state to the first state. In this way, the user can normalize the states of the memory blocks pointed to by pointers from multiple different branches based on their needs, thereby resolving conflicts between the first state and the second state.

[0200] In some embodiments, after the aforementioned S1304, a constraint solver (such as a Z3 solver) may be used to correct the detection result, thereby further reducing the false alarm rate.

[0201] It can be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0202] The above is an introduction to the time-based memory security detection method provided by the embodiment of the present application. Next, based on the method in the above embodiment, a time-based memory security detection device provided by the embodiment of the present application is introduced.

[0203] For example, FIG14 shows a schematic diagram of the structure of a time-based memory security detection device provided by an embodiment of the present application. As shown in FIG14 , the time-based memory security detection device may include: a first processing module 1401 and a second processing module 1402. Specifically, the first processing module 1401 and the second processing module 1402. Specifically, the first processing module 1401 is used to obtain multiple analysis units based on the source code, and the analysis unit includes a function or a function group. The second processing module 1402 is used to perform state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein the multiple analysis units include a first analysis unit and a second analysis unit, and the first analysis unit includes a function call statement, and the function call statement is used to call the second analysis unit. When the function call statement is analyzed, the summary information of the second analysis unit is used to perform state analysis on the state of the memory block pointed to by the pointer associated with the function call statement. The summary information of the analysis unit is used to describe the memory state of the memory block pointed to by the input and output pointers in the analysis unit when entering and exiting the analysis unit. The second processing module 1402 is further used to generate summary information of the analysis unit based on the state analysis results corresponding to the analysis unit, and obtain detection results related to time-related memory problems in the analysis unit. Exemplarily, the first processing module 1401 can be the program partitioning module 110 described above. The second processing module 1402 can be the summary generation module 120 described above, or can be mainly composed of the state normalization module 910 and the summary generation module 120 described above, or can be mainly composed of the local optimization module 920 and the summary generation module 120 described above, or can be mainly composed of the state normalization module 910, the local optimization module 920, and the summary generation module 120 described above.

[0204] In some embodiments, when performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, the second processing module 1402 is specifically used to: iteratively perform state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein, during the current round of iteration, the summary information generated in the previous round of iteration is used to perform state analysis on the state of the memory block pointed to by the pointer in the analysis unit.

[0205] When the second processing module 1402 generates summary information of the analysis unit based on the state analysis results corresponding to the state analysis and obtains the detection results related to the time-related memory problems in the analysis unit, it is specifically used to: during the iteration process, identify the time-related memory problems existing in the analysis unit based on the state analysis results obtained in the current round of iteration, and update the summary information of the analysis unit; and, when the summary information of multiple analysis units will no longer be updated, use the time-related memory problems existing in multiple analysis units identified in the last round of iteration as the final detection results.

[0206] In some embodiments, when performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, the second processing module 1402 is specifically configured to: traverse the statements in the analysis unit based on a preset state transition rule, and perform state analysis on the state of the memory block pointed to by the pointer in the analysis unit. The state transition rule is used to describe a state change rule for the memory block pointed to by the first pointer when a value is assigned to the first pointer or the first pointer is used.

[0207] In some embodiments, when the second processing module 1402 identifies the time-related memory problems existing in the analysis unit based on the state analysis results corresponding to the state analysis, it is specifically used to: when the state analysis results indicate that the state of the memory block is a terminated state, determine that the statements related to the memory block in the analysis unit have time-related memory problems, and, based on the type of the terminated state, determine the error type and error statement, wherein the terminated state is used to characterize that the memory block is not used correctly, the error type includes: one or more of repeated release, memory leak and reuse after release, and the error statement includes: one or more of memory allocation statement, memory usage statement and memory release statement; when the state analysis result indicates that the state of the memory block is an intermediate state, determine that the statements related to the memory block in the analysis unit do not have time-related memory problems, and the intermediate state is used to characterize that the memory block is being used correctly.

