计算机科学 ›› 2023, Vol. 50 ›› Issue (12): 1-13.doi: 10.11896/jsjkx.221000195
帅东昕, 葛丽丽, 谢金言, 张迎周, 薛渝川, 杨嘉毅, 密杰, 卢跃
SHUAI Dongxin, GE Lili, XIE Jinyan, ZHANG Yingzhou, XUE Yuchuan, YANG Jiayi, MI Jie, LU Yue
摘要: 指针分析技术是一种基础的静态程序分析技术,也是软件安全方向的研究热点之一,在软件缺陷检测、恶意代码分析、程序验证、编译器优化等应用场景中发挥着重要的作用,指针分析的精度在这些应用场景中至关重要。流敏感分析和过程间分析是提高指针分析精度最有效的两种技术。文中对现有的提高过程间流敏感指针分析精度的技术进行总结,从为提高精度所消除的信息入手,将分析方法分为两大类:一类是消除分析中的虚假信息,以避免指向信息沿虚假的返回路径或是虚假调用关系传播;另一类是消除分析中保守的指向关系,在每个程序点处根据设置的规则尽可能确定指针的唯一指向,而不是笼统地计算指针的多个可能指向。据此,详细比较了过程间流敏感指针分析技术的异同,并对指针分析技术未来的研究方向进行了展望。
中图分类号:
[1]HIND M,PIOLI A.Which Pointer Analysis Should I Use?[J].ACM Sigsoft Software Engineering Notes,2000,25(5):113-123. [2]STEENSGAARD B.Points-to Analysis in Almost Linear Time[C]//Proceedings of the 23rd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages(POPL'96).Association for Computing Machinery,1996:32-41. [3]ANDERSEN L O.Program Analysis and Specialization for the C Programming Language[D].Denmark:University of Copenha-gen,1994. [4]BURKE M,CARINI P,CHOI J D,et al.Flow-insensitive interprocedural alias analysis in the presence of pointers[C]//Proceedings from the 7th Workshop on Languages and Compilers for Parallel Computing.Berlin:Springer,1995:234-250. [5]CHOI J D,BURKE M G,CARINI P R.Efficient flow-sensitive interprocedural computation of pointer-induced aliases and side effects[C]//20th Annual ACM SIGACT-SIGPLAN Symposium on the Principles of Programming Languages.ACM,1993:232-245. [6]HIND M.Pointer Analysis:Haven't We Solved This ProblemYet?[C]//Acm Sigplan-sigsoft Workshop on Program Analysis for Software Tools & Engineering.ACM,2001:113-123. [7]CHEN C M,HUO W,YU H T,et al.A Review of PointerAnalysis Optimization Techniques Based on Inclusion[J].Chinese Journal of Computers,2011,34(7):1224-1238. [8]YAO Y F.A Review of Trusted Pointer Analysis Techniques For Software Trust-worthiness[J].Applied Research of Computers,2012,29(2):427-431. [9]LI H F,MENG H N,ZHENG H J,et al.Research on Context-Sensitive Pointer Analysis of Object-Oriented Programs[J].Journal of Software,2022,33(1):78-101. [10]HORWITZ S.Precise flow-insensitive may-alias analysis is NP-hard[J].Acm Transactions on Programming Languages & Systems,1997,19(1):1-6. [11]LANDI W.Undecidability of static analysis[J].ACM Letters on Programming Languages and Systems,1996,1(4):323-337. [12]RAMALINGAM G.The undecidability of aliasing[J].ACMTransactions on Programming Languages & Systems,1994,16(5):1467-1471. [13]LI Q.Research on points-to analysis for Java[D].Nanjing:Nanjing University,2012. [14]ANKUSH P,VAIBHAV B,SORAV B.OOElala:order-of-eva-luation based alias analysis for compiler optimization[C]//41st ACM SIGPLAN Conference on Programming Language Design and Implementation(PLDI 2020).Association for Computing Machinery,2020:839-853. [15]WHALEY J,RINARD M.Compositional pointer and escapeanalysis for Java programs[C]//Proceedings of the 14th ACM SIGPLAN Conference on Object-oriented Programming,Systems,Languages,and Applications(OOPSLA'99).Association for Computing Machinery,1999:187-206. [16]PRABHU P,SHANKAR P.Field Flow Sensitive Pointer andEscape Analysis for Java Using Heap Array SSA[C]//International Static Analysis Symposium(SAS 2008).Berlin:Springer,2008:110-127. [17]TOK T B,GUYER S Z,LIN C.Efficient Flow-Sensitive Interprocedural