A Propagation Engine Based Approach for Pointer Reference Fault Detection

Abstract

Pointers are widely used in C programs,pointer dereference faults are dangerous while they occur frequently.Many tools are designed to detect this kind of faults,but the state-of-art tools cannot meet the practical needs due to inconvenient usage,low detection accuracy and poor scalability.This paper presents a detection approach which is based on flow-sensitive,field-sensitive and context-sensitive propagation engine.The approach successfully lowers the user burden,improves detection accuracy and scalability.The core concept of the approach is fault attribute lattice.The lattice values are computed and propagated through the source code to detect the faults which were characterized via the fault attribute lattice.A prototype system named Propagator based on Open64 compiler has been implemented.Using null-pointer dereference fault detection as one case study,the comparison experiments with Saturn,Splint and Clang-SA on applications such as Apache,OpenSSH,gzip etc.are done.The results show that Propagator uses only 12 seconds on average to finish the fault checking and the false positive rate of Propagator is only 13% on average.Furthermore,Propagator do not report known false negatives.It is clear that Propagator not only improves the scalability but also achieves the high detection accuracy,thus indicates our approach can be used in practical.