[0208] In some embodiments, the summary information of the analysis unit includes summary information of pointers associated with formal parameters, global variables, and return values ​​in the analysis unit, wherein the pointers associated with the formal parameters, global variables, and return values ​​include second pointers. Exemplarily, the pointers associated with the formal parameters, global variables, and return values ​​can be understood as input and output pointers.

[0209] The summary information of the second pointer includes one or more of the following: the identifier of the second pointer, the position of the formal parameters, global variables or return values ​​associated with the second pointer in the analysis unit, the relationship between the second pointer and the formal parameters, global variables and return values ​​in the analysis unit, the state of the memory block pointed to by the second pointer when entering or exiting the analysis unit, or the alias and non-alias relationship between the second pointer and pointers other than the second pointer in the analysis unit that are associated with the formal parameters, global variables and return values.

[0210] In some embodiments, the input and output pointers in the analysis unit may include one or more of the following: a pointer related to a formal parameter or a return value and brought into or out of the analysis unit, or a global variable, or a pointer related to a global variable and brought into or out of the analysis unit by the global variable.

[0211] In some embodiments, before performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, the second processing module 1402 is also used to: when there are multiple different branches pointing to the same node in the control flow graph of the analysis unit, normalize the states of the memory blocks pointed to by the pointers transmitted by multiple different branches.

[0212] In some embodiments, when normalizing the states of the memory blocks pointed to by the pointers transmitted from multiple different branches, the second processing module 1402 is specifically configured to: convert the wild pointers in the multiple different branches into null pointers.

[0213] In some embodiments, before performing status analysis on the status of the memory block pointed to by the pointer in the analysis unit, the second processing module 1402 is further configured to eliminate redundant paths in the analysis unit.

[0214] In some embodiments, eliminating redundant paths in the analysis unit includes one or more of the following:

[0215] In the case where a dominating and post-dominating relationship exists between a memory allocation point and a release point of the memory block pointed to by the second pointer in the analysis unit, determining that it is not necessary to perform reachability determination on the memory block pointed to by the second pointer;

[0216] Alternatively, when the condition in the if statement in the analysis unit is always true, eliminate the branch in the if statement where the condition is false; when the condition in the if statement in the analysis unit is always false, eliminate the branch in the if statement where the condition is true;

[0217] Alternatively, when the condition in the while statement in the analysis unit is always false, eliminate the branch in the while statement where the condition is true;

[0218] Alternatively, when the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement and the condition in the second if statement have the same value, the second if statement is eliminated, and the branch in which the condition in the second if statement is true is added to the branch in which the condition in the first if statement is true, and the branch in which the condition in the second if statement is false is added to the branch in which the condition in the first if statement is false; when the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement and the condition in the second if statement have opposite values, the second if statement is eliminated, and the branch in which the condition in the second if statement is true is added to the branch in which the condition in the first if statement is false, and the branch in which the condition in the second if statement is false is added to the branch in which the condition in the first if statement is true;

[0219] Alternatively, when the result of calling a function in the analysis unit is used as a judgment condition and the judgment condition affects the path reachability judgment, the function is expanded and inlined; when the result of calling a function in the analysis unit is not used as a judgment condition, or the judgment condition does not affect the path reachability judgment, the function is not inlined.

[0220] In some embodiments, the second processing module 1402 is also used to: in the process of performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, when there are multiple different branches pointing to the same node in the control flow graph of the analysis unit, record the first state of the memory block corresponding to the node when the first variable passed out of the first branch of the multiple branches enters the node; based on the recorded first state, traverse the statements in the nodes on the unexplored edges associated with the node in the control flow graph, and perform state analysis on the state of the memory block pointed to by the pointer in the traversed statement.

[0221] In some embodiments, the second processing module 1402 is further configured to: when a pointer from another branch among the multiple branches enters a node and the second state of the memory block corresponding to the node is inconsistent with the first state, determine an error type and an error statement based on the conflict between the first state and the second state. The error type includes one or more of: duplicate free, memory leak, and use-after-free; and the error statement includes one or more of: memory allocation statement, memory usage statement, and memory release statement.