Data-Flow Analysis in the Presence of Pointers[C]//Lecture Notes in Computer Science.Berlin:Springer,2006:17-31. [18]WHALEY J,MONICA S.LAM.An Efficient Inclusion-BasedPoints-To Analysis for Strictly-Typed Languages[C]//International Static Analysis Symposium(SAS 2002).New York:ACM,2002:180-195. [19]REIF J H,Lewis H R.Symbolic evaluation and the global value graph[C]//Proceedings of the 4th ACM SIGACT-SIGPLAN Symposium on Principles of Programming Languages.New York:ACM,1977:104-118. [20]HARDEKOPF B,LIN C.Semi-Sparse Flow-Sensitive PointerAnalysis[C]//Proceedings of the 36th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages.Association for Computing Machinery,2009:226-238. [21]HARDEKOPF B,LIN C.Flow-sensitive pointer analysis formillions of lines of code[C]//International Symposium on Code Generation and Optimization.Piscataway,NJ:IEEE,2011:289-298. [22]SUI Y,XUE J.Value-Flow-Based Demand-Driven Pointer Analysis for C and C++[J].IEEE Transactions on Software Engineering,2018,46(8):812-835. [23]LANDI A,BRUNSWICK S N,RYDER B G,et al.Interprocedural Aliasing In The Presence Of Pointers[D].New Jersey:Rutgers University,1993. [24]SAMUEL Z G.Incorporating domain-specific information into the compilation process[D].Austin:The University of Texas,2003. [25]JEONG S,JEON M,CHA S,et al.Data-driven context-sensitivity for points-to analysis[C]//Proceedings of the ACM on Programming Languages.ACM,2017:1-28. [26]LI Y,TAN T,MOLLER A,et al.A Principled Approach to Selective Context Sensitivity for Pointer Analysis[J].ACM Transactions on Programming Languages and Systems,2020,42(2):1-40. [27]LU J,HE D,XUE J.Eagle:CFL-reachability-based precision-preserving acceleration of object-sensitive pointer analysis with partial context sensitivity[J].ACM Transactions on Software Engineering and Methodology(TOSEM),2021,30(4):1-46. [28]LU J,HE D,XUE J.Selective context-sensitivity for k-CFA with CFL-reachability[C]//International Static Analysis Symposium(SAS 2021).Springer.2021:261-285. [29]MILANOVA A,ROUNTEV A,RYDER B G.Parameterizedobject sensitivity for points-to analysis for Java[J].ACM Tran-sactions on Software Engineering & Methodology,2005,14(1):1-41. [30]KASTRINIS G,SMARAGDAKIS Y.Hybrid context-sensitivity for points-to analysis[C]//the 34th ACM SIGPLAN Conference on Programming Language Design and Implementation(PLDI 13).ACM,2013:423-434. [31]LHOTáK O,HENDREN L.Context-Sensitive Points-to Analysis:Is It Worth It?[C]//International Conference on Compiler Construction(CC 2006).Springer,2006:47-64. [32]NAIK M,AIKEN A,WHALEY J.Effective static race detection for Java[C]//Acm Sigplan Conference on Programming Language Design & Implementation.ACM,2006. [33]SRIDHARAN M,CHANDRA S,DOLBY J,et al.Alias Analysis for Object-Oriented Programs[M].Lecture Notes in Computer Science.Berlin:Springer,2013:196-232. [34]TAN T,LI Y,XUE J.Making k-Object-Sensitive Pointer Ana-lysis More Precise with Still k-Limiting[C]//InternationalSta-tic Analysis Symposium(SAS 2016).New York:ACM,2016:489-510. [35]TIAN T,YUE L,XUE J.Efficient and precise points-to analysis:modeling the heap by merging equivalent automata[C]//Acm Sigplan Conference on Programming Language Design & Implementation.ACM,2017:278-291. [36]SMARAGDAKIS Y,BRAVENBOER M,LHOTÁK O.Pickyour contexts well:Understanding