a method for searching of c++ string accesses with an incorrect index
Clicks: 281
ID: 151743
2016
Article Quality & Performance Metrics
Overall Quality
Not rated
Combines reader engagement with the AI quality analysis. This
article has not been analysed, so there is no overall score —
reader engagement is measured and shown alongside.
Reader Engagement
Popular Article
30.0
/100
281 views
25 readers
AI Quality Assessment
Not analyzed
Readership in this journal
PopularRanked #276 of 442 articles by views in BMJ open
Most read
Least read
Bar heights use a square-root scale. Only the 120 most-read articles are drawn; the journal has 442 in total.
Mint this article as an NFT
Not yet mintedCreate a permanent, verifiable on-chain record of this article on the Scimatic Network. The NFT is held in your Journament account, and you can withdraw it to your own wallet at any time.
5
SUSD
one-off · no wallet required
Abstract
Since C++ is a commonly used programming language that is also in wide use for programming the mobile OS such as Tizen the static analysis of C++ programs is in high demand. The article is devoted to searching the accesses to C++ strings with an incorrect index. As opposed to the buffer overflows in C, this kind of defect in rarely detected by industrial static analyzers due to complexity of its modeling. In the work, we formalize the criteria of this defect and propose the formal modeling rules of C++ string-related methods and a number of STL functions. These rules allow modeling of string length and access index. The rules for summary-based inter-procedural analysis are introduced as well. The article simulates only the length of a string to provide a compromise between the search precision and the volume of data processing. A checker based on these modeling rules is implemented for the Clang Static Analyzer - a symbolic execution static analyzer for C++ code. This checker was tested on the C++ code of Android OS and OS Tizen user-mode packages (totally about 20 million strings of code). The results of an eye-inspection of warnings produced by this checker prove its precision, which is appropriate for industrial static analyzer: nearly 70.
| Reference Key |
sidorin2016naukaa
Use this key to autocite in the manuscript while using
SciMatic Manuscript Manager or Thesis Manager
|
|---|---|
| Authors | ;A. V. Sidorin |
| Journal | BMJ open |
| Year | 2016 |
| DOI |
10.7463/0516.0840726
|
| URL | |
| Keywords |
Citations
No citations found. To add a citation, contact the admin at info@scimatic.org
Comments
No comments yet. Be the first to comment on this article.