[0222] In some embodiments, the second processing module 1402 is also used to: when the second state of the memory block corresponding to the node is inconsistent with the first state when the pointer passed from other branches in multiple branches enters the node, and the first state is allocated, add a null assignment statement in other branches, and the null assignment statement is used to assign the pointer passed from other branches to null; or, output a prompt message, and the prompt message is used to prompt to change the second state to an empty state, or to change the second state to the first state.

[0223] In some embodiments, after obtaining the detection result related to the time-related memory problem in the analysis unit, the second processing module 1402 is further configured to: modify the detection result using a constraint solver.

[0224] In some embodiments, the detection results include one or more of the following: the module with the time-related memory problem, or the line of code with the time-related memory problem, or the line or column of the pointer with the time-related memory problem in the source code, or the execution path from the memory allocation point with the time-related memory problem to the error point, where the error point includes the memory usage point or the memory release point.

[0225] In some embodiments, the first processing module 1401 and the second processing module 1402 shown in FIG14 can both be implemented by software or by hardware. For example, the implementation of the first processing module 1401 will be described below using the first processing module 1401 as an example. Similarly, the implementation of the second processing module 1402 can refer to the implementation of the first processing module 1401. Furthermore, the processing module 901 and the communication module 902 shown in FIG15 can also both be implemented by software or by hardware. For details, see the description of the communication module 902 and the processing module 901 shown in FIG14 , which will not be repeated here.

[0226] As an example of a software functional unit, the first processing module 1401 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Furthermore, the computing instance may be one or more. For example, the first processing module 1401 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple geographically close data centers. Typically, a region may include multiple AZs.

[0227] Similarly, multiple hosts / virtual machines / containers running the code can be distributed within the same virtual private cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Cross-region communication between two VPCs within the same region, or between VPCs in different regions, requires a communication gateway within each VPC to interconnect the VPCs.

[0228] As an example of a hardware functional unit, the first processing module 1401 may include at least one computing device, such as a server. Alternatively, the first processing module 1401 may be implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0229] The multiple computing devices included in the first processing module 1401 can be distributed in the same region or in different regions. The multiple computing devices included in the first processing module 1401 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the first processing module 1401 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0230] It should be noted that, in other embodiments, the first processing module 1401 can be used to execute any step in the time-type memory problem detection method described in the above embodiments, and the second processing module 1402 can be used to execute any step in the time-type memory problem detection method described in the above embodiments. The steps that the first processing module 1401 and the second processing module 1402 are responsible for implementing can be specified as needed. The first processing module 1401 and the second processing module 1402 respectively implement different steps in the time-type memory problem detection method described in the above embodiments to achieve all the functions of the time-type memory problem detection device 1400 shown in Figure 14.

[0231] This application also provides a computing device 1500. As shown in Figure 15, computing device 1500 includes a bus 1502, a processor 1504, a memory 1506, and a communication interface 1508. Processor 1504, memory 1506, and communication interface 1508 communicate with each other via bus 1502. Computing device 1500 can be a server or an electronic device. It should be understood that this application does not limit the number of processors and memories in computing device 1500.

[0232] Bus 1502 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, among others. Buses may be classified as address buses, data buses, control buses, and the like. For ease of illustration, FIG15 shows a single line, but this does not imply a single bus or type of bus. Bus 1504 may include a path for transmitting information between various components of computing device 1500 (e.g., memory 1506, processor 1504, and communication interface 1508).

[0233] The processor 1504 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0234] The memory 1506 may include volatile memory, such as random access memory (RAM). The processor 1504 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0235] Memory 1506 stores executable program code, which processor 1504 executes to implement the functions of first processing module 1401 and second processing module 1402 shown in FIG. 14 , thereby implementing the method for detecting time-related memory issues described in the above embodiment. Specifically, memory 1506 stores instructions for executing the method for detecting time-related memory issues described in the above embodiment.