object-sensitivity[J].ACM SIGPLAN Notices,2011,46(1):17-30. [37]LUNDBERG J,GUTZMANN T,EDVINSSON M,et al.Fast and precise points-to analysis[J].Information and Software Technology,2009,51(10):1428-1439. [38]BAO Y,ZHANG C,ZHUO X,et al.Parameter Sensitive Pointer Analysis for Java[C]//26th International Conference on Engineering of Complex Computer Systems(ICECCS).IEEE,2022:162-167. [39]PEARCE D J,KELLY P,HANKIN C.Efficient field-sensitive pointer analysis of C[J].ACM Transactions on Programming Languages and Systems,2007,30(1):1-42. [40]ANTOINE M.Field-Sensitive Value Analysis of Embedded CPrograms with Union Types and Pointer Arithmetics[C]//ACM SIGPLAN/SIGBED Conference on Language,Compilers,and Tool Support for Embedded Systems.Ecole Normale Superieure,2006:54-63. [41]SUI Y,FAN X,ZHOU H,et al.Loop-oriented array-and field-sensitive pointer analysis for automatic SIMD vectorization.[J].ACM SIGPLAN Notices,2016,51(5):41-51. [42]LATTNER C,LENHARTH A,ADVE V.Making context-sensitive points-to analysis with heap cloning practical for the real world[C]//Proceedings of the 28th ACM SIGPLAN Conference on Programming Language Design and Implementation(PLDI'07).ACM,2007:278-289. [43]SUI Y,YE S,XUE J,et al.SPAS:Scalable Path-SensitivePoin-ter Analysis on Full-Sparse SSA[C]//Proceedings of the 9th Asian Conference on Programming Languages and Systems(APLAS'11).ACM,2011:155-171. [44]WEI S,RYDER B.State-Sensitive Points-to Analysis for theDynamic Behavior of JavaScript Objects[C]//Proceedings of the 28th European Conference on ECOOP 2014.Springer-Verlag,2014:1-26. [45]ANTONIOL G,CALZOLARI F,TONELLA P.Impact of Function Pointers on the Call Graph[C]//European Conference on Software Maintenance & Reengineering.IEEE Computer Society,1999:51-59. [46]CHENG B,HWU W.An Empirical Study of Function Pointers Using SPEC Benchmarks[C]//Proceedings of the 12th International Workshop on Languages and Compilers for Parallel Computing.Berlin:Springer,1999:490-493. [47]MILANOVA A,ROUNTEV A,RYDER B G.Precise CallGraph Construction in the Presence of Function Pointers[C]//IEEE International Workshop on Source Code Analysis & Manipulation.IEEE,2003:155-162. [48]FHNDRICH M,REHOF J,DAS M.Scalable context-sensitive flow analysis using instantiation constraints[J].ACM SIGPLAN Notices,2000,35(5):253-263. [49]EMAMI M.A practical interprocedural alias analysis for an optimizing/parallelizing C compiler[D].Montreal:McGill University,1993. [50]EMAMI M,GHIYA R,HENDREN L J.Context-sensitive in-terprocedural points-to analysis in the presence of function pointers[J].ACM SIGPHLAN Notices,1994,29(6):242-256. [51]RUGINA R,RINARD M.Pointer Analysis for MultithreadedPrograms[J].ACM SIGPLAN Notices,2002,34(5):77-90. [52]LIU Q.Research on Interprocess Analysis Technique Conside-ring Pointer Alias[D].Beijing:Chinese Academy of Sciences(Institute of Computing Technology),1998. [53]WILSON R P,LAM M S.Efficient Context-Sensitive PointerAnalysis for C Programs[J].ACM SIGPLAN Notices,1995,30(6):1-12. [54]CHEN P S,HWANG Y S,JU D C,et al.Interprocedural Probabilistic Pointer Analysis[J].IEEE Transactions on Parallel and Distributed Systems,2004,15(10):893-907. [55]QIAN L,ZHAO J,LI X.Optimize Context-Sensitive Andersen-Style Points-To Analysis by Method Summarization and Cycle-Elimination[C]//International