摘要： 提出一个扩展的流不敏感指针分析算法,主要用于缓冲区溢出静态分析,该算法把程序控制流图(CFG)转换为静态单指派(SSA),然后循环调用一个流不敏感指针分析,生成每个指针变量精确的指向集,更新指针变量的定义-引用链中约束信息。在LLVM编译系统下实现了该算法,实验表明其精度和流敏感的指针分析算法相当,但效率高于流敏感指针分析算法,时间复杂度低于流敏感指针分析算法。

关键词: 缓冲区溢出, 指针分析, 静态单指派, 定义-引用链

Abstract: The paper presents an extended flow-insensitive pointer analysis algorithm used in statical buffer overflow analysis,which translates the control flow graph (CFG) into static single assignment(SSA),repeated calls a flow-insensitive pointer analysis and then generates precise point-to set for each pointer variable.Finally,it updates the constraint information in the define-use chain of pointer variable.The paper implements the algorithm in LLVM compiler system and measures the analysis result and times for a set of benchmark programs.The empirical results show that the result is as good as the flow-sensitive analysis but efficiency is higher than flow-sensitive analysis.

中图分类号: 

• TP311.11