Detecting Null-dereference Bugs via a Backward Analysis

摘要

Null dereference is a common occurring bug inprogramming languages such as C. In this paper, wepropose a path-sensitive and context-sensitive approach thatperforms a backward dataflow analysis to identify nulldereferencebugs. One novel feature of our approach is thatwith the help of aliasing predicates, it can perform strongupdates in presence of aliasing, thus eliminating falsepositives. The aliasing predicates are introduced on thepremise of a canonical representation for program beinganalyzed. Moreover, a context-sensitive algorithm for interproceduralnull-dereference analysis is also presented in thispaper, which also contributes to improve accuracy. We haveimplemented this approach, and give an evaluation of it on aset of open source benchmarks. The experimental resultsverify the effectiveness of our approach, and show that it issuitable for exploring large real programs with reasonableaccuracy.