Symbolic Expression Graph for Null Pointer Dereference Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Null pointer dereference (NPD) defects in software are difficult to detect due to the limitations of control flow graphs (CFG) in program analysis, which lack value information and are not sparse, making defect detection inefficient.
Innovation Solution
A symbolic expression graph (SEG) is introduced, comprising nodes representing program variables and edges representing data and control dependencies, allowing for efficient defect detection by preprocessing code, generating SEG, and performing depth-first traversal to identify null pointer dereferences.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If control flow graph (CFG) is used for program analysis, then control flow can be represented, but value information is lost and detection speed is slow
Solution Approach 1:
The patent merges control flow information and value information into a unified Symbolic Expression Graph (SEG) structure. The SEG simultaneously represents control dependencies (like CFG) and value dependencies (data flow), eliminating the information loss inherent in separate representations. This integration allows the system to maintain both control structure and value information without the performance penalty of processing them separately.
Solution Approach 2:
The SEG acts as an intermediary representation between traditional CFG and detailed data flow analysis. It provides a sparse, symbolic representation that captures essential value information while maintaining the structural benefits of CFG. This intermediary structure enables efficient defect detection by providing just enough value information without the full overhead of comprehensive data flow analysis.
2Productivity
If control flow graph (CFG) is used for program analysis, then control flow can be represented, but defect detection efficiency is reduced due to non-sparse structure
Solution Approach 1:
The SEG applies local quality by representing only the necessary value dependencies locally at each node, rather than maintaining a global, dense representation. Each node in the SEG contains symbolic expressions that capture local value relationships, creating a sparse structure that reduces complexity while maintaining detection efficiency. This localized approach avoids the overhead of processing entire CFG structures when only specific value flows are relevant to defect detection.
3Measurement precision
If precise data flow analysis is performed to track information flow into and out from heap, then NPD errors can be detected, but the analysis becomes extremely complex and slow
Solution Approach 1:
The patent changes the parameter representation from concrete memory addresses to symbolic expressions. Instead of tracking specific heap addresses through complex data flow analysis, the SEG uses symbolic parameters to represent memory locations and their dependencies. This parameter transformation enables precise tracking of value flows without the computational burden of address-based analysis, significantly reducing analysis time while maintaining detection precision.
Data Source
AI summary
A method for detecting defects in computer software code comprises: preprocessing a code to check; generating an SEG for the code to check, wherein the SEG includes nodes, data dependency edges and control dependency edges that connect the nodes, wherein, the nodes include value nodes and operator nodes, the value nodes including terminal value nodes representing unknown values or constants generated outside a function, and non-terminal value node representing values generated within the function, wherein each non-terminal value node is associated with a unique memory location, and wherein the data dependency edge is a directed edge connecting a value node to another value node that has a direct data dependency relationship with the value node, and traversing the SEG in a depth-first way backward from a null pointer node in a lowest level of the SEG and generating a bug report when a defect is found.