Conference on Leveraging Applications of Formal Methods.Springer-Verlag,2010:564-578. [56]DAVID T,TIMOTEJ K,NOAM R,et al.Past-Sensitive Pointer Analysis for Symbolic Execution[C]//28th ACM Joint Euro-pean Software Engineering Conference and Symposium on the Foundations of Software Engineering(ESEC/FSE'20).Association for Computing Machinery.2020:197-208. [57]SCHUBERT P,HERMANN B,BODDEN E.Lossless,Persisted Summarization of Static Callgraph,Points-To and Data-Flow Analysis[C]//35th European Conference on Object-Oriented Programming(ECOOP 2021).Schloss Dagstuhl,2021:1-31. [58]WANG Y,ZHOU M,GU M,et al.Necessity and Capability of Flow,Context,Field and Quasi Path Sensitive Points-to Analysis[C]//2019 26th Asia-Pacific Software Engineering Confe-rence(APSEC).IEEE Computer Society,2019:268-275. [59]SHARIR M,PNUELI A.Two approaches to interprocedural data flow analysis[D].New York:New York University,1978. [60]SHIVERS O.Control-Flow Analysis of Higher-Order Langua-ges[D].Pennsylvania:Carnegie Mellon University,1991. [61]PALSBERG J,SCHWARTZBACH M I.Object-Oriented Type Inference[J].ACM SIGPLAN Notices,1997,26(11):146-161. [62]GROVE D,DEFOUW G,DEAN J,et al.Call Graph Construction in Object-Oriented Languages[J].ACM SIGPLAN Notices,1997,32(10):108-124. [63]JONES N D,MUCHNICK S S.Flow analysis and optimization of LISP-like structures[C]//Proceedings of the 6th ACM SIGACT-SIGPLAN Symposium on Principles of Programming Languages.ACM,1979:244-256. [64]LANDI W,RYDER B G.A safe approximate algorithm for interprocedural aliasing[J].ACM SIGPLAN Notices,1992,39(4):235-248. [65]DEUTSCH A.Interprocedural May-Alias Analysis for Pointers:Beyond k-limiting[J].ACM SIGPLAN Notices,1994,29(6):230-241. [66]DE A,D'SOUZA D.Scalable Flow-Sensitive Pointer Analysis for Java with Strong Updates[C]//European Conference on Object-Oriented Programming.Berlin:Springer,2012:665-687. [67]SMARAGDAKIS Y,KASTRINIS G.Defensive Points-To Ana-lysis:Effective Soundness via Laziness[C]//32nd European Conference on Object-Oriented Programming(ECOOP 2018).Sch-loss Dagstuhl,2018:23:1-23:28. [68]JEONG S,JEON M,CHA S,et al.Data-driven context-sensitivity for points-to analysis[C]//Proceedings of the ACM on Programming Languages.ACM,2017:1-28. [69]HUA Y,SUI Y,CHEN S,et al.Spatio-Temporal Context Reduction:A Pointer-Analysis-Based Static Approach for Detecting Use-After-Free Vulnerabilities[C]//2018 IEEE/ACM 40th International Conference on Software Engineering(ICSE).IEEE Computer Society,2018:327-337. [70]AGESEN O.The cartesian product algorithm[C]//EuropeanConference on Object-Oriented Programming(ECOOP 95).Schloss Dagstuhl,1995:2-26. [71]GROVE D,CHAMBERS C.A Framework for Call Graph Construction Algorithms[J].ACM Transactions on Programming Languages and Systems,2001,23(6):685-746. [72]CHEN T Q,FAN G S,YIN B H,et al.An Optimization Method for Interprocedural Analysis of Function Inlining Oriented to Abstract Interpretation Framework[J].Journal of Software,2022,33(8):2964-2979. [73]WHALEY J,LAM M S.Cloning-based context-sensitive pointer alias analysis using binary decision diagrams[J].ACM SIGPLAN Notices,2004,39(6):131-144. [74]THIESSEN R,LHOTÁK O.Context transformations for poin-ter analysis[J].ACM SIGPLAN Notices,2017,52(6):263-277. [75]REPS T,HORWITZ S,SAGIV M.Precise interprocedural