The vector container in the C++ Standard Template Library (STL) is widely adopted due to its flexibility and efficiency, but its element access and iterator operations lack boundary checks, potentially leading to memory safety issues such as buffer overflows and iterator invalidation. Existing static analysis tools demonstrate limited effectiveness in detecting these issues due to insufficient consideration of the characteristics of C++ vector containers, such as the combined usage of iterators with vectors and vector memory allocation mechanisms. To address these issues, this paper proposes an abstract interpretation-based defection approach that formally tracks vector size and iterator states, and identifies illegal operations. We have implemented our method as a tool named IKOS4VecErr (on top of IKOS) and evaluated it on hand-crafted benchmarks and five well-known open-source projects. Experimental results show that our tool performs much better than mainstream static analysis tools (including IKOS, CSA, Infer, and Cppcheck) in detection capability, which demonstrates the effectiveness of our work in identifying C++ vector-related defects. On hand-crafted benchmarks, IKOS4VecErr successfully identifies 503 out of 505 defects while the best of the compared tools can only identifies 435 defects. On real-world open-source projects, we discovered 16 previously undetected vector-related errors (while the best of the compared tools discovered 4 defects).

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Detecting Vector Container Errors in C++ Programs via Abstract Interpretation

  • Siyu Liu,
  • Liqian Chen,
  • Guangsheng Fan,
  • Banghu Yin,
  • Chun Huang,
  • Ji Wang

摘要

The vector container in the C++ Standard Template Library (STL) is widely adopted due to its flexibility and efficiency, but its element access and iterator operations lack boundary checks, potentially leading to memory safety issues such as buffer overflows and iterator invalidation. Existing static analysis tools demonstrate limited effectiveness in detecting these issues due to insufficient consideration of the characteristics of C++ vector containers, such as the combined usage of iterators with vectors and vector memory allocation mechanisms. To address these issues, this paper proposes an abstract interpretation-based defection approach that formally tracks vector size and iterator states, and identifies illegal operations. We have implemented our method as a tool named IKOS4VecErr (on top of IKOS) and evaluated it on hand-crafted benchmarks and five well-known open-source projects. Experimental results show that our tool performs much better than mainstream static analysis tools (including IKOS, CSA, Infer, and Cppcheck) in detection capability, which demonstrates the effectiveness of our work in identifying C++ vector-related defects. On hand-crafted benchmarks, IKOS4VecErr successfully identifies 503 out of 505 defects while the best of the compared tools can only identifies 435 defects. On real-world open-source projects, we discovered 16 previously undetected vector-related errors (while the best of the compared tools discovered 4 defects).