[0236] Alternatively, the memory 1506 stores executable code, and the processor 1504 executes the executable code to implement the functions of the time-related memory problem detection device 1400 shown in FIG. 14 , thereby implementing the time-related memory problem detection method described in the above embodiment. That is, the memory 1506 stores instructions for executing the time-related memory problem detection method described in the above embodiment.

[0237] The communication interface 1503 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 1500 and other devices or a communication network.

[0238] Embodiments of the present application also provide a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be an electronic device such as a desktop computer, a laptop computer, or a smartphone.

[0239] As shown in Figure 16, the computing device cluster includes at least one computing device 1500. The memory 1506 in one or more computing devices 1500 in the computing device cluster may store the same instructions for executing the time-related memory problem detection method described in the above embodiment.

[0240] In some possible implementations, the memory 1506 of one or more computing devices 1500 in the computing device cluster may also store partial instructions for executing the method for detecting time-related memory issues described in the above embodiments. In other words, the combination of one or more computing devices 1500 can collectively execute instructions for executing the method for detecting time-related memory issues described in the above embodiments.

[0241] It should be noted that the memory 1506 in different computing devices 1500 in the computing device cluster can store different instructions, each for executing a portion of the functions of the time-related memory problem detection apparatus 1400 shown in FIG14 . In other words, the instructions stored in the memory 1506 in different computing devices 1500 can implement the functions of one or more of the first processing module 1401 and the second processing module 1402.

[0242] In some possible implementations, one or more computing devices in a computing device cluster may be connected via a network. The network may be a wide area network (WAN) or a local area network (LAN), among others. FIG. 17 illustrates a possible implementation. As shown in FIG. 17 , two computing devices 1500A and 1500B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 1506 in the computing device 1500A stores instructions for executing the functions of the first processing module 1401. Simultaneously, the memory 1506 in the computing device 1500B stores instructions for executing the functions of the second processing module 1402.

[0243] It should be understood that the functionality of the computing device 1500A shown in FIG17 may also be implemented by multiple computing devices 1500. Similarly, the functionality of the computing device 1500B may also be implemented by multiple computing devices 1500.

[0244] The present application also provides another computing device cluster. The connection relationship between the computing devices in this computing device cluster can be similar to the connection method of the computing device cluster described in Figures 16 and 17. The difference is that the memory 1506 of one or more computing devices 1500 in this computing device cluster can store the same instructions for executing the method of the above embodiment.

[0245] In some possible implementations, the memory 1506 of one or more computing devices 1500 in the computing device cluster may also store partial instructions for executing the aforementioned method for detecting time-related memory issues. In other words, the combination of one or more computing devices 1500 can collectively execute instructions for executing the aforementioned method for detecting time-related memory issues.

[0246] Based on the method in the above embodiment, an embodiment of the present application provides a computer-readable storage medium, including computer program instructions. When the computer program instructions are executed by a computing device, the computing device executes the method in the above embodiment; or, when the computer program instructions are executed by a computing device cluster, the computing device cluster executes the method in the above embodiment. Exemplarily, the computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center that contains one or more available media. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid-state drive), etc.

[0247] Based on the method in the above embodiment, an embodiment of the present application provides a computer program product containing instructions, which, when executed by a computing device, enables the computing device to execute the method in the above embodiment, or, when executed by a computing device cluster, enables the computing device cluster to execute the method in the above embodiment.

[0248] It is understood that the processor in the embodiments of the present application may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

[0249] The method steps in the embodiments of the present application can be implemented by hardware or by a processor executing software instructions. The software instructions can be composed of corresponding software modules, which can be stored in random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, mobile hard disks, CD-ROMs or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC.

[0250] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted via the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state drive (SSD)).

[0251] It will be understood that the various numerical numbers involved in the embodiments of the present application are merely distinctions for the convenience of description and are not intended to limit the scope of the embodiments of the present application.

