Renaming Global Variables for Static Analysis Type Inference
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static analysis of incomplete applications with missing user-defined type definitions and multiple entry points with same-named variables of different types limits the quality of analysis, potentially leading to undetected vulnerabilities.
Innovation Solution
A two-pass fixed-point type inference algorithm is implemented to infer definitions of unknown user-defined types by traversing control flow paths, building inferred definitions, and propagating type information, followed by renaming global variables to distinguish between same-named but differently-typed variables, enhancing the robustness of static analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If static analysis is performed on incomplete applications with missing user-defined type definitions, then analysis can proceed without complete information, but the quality and accuracy of analysis is limited and vulnerabilities may go undetected
Solution Approach 1:
The system performs preliminary type inference before the main static analysis phase. By inferring type definitions from control flow and data flow analysis in advance, the system prepares complete type information that enables subsequent analysis to proceed with high accuracy even when original type definitions are missing from the application
2Ease of operation
If same-named global variables of different types are allowed in applications with multiple entry points, then the application maintains flexibility and ease of operation, but static analysis quality deteriorates due to inability to distinguish between differently-typed variables
Solution Approach 1:
The system segments the analysis by creating separate analysis contexts for different entry points. By tracking control flow paths from each entry point independently and maintaining separate variable type information for each context, the system can distinguish between same-named global variables that have different types in different execution contexts
Solution Approach 2:
The system applies local quality by assigning context-specific type information to variables based on their usage in particular control flow paths. Instead of using a single global type for same-named variables, the system determines and applies the appropriate type locally within each analysis context, enabling accurate distinction between differently-typed variables
Data Source
AI summary
After a first pass of type inferencing for application program code, global variables that share a name but correspond to different types and thus also correspond to different memory locations are identified and renamed. A static analyzer evaluates identified variables and their inferred types from the first pass of type inferencing and, if two global variables having a same name but different types are identified based on multiple disparate types being inferred for one global variable, the global variables are distinguished via renaming of at least one of the global variables before a second pass of type inferencing and data flow analysis are performed for the program code having the renaming incorporated. Renaming a global variable(s) in the case of same-named but differently typed global variables distinguishes the instances of the global variable to provide for correct propagation of type information and values without ambiguity for improved data flow analysis.