15 Aoû 2024

Interprocedural context-sensitive analysis

15 Aoû 2024

Static code analyzers can take into consideration the data exchanged between procedures/functions, helping to detect more errors and potential vulnerabilities. This is crucial for identifying issues like memory leaks, null pointer dereferences, and array overruns, as these errors often arise when resource creation, usage, and release are handled by different functions.

To detect errors that result from the interaction of multiple functions, static analyzers use interprocedural context-sensitive code analysis.

We'll explore it in detail by examining a real error that PVS-Studio detected in the AvalonStudio source code (C#).

Let's look at the IsBuiltInType function first. Note that if its parameter, cursor, turns to be a null reference, the function returns false.

private static bool IsBuiltInType(ClangType cursor)
{
  var result = false;
  if (cursor != null && ....)
  {
    return true;
  }
  return result;
}

Take a look at another code fragment where the above function is called:

private static StyledText InfoTextFromCursor(ClangCursor cursor)
{
  ....
  if (cursor.ResultType != null)
  {
    result.Append(cursor.ResultType.Spelling + " ",
                  IsBuiltInType(cursor.ResultType) ? theme.Keyword 
                                                   : theme.Type);
  }
  else if (cursor.CursorType != null)
  {
    switch (kind)
    {
      ....
    }
    result.Append(cursor.CursorType.Spelling + " ",
                  IsBuiltInType(cursor.ResultType) ? theme.Keyword
                                                   : theme.Type);
  }
  ....
}

If cursor.ResultType != null, the body of the first if statement is executed. So, if control is passed inside the body of the second if, statement, we know for sure that cursor.ResultType reference is null.

Let's examine the spot where the IsBuiltInType function (which we discussed earlier) is called:

result.Append(cursor.CursorType.Spelling + " ",
              IsBuiltInType(cursor.ResultType) ? theme.Keyword
                                               : theme.Type);

The analyzer recognizes that cursor.ResultType is a null reference. So, it concludes that with this argument, the function always returns false.

That's what the interprocedural context-sensitive analysis is all about.

The ternary operator condition that is always false seems suspicious, so the analyzer issues a warning:

V3022 Expression 'IsBuiltInType(cursor.ResultType)' is always false.

The analyzer is right. If we examine the code more closely, we'll notice a typo. In the body of the second if statement, the cursor.CursorType variable should be passed as the argument when calling the IsBuiltInType function.

The fixed code:

private static StyledText InfoTextFromCursor(ClangCursor cursor)
{
  ....
  if (cursor.ResultType != null)
  {
    result.Append(cursor.ResultType.Spelling + " ",
                  IsBuiltInType(cursor.ResultType) ? theme.Keyword 
                                                   : theme.Type);
  }
  else if (cursor.CursorType != null)
  {
    switch (kind)
    {
      ....
    }
    result.Append(cursor.CursorType.Spelling + " ",
                  IsBuiltInType(cursor.CursorType) ? theme.Keyword
                                                   : theme.Type);
  }
  ....
}

Analyzing the interaction of functions located in different translation units or program modules adds complexity. In this case, it is referred to as intermodular analysis.

Additional links