llllllllllllllilllllllllllllllll l lllllllllllllllllllllllllllllllllllllll

Transcription

1 United States Patent [19] Goodnow, II at al. llllllllllllllilllllllllllllllll l lllllllllllllllllllllllllllllllllllllll USOO A [11] Patent Number: 5,590,329 [45] Date of Patent: Dec. 31, 1996 [54] METHOD AND APPARATUS FOR DETECTING lviemory ACCESS ERRORS [75] Inventors: James E. Goodnow, H, Grass Valley, Calif.; Thaddeus J. Kowalski, Summit; James R. Rowland, Short Hills, both of NJ. [73] Assignee: Lucent Technologies Inc., Murray Hill, N1. [21] Appl. No.: 192,239 [22] Filed: Feb. 4, 1994 [51] Int. Cl G06F 11/08 [52] US. Cl. 395/708 [58] Field of Search /650, 700, 395/575 [56] References Cited U.S. PATENT DOCUMENTS 5,107,418 4/1992 Crarner et al /700 5,193,180 5,313,387 5/1994 3/1993 5,335,344 8/1994 5,355,469 10/1994 5,361,351 11/1994 5,432,936 7/1995 OTHER PUBLICATIONS Kanfer et al., Saber-C An Interpreter-based Programming Environment for the C Language, Jun , 1988, pp. 16l 17l. Landi et al., Aliasing with and without pointers: A Problem Taxonomy Sep. 25, 1990, pp. l-55. Landi et al., A Safe Approximate Algorithm for Interpro cedural Pointer Aliasing, Jul., 1992, pp Sulzman, Saber C ; A Sharp Programming Tool, Feb. 1990, pp. l Steffen, Adding Run-Time Checking to the Portable C Compiler, Apr. 1992, pp l6. Hipkins, Steven, The case of the Troublesome Switch (Case Study of Debugging application Software), Oct. 1, 1992, p. 39. C Users Journal, Nu-Mega Announces Bounds Checker 2.0, for MS DOS Memory Protections, p Primary Examiner-Kevin A. Kriess Assistant Examiner l0hn I. Chavis [571 ABSTRACT Disclosed is a software generation system (SGS) based memory error detection system which may be utilized to detect various memory access errors, such as array dimen sion violations, dereferencing of invalid pointers, accessing freed memory, reading uninitialized memory, and automated detection of memory leaks. Error checking commands and additional information are inserted into a parse tree associ ated with a source code?le being tested at read time which serve to initiate and facilitate run-time error detection pro cesses. Wrapper functions may be provided for initiating error checking processes for associated library functions. A pointer check table maintains pointer information, including valid range information, for each pointer that is utilized to monitor the use and modi?cation of the respective pointers. A memory allocation structure records allocation informa tion, including a chain list of all pointers that point to the memory region and an initialization status for each byte in the memory region, for each region of memory. The chain list is utilized to monitor the deallocation of the associated memory region, as well as to detect when there is a memory leak. The initialization status is used to ensure that a region of uninitialized memory is not accessed. A data?ow analysis algorithm minimizes the number of pointer checks that have to be performed and allows certain read-time errors to be detected. 12 Claims, 19 Drawing Sheets 310 IS there a me ulccde? No Q 320 Is a pointer assigned a value in lhls line of code? No Q 337 S ldenl?y any allocated memory malfunction may access and." r.52! flag in inlemal sy liable Perfoml data flow analysis 350% to reduce the number of pointer checks performed at rurhime Insert a ptrchk command for respective pulnler in parse tree Are there addln'unal pointer dereferenees in line cl parse tree being evaluated?

2

3

4 US. Patent Dec. 31, 1996 Sheet 3 0f 19 5,590,329 [ TestfIIe I10 struct part { I20 Int number; I30 char name [10]; I40 } widget; I50 struct part *ptr_part; '60 ptr_part = &widget; I70 int testint = 16394; FIG 2b I80 char testchar = 88; ' '90 int *ptr testint = &testint; I100 char *ptr_testchar = &testchar; I210 Char *ptr_a oc; ptr_aiioc = maiioc (35 *sizeof (char)); I300 ptr_testchar = &widget.name[0]; 310 *ptr_testint = 12024;

5 U.S. Patent Dec. 31, 1996 Sheet 4 of 19 5,590,329 FIG. 20% K lines widgetnumber widget.name A??\ ptr_part ( lines _ testchar testmt FIG. 2d< K i g W. W ptr test nt ptr_testchar?nes FIG. 2e< tr a ll 00 P _ /280 Lower Upper Chain Initialization bound bound List Bit Vector Status ptr_aiioc 11010"""0110 ALLOCATED K 1 l l l l

