C至3C
C to Checked C by 3C
摘要：
由于C（和C++）的持续使用，空间安全违规（例如，缓冲区溢出）仍然构成当今最危险和最普遍的安全漏洞之一。为了对抗这些违规行为，Bounds-Enforced检查指针类型扩展了C。CXC本质上是一个渐进类型的空间安全的C -检查指针与传统指针向后二进制兼容，并且语言允许它们被逐段添加，而不是必须一次全部添加，因此安全改造可以是增量的。本文提出了一个半自动化的过程中移植遗留的C程序到CNOC。该过程以3C为中心，这是一种基于静态分析的注释工具。3C采用两种新颖的静态分析算法--typ 3c和boun 3c--将遗留指针注释为检查指针，并推断需要它们的指针的数组边界注释。3C执行根本原因分析，以指导人类开发人员进行应该重构的代码;一旦完成，3C可以重新运行以推断进一步的注释（和更新的根本原因）。在11个程序上的实验表明，3C在推断检查指针类型方面是有效的，并且以前和新移植的代码的经验发现，3C在与人为驱动的重构相结合时工作得很好。
英文摘要：
Owing to the continued use of C (and C++), spatial safety violations (e.g., buffer overflows) still constitute one of today's most dangerous and prevalent security vulnerabilities. To combat these violations, Checked C extends C with bounds-enforced checked pointer types. Checked C is essentially a gradually typed spatially safe C - checked pointers are backwards-binary compatible with legacy pointers, and the language allows them to be added piecemeal, rather than necessarily all at once, so that safety retrofitting can be incremental. This paper presents a semi-automated process for porting a legacy C program to Checked C. The process centers on 3C, a static analysis-based annotation tool. 3C employs two novel static analysis algorithms - typ3c and boun3c - to annotate legacy pointers as checked pointers, and to infer array bounds annotations for pointers that need them. 3C performs a root cause analysis to direct a human developer to code that should be refactored; once done, 3C can be re-run to infer further annotations (and updated root causes). Experiments on 11 programs totaling 319KLoC show 3C to be effective at inferring checked pointer types, and experience with previously and newly ported code finds 3C works well when combined with human-driven refactoring.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