[0252] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A time-based memory security detection method, characterized in that: The method comprises: Based on the source code, a plurality of analysis units are obtained, wherein the analysis unit includes a function or a function group; Performing a state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein the multiple analysis units include a first analysis unit and a second analysis unit, the first analysis unit includes a function call statement, the function call statement is used to call the second analysis unit, and when the function call statement is analyzed, using the summary information of the second analysis unit, performing a state analysis on the state of the memory block pointed to by the pointer associated with the function call statement, the summary information of the analysis unit is used to describe the memory state of the memory block pointed to by the entry and exit pointers in the analysis unit when entering and exiting the analysis unit; According to the status analysis result corresponding to the analysis unit, the summary information of the analysis unit is generated, and the detection result related to the time-related memory problem in the analysis unit is obtained.

2. The method according to claim 1, characterized in that The performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit includes: Iteratively performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein in the current round of iteration, using summary information generated in the previous round of iteration, the state analysis is performed on the state of the memory block pointed to by the pointer in the analysis unit; Generating summary information of the analysis unit according to the state analysis result corresponding to the state analysis, and obtaining the detection result related to the time-related memory problem in the analysis unit, includes: During the iteration process, based on the status analysis results obtained in the current round of iteration, the time-related memory problems existing in the analysis unit are identified, and the summary information of the analysis unit is updated; and, when the summary information of the multiple analysis units will not be updated any more, the time-related memory problems existing in the multiple analysis units identified in the last round of iteration are used as the final detection results.

3. The method according to claim 1 or 2, characterized in that: The summary information of the analysis unit includes: summary information of the input and output pointers in the analysis unit, the input and output pointers including the second pointer; The summary information of the second pointer includes one or more of the following: the identifier of the second pointer, the position of the formal parameters, global variables or return values ​​associated with the second pointer in the analysis unit, the relationship between the second pointer and the formal parameters, global variables and return values ​​in the analysis unit, the state of the memory block pointed to by the second pointer when entering or exiting the analysis unit, or the alias and non-alias relationship between the second pointer and other pointers in the entry and exit pointers except the second pointer.

4. The method according to any one of claims 1 to 3, characterized in that: The input and output pointers in the analysis unit include one or more of the following: A pointer associated with a formal parameter or a return value and brought into or out of the analysis unit, or a global variable, or a pointer associated with the global variable and brought into or out of the analysis unit by the global variable.

5. The method according to any one of claims 1 to 4, characterized in that: The performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit includes: Based on a preset state transfer rule, the statements in the analysis unit are traversed, and a state analysis is performed on the state of the memory block pointed to by the pointer in the analysis unit. The state transfer rule is used to describe the state change rule of the memory block pointed to by the first pointer when the first pointer is assigned a value or used.

6. The method according to any one of claims 1 to 5, characterized in that: The identifying, according to the state analysis result corresponding to the state analysis, the time memory problem existing in the analysis unit specifically includes: In the case where the state analysis result indicates that the state of the memory block is a termination state, determining that a statement related to the memory block in the analysis unit has a time-related memory problem, and determining an error type and an error statement according to the type of the termination state, wherein the termination state is used to characterize that the memory block is not used correctly, the error type includes: one or more of repeated release, memory leak, and reuse after release, and the error statement includes: one or more of a memory allocation statement, a memory use statement, and a memory release statement; When the state analysis result indicates that the state of the memory block is an intermediate state, it is determined that there is no time-related memory problem in the statements related to the memory block in the analysis unit, and the intermediate state is used to represent that the memory block is being used correctly.

7. The method according to any one of claims 1 to 6, characterized in that: Before performing status analysis on the status of the memory block pointed to by the pointer in the analysis unit, the method further includes: In the case that there are multiple different branches pointing to the same node in the control flow graph of the analysis unit, the states of the memory blocks pointed to by the pointers transmitted from the multiple different branches are normalized.

8. The method according to claim 7, characterized in that The normalizing the states of the memory blocks pointed to by the pointers transmitted by the multiple different branches specifically includes: The wild pointers in the multiple different branches are converted into null pointers.

9. The method according to any one of claims 1 to 8, characterized in that: Before performing status analysis on the status of the memory block pointed to by the pointer in the analysis unit, the method further includes: Redundant paths in the analysis unit are eliminated.