6 US. Patent Dec. 31, 1996 Sheet 5 of 19 5,590,329 Read line or node of the parse tree 310 is there a reference to an array in this Yes Q TO FIG. 4 ine of code? 320 pointer assigned a value in this line of code? there a call to a function? identify any allocated memory that function may access and, if any, set?ag in internal symbol table I 340 Are there Yes additional nodes of parse tree to be analyzed? Perform data?ow analysis 350 \-/\ to reduce the number of pointer checks performed at run-time 370 Generate error message 360 Does data?ow analysis Yes indicate that an uninitialized or null pointer is being dereferenced? FIG. 3

7 US. Patent Dec. 31, 1996 Sheet 6 of 19 5,590,329 (#9 FROM FIG. 3 Obtain maximum declared 410% size for each dimension of array from internal symbol table subscript reference for this dimension 435 Generate error message subscript reference <0 or > maximum for this dimension? Insert dimchk command 425%.. node in parse tree with maximum size for this dimension 4 Yes Does array have additional untested dimensions? FIG. 4

8 U.S. Patent Dec. 31, 1996 Sheet 7 of 19 FiG % Generate tblupd command node ii, 510% Analyze pointer expression being assigned to pointer 515 is the Place pointer to internal pointer being assigned the address of an identi?ed variable or function? symbol table entry the identi?ed variable To FIG 3 or function in tblupd node 520 is the pointer being assigned the contents of a second pointer? insert a readintstk command in -@To FIG. 3 tblupd node 525 Is the pointer Place address and being assigned a size of string in +@To FIG. 3 string? tblupd node 530 is the Place ILLEGAL pointer being assigned an illegal value? status indication '@TO H6. 3 in tblupd node 535 Is the Place size of pointer being assigned the address of a structure structure member and readintstk FIG- 3 in tblupd node TO FiG. 5b FIG. 5a

9 U.S. Patent Dec. 31, 1996 Sheet 8 of 19 5,590, FROM FIG. 5a 540 pointer being assigned by a conditiona expression in the form *(Test?exp1 :exp2)? 542R Generate a savptr command for each instruction stream and insert >@TQ HQ 3 a rdptrstk command in tblupd node 545 pointer being assigned implicitly upon th assing of pointer argument to an interpreted 547R Generate a savptr command prior to the function call for each pointer argument with a pointer to the >@TQ HQ 3 function and insert a rdptrstk command in tblupd node 550 pointer being assigned a value returned from an interpreted function? 560% 552R Generate a savptr command Y with a pointer to the function 93 in response to the return call by the called function for each,@ To FIG 3 returned pointer and insert a rdptrstk command in tblupd node Place U'NKNOIWN FROM HQ 3 status indication in tblupd node 615 insert a ptrchk command \\ for respective pointer TO FIG. 3 in parse tree FIG. 5b 620 Are there additional pointer dereferences in line of parse tree being FIG. 6

10 w US. Patent Dec. 31, 1996 Sheet 9 of 19 5,590, \ Locate row in pointer check table for pointer argument a Status = FREED? Generate error message Status = \ ALLOCATED or UNKNOWN? Generate error message 725\ Access memory allocation structure pointed to by pointer retrieved from entry 250a and set status member = FREED 730 \ Access chain list member in memory allocation structure and retrieve list of pointers Ir 735\ Access appropriate row in pointer check table for each pointer retrieved from chain list and set status = FREED 737 Call and execute compiled memory deallocation function 739\ Set actual contents of each pointer listed in chain list to a null value l 740 EXlT 4 FIG. 7

11 US. Patent ' Dec. 31, 1996 Sheet 10 of 19 5,590, FROM Evaluate each node of 1 FIGS internal pseudo-code 810 Yes TO FIG i N Retrieve address of pointer being 0 copied from top of interpreter 820 stack and copy pointer infonnation Yes from associated row of pointer check table into pointer save stack. Place pointer to function identi?er in pointer N0 save stack if included with 830 savptr command. ' Yes To FIG. 10a Yes TO FlG.11a command for a compiled function? Yes Q TO FlG. 12a No 860 Are there additional nodes of internal pseudo-code to be evaluated? Yes 870 FIG. 8

12 US. Patent Dec. 31, 1996 Sheet 11 of 19 5,590,329 C?FROM FIG. s 910 \ Calculate array index for variable subscript reference 920 I s subscript reference maximum valid < 0 or > maximum valid dimension 928 dimension? =1? / Utilize pointer checking facilities to determine if structure as a whole is within valid range Generate error message H TO FIG. 8 FIG. 9

