Detecting Vector Container Errors in C++ Programs via Abstract Interpretation
摘要
The vector container in the C++ Standard Template Library (STL) is widely adopted due to its flexibility and efficiency, but its element access and iterator operations lack boundary checks, potentially leading to memory safety issues such as buffer overflows and iterator invalidation. Existing static analysis tools demonstrate limited effectiveness in detecting these issues due to insufficient consideration of the characteristics of C++ vector containers, such as the combined usage of iterators with vectors and vector memory allocation mechanisms. To address these issues, this paper proposes an abstract interpretation-based defection approach that formally tracks vector size and iterator states, and identifies illegal operations. We have implemented our method as a tool named IKOS4VecErr (on top of IKOS) and evaluated it on hand-crafted benchmarks and five well-known open-source projects. Experimental results show that our tool performs much better than mainstream static analysis tools (including IKOS, CSA, Infer, and Cppcheck) in detection capability, which demonstrates the effectiveness of our work in identifying C++ vector-related defects. On hand-crafted benchmarks, IKOS4VecErr successfully identifies 503 out of 505 defects while the best of the compared tools can only identifies 435 defects. On real-world open-source projects, we discovered 16 previously undetected vector-related errors (while the best of the compared tools discovered 4 defects).