Detecting Element Accessing Bugs in C++ Sequence Containers

Sequence Containers (SC) in the C++ Standard Template Library (STL), such as the vector, are widely used in large-scale projects for their maintainability and flexibility. However, accessing the elements in an SC is bug-prone, as such operations will not check their boundaries during compilation or execution, which can lead to memory errors, such as buffer overflow problems. And these bugs are difficult to detect with available static analyzers, since the size of SCs and the target of iterators cannot be precisely tracked without accurate analysis of the behavior of SCs and iterators.To address this problem, we propose a combined model of SC sizes and iterator targets by tracking them simultaneously through a set of meta-operations extracted from corresponding method calls, and report improper operation usages according to three bug patterns. We implement the approach as a static analyzer, Scasa, on the top of the Clang Static Analyzer (CSA) framework, and evaluate its effectiveness and efficiency against CSA and other state-of-the-art static analyzers on a benchmark composed of 2,230 manually created code snippets and eight popular open-source C++ projects with a lot of SC usages. The experimental results reveal that Scasa effectively identifies nearly all inherent bugs within the manual code snippets and generates 125 reports for these projects (with a time loss of 5–85%) where 72 of them are marked as correct with a manual revision. And to further confirm these correct reports, we also select some important ones for developers. These results show that accessing elements of SCs is bug-prone, and cooperatively tracking SC sizes and iterator targets can accurately detect these bugs with acceptable overhead.CCS CONCEPTS• Software and its engineering → Software defect analysis.