dataflow analysis via graph reachability[C]//ACM SIGPLAN-sigact Symposium on Principles of Programming Languages(POPL 95).ACM,1995:49-61. [76]REPS T.Program analysis via graph reachability[J].Information & Software Technology,1998,40(11/12):701-726. [77]JOHANNES S,LISA N Q D,ALI K,et al.Boomerang:Demand-Driven Flow-and Context-Sensitive Pointer Analysis for Java[C]//30th European Conference on Object-Oriented Programming(ECOOP 2016).Schloss Dagstuhl,2016:1-26. [78]SUI Y,YE D,XUE J.Detecting Memory Leaks Statically with Full-Sparse Value-Flow Analysis[J].IEEE Transactions on Software Engineering,2014,40(2):107-122. [79]SUI Y,PENG D,XUE J.Sparse flow-sensitive pointer analysis for multithreaded programs[C]//Proceedings of the 2016 International Symposium on Code Generation and Optimization(CGO'16).IEEE,2016:160-170. [80]SUI Y,XUE J.SVF:interprocedural static value-flow analysis in LLVM[C]//Proceedings of the 25th International Conference on Compiler Construction(CC 2016).ACM,2016:265-266. [81]SUI Y,XUE J.Value-Flow-Based Demand-Driven Pointer Ana-lysis for C and C++[J].IEEE Transactions on Software Engineering,2018,46(8):812-835. [82]LEI Y,SUI Y.Fast and Precise Handling of Positive Weight Cycles for Field-Sensitive Pointer Analysis[C]//International Sta-tic Analysis Symposium(SAS 2019).Berlin:Springer.2019:27-47. [83]SUN C,MIDKIFF S.Demand-Driven Refinement of Points-toAnalysis[C]//2019 IEEE/ACM 41st International Conference on Software Engineering:Companion Proceedings(ICSE-Companion).IEEE,2019:264-265. [84]SOTIN P,JEANNET B.Precise Interprocedural Analysis in the Presence of Pointers to the Stack[C]//Programming Languages and Systems.Berlin:Springer,2012:459-479. [85]HORVÁTH E,FORGáCS I,KISS Á,et al.General flow-sensitive pointer analysis and call graph construction[C]//9th Symposium on Programming Languages and Software Tools(SPLST 2005).2005:49-58. [86]HIND M,BURKE M,CARINI P,et al.Interprocedural Pointer Alias Analysis[J].ACM Transactions on Programming Languages & Systems,1999,21(4):848-894. [87]ATKINSON D C.Accurate call graph extraction of programs with function pointers using type signatures[C]//ASIA-Pacific Software Engineering Conference.IEEE,2004:326-335. [88]SUN H H,WANG S Y,LIN X B.Improvement of Interprocess Pointer Analysis Algorithm[J].Computer Engineering,2009,35(1):90-92,104. [89]CHENG B C,HWU W.Modular interprocedural pointer analysis using access paths:design,implementation,and evaluation[J].ACM Sigplan Notices,2000,35(5):57-69. [90]ZHANG W,ZHANG Y.Lightweight function pointer analysis[C]//Information Security Practice and Experience(ISPEC 2015).Cham:Springer,2015:439-453. [91]ZHANG X.Practical pointer aliasing analysis[D].New Brunswick:Rutgers University,1998. [92]ZHANG S,RYDER B G,LANDI W.Program Decompositionfor Pointer Aliasing:A Step toward Practical Analyses[J].ACM Sigsoft Software Engineering Notes,1996,21(6):81-92. [93]YONG S,HORWITZ S,REPS T.Pointer analysis for programs with structures and casting[C]//Proceedings of the ACM Conference on Programming Language Design and Implementation(PLDI).ACM,New York,1999:91-103. [94]BACON D F,SWEENEY P F.Fast Static Analysis of C++ Virtual Function Calls[J].ACM SIGPLAN Notices,1996,31(10):324-341. [95]DEAN J.Optimization of Object-Oriented Programs Using Sta-tic Class