10. The method according to claim 9, characterized in that The eliminating redundant paths in the analysis unit includes one or more of the following: In the case where there is a dominating and post-dominating relationship between a memory allocation point and a release point of the memory block pointed to by the second pointer in the analysis unit, determining that there is no need to perform reachability judgment on the memory block pointed to by the second pointer; Alternatively, when the condition in the if statement in the analysis unit is always true, the branch in which the condition is false in the if statement is eliminated; when the condition in the if statement in the analysis unit is always false, the branch in which the condition is true in the if statement is eliminated; Alternatively, when the condition in the while statement in the analysis unit is always false, eliminating the branch in the while statement where the condition is true; Alternatively, when the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement has the same value as the condition in the second if statement, the second if statement is eliminated, and a branch in which the condition in the second if statement is true is added to a branch in which the condition in the first if statement is true, and a branch in which the condition in the second if statement is false is added to a branch in which the condition in the first if statement is false; When a second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement is opposite to the condition in the second if statement, the second if statement is eliminated, and a branch in which the condition in the second if statement is true is added to a branch in which the condition in the first if statement is false, and a branch in which the condition in the second if statement is false is added to a branch in which the condition in the first if statement is true; Alternatively, when the result of calling the function in the analysis unit is used as a judgment condition and the judgment condition affects the path reachability judgment, the function is expanded and inlined; when the result of calling the function in the analysis unit is not used as a judgment condition, or the judgment condition does not affect the path reachability judgment, the function is not inlined.

11. The method according to any one of claims 1-6, 9-10, characterized in that: The method further comprises: In the process of performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, when there are multiple different branches pointing to the same node in the control flow chart of the analysis unit, recording the first state of the memory block corresponding to the node when the first variable transmitted from the first branch of the multiple branches enters the node; Based on the recorded first state, statements in nodes on unexplored edges associated with the node in the control flow graph are traversed, and a state analysis is performed on the state of the memory block pointed to by the pointer in the traversed statement.

12. The method according to claim 11, characterized in that The method further comprises: When the second state of the memory block corresponding to the node is inconsistent with the first state when the pointers transmitted from other branches among the multiple branches enter the node, determine the error type and error statement according to the conflict between the first state and the second state; The error reporting types include: one or more of repeated release, memory leak and reuse after release, and the error reporting statements include: one or more of memory allocation statements, memory use statements and memory release statements.

13. The method according to claim 11, characterized in that The method further comprises: When the second state of the memory block corresponding to the node is inconsistent with the first state when the pointer transmitted from other branches among the multiple branches enters the node, and the first state is allocated, adding a null assignment statement in the other branches, wherein the null assignment statement is used to assign the pointer transmitted from the other branches to null; Alternatively, a prompt message is output, where the prompt message is used to prompt that the second state is changed to an empty state, or that the second state is changed to the first state.

14. The method according to any one of claims 1 to 13, characterized in that: After obtaining the detection result related to the time-related memory problem in the source code, the method further includes: The detection result is corrected using a constraint solver.

15. The method according to any one of claims 1 to 14, characterized in that: The test results include one or more of the following: A module with a time-related memory problem, or a line of code with a time-related memory problem, or a line or column of a pointer in the source code with a time-related memory problem, or an execution path from a memory allocation point with a time-related memory problem to an error reporting point, wherein the error reporting point includes a memory usage point or a memory release point.

16. A time memory security detection device, characterized in that: include: A first processing module, configured to obtain a plurality of analysis units based on source code, wherein the analysis unit includes a function or a function group; A second processing module is used to perform a state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein the multiple analysis units include a first analysis unit and a second analysis unit, the first analysis unit includes a function call statement, and the function call statement is used to call the second analysis unit. When the function call statement is analyzed, the summary information of the second analysis unit is used to perform a state analysis on the state of the memory block pointed to by the pointer associated with the function call statement, and the summary information of the analysis unit is used to describe the memory state of the memory block pointed to by the input and output pointers in the analysis unit when entering and exiting the analysis unit; The second processing module is further used to generate summary information of the analysis unit according to the status analysis result corresponding to the analysis unit, and obtain the detection result related to the time-related memory problem in the analysis unit.

