基于源代码分析的软件静态测试

介绍了现代源代码分析技术中使用的安全规则,并对此技术可以测试出的软件中存在的内存管理、变量未初始化、空指针引用、数组访问越界或异常四类主要代码缺陷和缓冲区溢出等安全漏洞类缺陷几大问题做了研究。通过介绍一个基于源代码分析的静态测试工具Klocwork,提出了基于源代码分析技术的静态测试过程的四个阶段并对其进行分析,总结了其应用到大型航天软件中存在的一些问题,并说明解决其相应难题还需要准备进一步的研究工作。

Static software testing based on the source code analysis

This paper first introduces the safety rule which standardizes static software testings based on the source code analysis technology and lists a few big problems which can be tested by the technology.These problems can be categorized as memory management,uninitialized variables,null pointer exception,array access violation and exception and buffer overflow.Besides,this paper gives a static test tool,Klocwork,which analyses source code,and puts forward four stages of the static software testings based on the source code analysis technology.In the end,certain issues inside aerospace simulation applications are technically summarized with associated research plans.