Hierarchy Analysis[C]//European Conference on Object-Oriented Programming(ECOOP 1995).Berlin:Springer,1995:77-101. [96]DIWAN A,MOSS J,MCKINLEY K S.Simple and EffectiveAnalysis of Statically-Typed Object-Oriented Programs[J].ACM Sigplan Notices,1996,31(10):292-305. [97]ROUNTEV A,MILANOVA A,RYDER B G.Points-to analysis for Java using annotated constraints[J].ACM SIGPLAN Notices,2001,36(11):43-55. [98]MILANOVA A,ROUNTEV A,RYDER B G.ParameterizedObject Sensitivity for Points-to and Side-Effect Analyses for Java[J].ACM SIGSOFT Software Engineering Notes,2002,27(4):1-11. [99]BALATSOURAS G,SMARAGDAKIS Y.Structure-SensitivePoints-To Analysis for C and C++[C]//International Static Analysis Symposium(SAS 2016).Berlin:Springer,2016:84-104. [100]FINK S J,YAHAV E,DOR N,et al.Effective typestate verification in the presence of aliasing[J].ACM Transactions on Software Engineering & Methodology,2006,17(2):133-144. [101]FINK S,KNOBE K,SARKAR V.Unified Analysis of Arrayand Object References in Strongly Typed Languages[C]//International Symposium on Static Analysis.Springer-Verlag,2000:155-174. [102]LHOTÁK O,CHUNG K C A.Points-to analysis with efficient strong updates[C]//ACM Sigplan-sigact Symposium on Principles of Programming Languages.ACM,2011:3-16. [103]SUI Y,XUE J.On-demand strong update analysis via value-flow refinement[C]//ACM Sigsoft International Symposium on Foundations of Software Engineering.ACM,2016:460-473. [104]VIVIEN F,RINARD M.Incrementalized pointer and escapeanalysis[J].ACM SIGPLAN Notices,2001,36(5):35-46. [105]RUGINA R,RINARD M C.Pointer analysis for structured pa-rallel programs[J].Acm Transactions on Programming Languages & Systems,2003,25(1):70-116. [106]YU S,DING Y,XUE J.Parallel Pointer Analysis with CFL-Reachability[C]//2014 43rd International Conference on Parallel Processing.IEEE,2014:451-460. [107]YU H,SUN Q,XIAO K,et al,Parallelizing Flow-Sensitive Demand-Driven Points-to Analysis[C]//2020 IEEE 20th International Conference on Software Quality,Reliability and Security Companion(QRS-C).IEEE,2020:91-97. [108]NAGARAJ V,GOVINDARAJAN R.Parallel flow-sensitivepointer analysis by graph-rewriting[C]//2013 22nd Interna-tional Conference on Parallel Architectures and Compilation Techniques(PACT).IEEE,2013:19-28. [109]ZHAO J,BURKE M G,SARKAR V.Parallel sparse flow-sensitive points-to analysis[C]//Proceedings of the 27th Interna-tional Conference on Compiler Construction(CC 2018).ACM,2018:59-70. [110]TAN T,LI Y,MA X,et al.Making pointer analysis more precise by unleashing the power of selective context sensitivity[C]//Proceedings of the ACM Programming Languages 5(OOPSLA).ACM,2021:1-27. [111]HE D,LU J,GAO Y,et al.Accelerating object-sensitive pointer analysis by exploiting object containment and reachability[C]//35th European Conference on Object-Oriented Programming(ECOOP 2021).Dagstuhl,Germany.2021. [112]LU J,XUE J.Precision-preserving yet fast object-sensitivepointer analysis with partial context sensitivity[C]//Procee-dings of the ACM on Programming Languages.ACM,2019:1-29. [113]MOCK M,DAS M,CHAMBERS C,et al.Dynamic points-tosets:A comparison with static analyses and potential applications in program understanding and optimization[C]//ACM Sigplan-sigsoft Workshop on Program Analysis for Software Tools & Engineering.ACM,2001:66-72. |
|