13 US. Patent Dec. 31, 1996 Sheet 12 of 19 5,590, FROM FIG. 8 \ Evaluate tblupd node Does the node contain a pointer to an internal symbol table ntry? NO 100E 1008 Access identi?ed symbol table entry and retrieve address and size information Set status = UNKNOWN \ Set status 1018 Set status =PFUNC i \=BOUNDED Iv start address vaiid range i022 Does the 1020 \ it node contain a readintstk HG 103 Update pointer check table entry for pointer being FIG \ Access interpreter stack to retrieve address of second pointer being copied l \ Locate pointer check table entry for second pointer using retrieved address it 1028 Copy pointer check table entry for second pointer into entry for pointer being FIG. 8

14 US. Patent Dec. 31, 1996 Sheet 13 of 19 5,590, Q FROM FIG. 10a Does the node contain s 1034 \ \ I Update pointer calcqlate + Set status = + check table entry Vahd BOUNDED for pointer being range assigned TO FIG Does the 1040 \ \ Update pointer node contain Set status = check table entry an ILLEGAL status ILLEGAL " for pointer being * TO HQ 8 indication? assigned Does the \ _ T0 F'G- 10C stack to retrieve address of structure member \ Update pointer ca'c t ate + Set status = _> check table entry "d BOUNDED for pointer being range assigned TO FIG. 8 FIG. 10b

15 US. Patent Dec. 31, 1996 Sheet 14 0f 19 5,590,329 FROM FIG. 10b i Does the node contain a rdptrstk command? Access pointer save stack and retrieve contents No 1066 Does pointer save stack include a 1074 pointer to a function pointer to a function = address of function that = address of function 1080 \ Update pointer check table entry for pointer being assigned with pointer information retrieved from pointer save FIG \ Does the_ \ Update pointer node Contain Set status = check table entry an UNKNOWN status UNKNOWN for pointer being * \ Generate error message 1098@ FIG. 10c

16 US. Patent Dec. 31, 1996 Sheet 15 of 19 FROM FIG \ Access interpreter stack and retrieve address of pointer being checked l Locate pointer check 1108 \ table entry for pointer being checked using retrieved address of pointer 1112 No Yes 1116 \ Obtain address of function from internal symbol table Set recorded contents \ = address from symbol table 1 J Recorded contents = actual contents? 1128 \ Set status = UNKNOWN v TO H6. 8 Yes Q TO FlG. 13 No TO FIG. 11b FIG. 11a

17 US. Patent Dec. 31, 1996 Sheet 16 of 19 5,590,329 m FROM FlG.11a Status = contents of the BOUNDED? pointer within valid To HQ \ Status = CO?tBntS of Yes Update appropriate ALLOCATED? the pointer within bits of initialization ' bit vector to indicate initialized status Generate error \1176 Access appropriate bits of initialization bit vector to determine if corresponding bytes of allocated memory have been initialized 69m H6. 8 FIG. 11h

18 US. Patent Dec. 31, 1996 Sheet 17 of 19 5,590,329 Q FROM FIG D088 compiled function have an associated pre execution wrappe function? \ Initiate associated pre execution wrapper function to perform pointer check 1205 Has allocation access flag No been set? Call and execute 1201 compiled code Execute initialization bit vector maintenance subroutine 4 i 1265 D093 compiled function have an associated post execution wrappe function? 1270 \ Initiate associated post-execution wrapper function No (5T0 FIG. 8 FIG. 12a

19 U.S. Patent Dec. 31, 1996 Sheet is of 19 5,590,329 Begin initialization bit vector maintenance subroutine l Analyze initialization bit vector in FROM FlGS. 11a 1210 memory allocation structure for all 1310 OR 11b \ accessible allocated memory to identify uninitialized bytes at time compiled function is called.gelierii te error message 'nq'catmg em. type. and the line number in which the 1220 l pointer was last modified \ Perform CRC checksum on all i uninitialized accessible bytes Utilize read-time facilities 1225 to allow programmer to correct detected error Call and execute compiled code 132K0 TO FIG Perform CRC checksum on all bytes uninitialized before FIG. 13 execution of compiled code \. D 088 CRC : CR0") ' Read?ag de?ned by user to determine if entire block should be marked with the initialized status Yes Return to compiled function error checking process 1255 \ Identify each 4 byte block having a contents not equal to FFFA 5A5A Update each bit of initialization bit vector to indicate initialization status l y Update corresponding \ bits of initialization bit vector to indicate initialized status c l FIG. 12b

20 U.S. Patent Dec. 31, 1996 Sheet 19 of 19 5,590,329 [ Sourcecode = Sample FIG. 14a I10 struct part { I20 int number; I30 char name [10]; I40 I50 I60 I70 char color; } widget; struct part *ptlpart; ptlpart = &widget; I80 ptr part +number = 860; 90 strcpy (ptr_part >name, " chair ); I100 ptr_part >coior = b'; I150 ptr_part = 0; I160 ptr_part >number = 870; Set 1 DEF (170) USED (I80) USED (I90) USED (1100) Set 2 DEF 0 (I150). FIG. 14b USED (I160)

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38