17. The device according to claim 16, characterized in that When the second processing module performs state analysis on the state of the memory block pointed to by the pointer in the analysis unit, it is specifically used to: Iteratively performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, wherein in the current round of iteration, using summary information generated in the previous round of iteration, the state analysis is performed on the state of the memory block pointed to by the pointer in the analysis unit; The second processing module generates summary information of the analysis unit according to the state analysis result corresponding to the state analysis, identifies the time memory problem existing in the analysis unit, and obtains the detection result related to the time memory problem in the analysis unit, specifically for: During the iteration process, based on the status analysis results obtained in the current round of iteration, the time-related memory problems existing in the analysis unit are identified, and the summary information of the analysis unit is updated; and, when the summary information of the multiple analysis units will not be updated any more, the time-related memory problems existing in the multiple analysis units identified in the last round of iteration are used as the final detection results.

18. The device according to any one of claims 16 or 17, characterized in that: The summary information of the analysis unit includes: summary information of the input and output pointers in the analysis unit, the input and output pointers including the second pointer; The summary information of the second pointer includes one or more of the following: the identifier of the second pointer, the position of the formal parameters, global variables or return values ​​associated with the second pointer in the analysis unit, the relationship between the second pointer and the formal parameters, global variables and return values ​​in the analysis unit, the state of the memory block pointed to by the second pointer when entering or exiting the analysis unit, or the alias and non-alias relationship between the second pointer and other pointers in the entry and exit pointers except the second pointer.

19. The device according to any one of claims 16 to 18, characterized in that: The input and output pointers in the analysis unit include one or more of the following: A pointer associated with a formal parameter or return value and brought into or out of the analysis unit, or a global variable, or a pointer brought into or out of the analysis unit by the global variable.

20. The pointer according to any one of claims 16 to 19, characterized in that: When the second processing module performs state analysis on the state of the memory block pointed to by the pointer in the analysis unit, it is specifically used to: Based on a preset state transfer rule, the statements in the analysis unit are traversed, and a state analysis is performed on the state of the memory block pointed to by the pointer in the analysis unit. The state transfer rule is used to describe the state change rule of the memory block pointed to by the first pointer when the first pointer is assigned a value or used.

21. The device according to any one of claims 16 to 20, characterized in that: When the second processing module identifies the time memory problem existing in the analysis unit according to the state analysis result corresponding to the state analysis, it is specifically used to: In the case where the state analysis result indicates that the state of the memory block is a termination state, determining that a statement related to the memory block in the analysis unit has a time-related memory problem, and determining an error type and an error statement according to the type of the termination state, wherein the termination state is used to characterize that the memory block is not used correctly, the error type includes: one or more of repeated release, memory leak, and reuse after release, and the error statement includes: one or more of a memory allocation statement, a memory use statement, and a memory release statement; When the state analysis result indicates that the state of the memory block is an intermediate state, it is determined that there is no time-related memory problem in the statements related to the memory block in the analysis unit, and the intermediate state is used to represent that the memory block is being used correctly.

22. The device according to any one of claims 16 to 21, characterized in that: Before performing status analysis on the status of the memory block pointed to by the pointer in the analysis unit, the second processing module is further used to: In the case that there are multiple different branches pointing to the same node in the control flow graph of the analysis unit, the states of the memory blocks pointed to by the pointers transmitted from the multiple different branches are normalized.

23. The device according to claim 22, characterized in that When normalizing the states of the memory blocks pointed to by the pointers transmitted by the multiple different branches, the second processing module is specifically used to: The wild pointers in the multiple different branches are converted into null pointers.

24. The device according to any one of claims 16 to 23, characterized in that: Before performing status analysis on the status of the memory block pointed to by the pointer in the analysis unit, the second processing module is further used to: Redundant paths in the analysis unit are eliminated.

