State Key Laboratory of Networking and Switching Tech, Beijing University of Posts and Telecommunications Beijing 100876, China

---

Abstract—Null dereference is a common occurring bug in programming languages such as C. In this paper, we propose a path-sensitive and context-sensitive approach that performs a backward dataflow analysis to identify nulldereference bugs. One novel feature of our approach is that with the help of aliasing predicates, it can perform strong updates in presence of aliasing, thus eliminating false positives. The aliasing predicates are introduced on the premise of a canonical representation for program being analyzed. Moreover, a context-sensitive algorithm for interprocedural null-dereference analysis is also presented in this paper, which also contributes to improve accuracy. We have implemented this approach, and give an evaluation of it on a set of open source benchmarks. The experimental results verify the effectiveness of our approach, and show that it is suitable for exploring large real programs with reasonable accuracy.

Index Terms—Null-dereference Analysis, Aliasing, Strong updates, Context-sensitive Inter-procedural Analysis.

[PDF]

Cite: Qian Wang, Dahai Jin, Yunzhan Gong, Hongbo Zhou, "Detecting Null-dereference Bugs via a Backward Analysis," Journal of Software vol. 8, no. 12, pp. 3120-3131, 2013.