Language interoperability to automate code analysis

Patent metadata

Field	Value
Publication number	US-2021357192-A1
Application number	US-202015931234-A
Country	US
Kind code	A1
Filing date	May 13, 2020
Priority date	May 13, 2020
Publication date	Nov 18, 2021
Grant date	—

Abstract

Language interoperability between source code programs not compatible with an interprocedural static code analyzer is achieved through language-independent representations of the programs. The source code programs are transformed into respective intermediate language instructions from which a language-independent control flow graph and a language-independent type environment is created. A program compatible with the interprocedural static code analyzer is generated from the language-independent control flow graph and the language-independent type environment in order to utilize the interprocedural static code analyzer to detect memory safety faults.

First claim

What is claimed:

1 . A system comprising:
one or more processors coupled to a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including instructions that: generate a language-independent control graph of a first program and language-independent type environment of the first program; convert the language-independent control graph into a second program consisting of analysis language instructions of an interprocedural static code analyzer; and invoke the interprocedural static code analyzer on the second program to detect a memory safety fault in the first program.

2 . The system of claim 1 , wherein the one or more program includes further instructions that:
generate a control flow graph of a first program from intermediate language instructions of the first program, the control flow graph including the analysis language instructions, wherein the intermediate language instructions differ from the analysis language instructions; and transform the control flow graph into the language-independent control flow graph.

3 . The system of claim 2 , wherein the one or more programs include further instructions that:
extract a type environment of the first program from the intermediate language instructions of the first program; and generate the language-independent type environment from the type environment.

4 . The system of claim 2 , wherein the one or more programs include further instructions that:
detect a commit change to the first program from a source-controlled repository; and extract a binary file of the commit change from the source-controlled repository.

5 . The system of claim 4 , wherein the one or more programs include further instructions that:
convert the commit change into the intermediate language instructions.

6 . The system of claim 1 , wherein the language-independent code is based on a JavaScript Notation (JSON) format.

7 . The system of claim 1 , wherein the intermediate language instructions are based on a Common Intermediate Language (CIL) and the analysis language instructions are based on a Smallfoot Intermediate Language (SIL).

8 . A method, comprising:
analyzing a first program to generate a language-independent control flow graph of the first program and a language-independent type environment of the first program; transforming the language-independent control flow graph into a second program, the second program including instructions of an analysis language of an interprocedural static code analyzer; and applying the interprocedural static code analyzer to the second program to identify a memory safety fault in the first program.

9 . The method of claim 8 , further comprising:
extracting the first program from a source-controlled repository; converting the first program into intermediate language instructions; and generating the language-independent control flow graph from the intermediate language instructions.

10 . The method of claim 9 , further comprising:
upon activation of a commit change in the source-controlled repository, extracting a binary file of the first program from the source-controlled repository.

11 . The method of claim 10 , further comprising:
decompiling the binary file into the intermediate language instructions.

12 . The method of claim 8 , wherein the language-independent type environment is based on a JavaScript Object Notation (JSON) format.

13 . The method of claim 8 , wherein the language-independent control graph is based on a JSON format.

14 . The method of claim 8 , wherein the first program is written in a programming language supported by the .NET framework and the interprocedural static code analyzer is written in a programming language that is not support by the .NET framework.

15 . The method of claim 8 , wherein the memory safety fault includes one of a null pointer dereference, race condition or memory leak.

16 . A device, comprising:
at least one processor and a memory; wherein the at least one processor is configured to:
generate a language-independent control graph of a first program, the language-independent control graph including instructions of an analysis language of an interprocedural static code analyzer;
generate a second program from the language-independent control graph, the second program including the analysis language instructions; and
apply the interprocedural static code analyzer to the second program to find a memory safety fault in the first program.

17 . The device of claim 16 , wherein the at least one processor is further configured to:
transform the first program into intermediate language instructions; generate a control flow graph of the first program from the intermediate language instructions; and convert each intermediate language instruction in the control flow graph into a corresponding analysis language instruction.

18 . The device of claim 17 , wherein the at least one processor is further configured to:
generate a language-independent type environment of the first program using the intermediate language instructions.

19 . The device of claim 18 , wherein the at least one processor is further configured to:
convert the language-independent type environment of the first program into a type data structure compatible with the interprocedural static code analyzer.

20 . The device of claim 16 , wherein the language-independent control graph is based on a JavaScript Notation format.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Deng Shao Kun
• Jin Matthew Glenn
• Lahiri Shuvendu
• Liu Xiaoyu
• Shi Xin
• Sundaresan Neelakantan

Classifications

• G06F8/71

  Version control (security arrangements therefor G06F21/57); Configuration management · CPC title

• G06F8/51

  Source to source · CPC title

• G06F11/3604 Primary

  Analysis of software for verifying properties of programs (testing of software G06F11/3668) · CPC title

• G06F8/31

  Programming languages or programming paradigms · CPC title

• G06F8/437

  Type checking · CPC title