25. The device according to claim 24, characterized in that The eliminating redundant paths in the analysis unit includes one or more of the following: In the case where there is a dominating and post-dominating relationship between a memory allocation point and a release point of the memory block pointed to by the second pointer in the analysis unit, determining that there is no need to perform reachability judgment on the memory block pointed to by the second pointer; Alternatively, when the condition in the if statement in the analysis unit is always true, the branch in which the condition is false in the if statement is eliminated; when the condition in the if statement in the analysis unit is always false, the branch in which the condition is true in the if statement is eliminated; Alternatively, when the condition in the while statement in the analysis unit is always false, eliminating the branch in the while statement where the condition is true; Alternatively, when the second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement has the same value as the condition in the second if statement, the second if statement is eliminated, and a branch in which the condition in the second if statement is true is added to a branch in which the condition in the first if statement is true, and a branch in which the condition in the second if statement is false is added to a branch in which the condition in the first if statement is false; When a second if statement is executed immediately after the first if statement is executed in the analysis unit, and the condition in the first if statement is opposite to the condition in the second if statement, the second if statement is eliminated, and a branch in which the condition in the second if statement is true is added to a branch in which the condition in the first if statement is false, and a branch in which the condition in the second if statement is false is added to a branch in which the condition in the first if statement is true; Alternatively, when the result of calling the function in the analysis unit is used as a judgment condition and the judgment condition affects the path reachability judgment, the function is expanded and inlined; when the result of calling the function in the analysis unit is not used as a judgment condition, or the judgment condition does not affect the path reachability judgment, the function is not inlined.

26. The device according to any one of claims 16-21, 24, and 25, characterized in that: The second processing module is further used for: In the process of performing state analysis on the state of the memory block pointed to by the pointer in the analysis unit, when there are multiple different branches pointing to the same node in the control flow chart of the analysis unit, recording the first state of the memory block corresponding to the node when the first variable transmitted from the first branch of the multiple branches enters the node; Based on the recorded first state, statements in nodes on unexplored edges associated with the node in the control flow graph are traversed, and a state analysis is performed on the state of the memory block pointed to by the pointer in the traversed statement.

27. The device according to claim 26, characterized in that The second processing module is further used for: When the second state of the memory block corresponding to the node is inconsistent with the first state when the pointers transmitted from other branches among the multiple branches enter the node, determine the error type and error statement according to the conflict between the first state and the second state; The error reporting types include: one or more of repeated release, memory leak and reuse after release, and the error reporting statements include: one or more of memory allocation statements, memory use statements and memory release statements.

28. The device according to claim 26, characterized in that The second processing module is further used for: When the second state of the memory block corresponding to the node is inconsistent with the first state when the pointer transmitted from other branches among the multiple branches enters the node, and the first state is allocated, adding a null assignment statement in the other branches, wherein the null assignment statement is used to assign the pointer transmitted from the other branches to null; Alternatively, a prompt message is output, where the prompt message is used to prompt that the second state is changed to an empty state, or that the second state is changed to the first state.

29. The device according to any one of claims 16 to 28, characterized in that: After outputting the detection result related to the time memory problem in the source code, the second processing module is further used to: The detection result is corrected using a constraint solver.

30. The device according to any one of claims 16 to 29, characterized in that: The test results include one or more of the following: A module with a time-related memory problem, or a line of code with a time-related memory problem, or a line or column of a pointer in the source code with a time-related memory problem, or an execution path from a memory allocation point with a time-related memory problem to an error reporting point, wherein the error reporting point includes a memory usage point or a memory release point.

31. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1-15.

32. A computer-readable storage medium, characterized in that: The method comprises computer program instructions, and when the instructions are executed by a computing device cluster, the computing device cluster enables the computing device cluster to perform the method according to any one of claims 1 to 15, wherein the computing device cluster comprises at least one computing device.

33. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device cluster, the computing device cluster executes the method according to any one of claims 1 to 15, wherein the computing device cluster includes at least one computing device.

Images