JP6476994B2 - Indication sorting apparatus, indication sorting method and program - Google Patents

Description

  The present invention relates to an indication sorting device, an indication sorting method, and a program.

  Static verification tools (static verification devices) are used to detect problems related to software bugs and security vulnerabilities. The static verification tool points out the problem of the software without executing the executable file of the software by internally constructing and verifying any model regarding the source code of the software to be verified.

  As examples of static verification tools, for example, "C ++ test" (trademark) and "Jtest" (trademark) of TechMatrix are known.

  Static verification tools generally point out software problems by performing verification using only source code. Therefore, indications from the static verification tool may include false positives. False detection does not occur when the software to be verified is executed, and is an indication that does not actually need confirmation or correction. The false detection occurs due to, for example, information assumed when the static verification tool performs verification (system setting information, information of the setting file, etc.). Therefore, with regard to indications from static verification tools, methods for suppressing the number of indications that should actually be confirmed are being considered.

  Patent Document 1 describes a determination work support system and the like. The determination work support system described in Patent Document 1 processes the similar indications that are unified in advance to be the same examination result when the user scrutinizes the indications, thereby reducing the duplication work of the similar indications. Support reduction etc.

  Patent Document 2 describes a source code analysis device and the like. The source code analysis device described in Patent Document 2 includes a first number of warnings and a second number of warnings, which are the number of warnings detected as a result of statically analyzing the first source code and the second source code obtained by modifying the first source code. Prioritize warning information based on the number of warnings.

  Patent Document 3 describes a source program analysis device and the like. The source program analysis device described in Patent Document 3 analyzes its own rule violation part and automatically corrects the source code according to the analysis result.

JP 2012-256220 A Japanese Patent Application Publication No. 2008-052424 JP, 2006-236042, A

  In the case of suppressing the number of indications from the static verification tool, it is preferable that the number of the indications is appropriately suppressed regardless of the type of software to be verified and the number of verifications. However, with the technology described in Patent Document 1 etc., for example, when the static verification tool is applied to software for the first time, the number of indications from the static verification tool may not be sufficiently suppressed.

  The present invention has been made to solve the above-mentioned problems, and its main object is to provide an indication / sorting device and the like that make it possible to efficiently identify the indication of a static verification device.

The indication / sorting device according to one aspect of the present invention includes sorting rule acquisition means for acquiring a sorting rule indicating a condition for sorting a tool indication that is a result of verification of a source code by a static verification device; And analysis means for associating information on the source code and deriving information on a processing type indicating the type of processing in the source code included in the tool indication as analysis information, and based on the analysis information and the sorting rule And sorting means for sorting the tool indications related to the sorting rule.

According to one aspect of the present invention, a method of selecting an indication obtains a selection rule indicating a condition for selecting a tool indication which is a result of verification of a source code by a static verification apparatus, the tool indication, and the source code Information associated with the information related to the processing rule, the information related to the processing type indicating the type of processing in the source code included in the tool indication is derived as analysis information, and the information relates to the sorting rule based on the analysis information and the sorting rule Select tool indications.

A program according to an aspect of the present invention includes: a process of acquiring a sorting rule indicating a condition for screening a tool indication which is a result of verification of a source code by a static verification device; the tool indication; and the source code Related to the information related to information, and a process of deriving information related to a process type indicating the type of process in the source code included in the tool indication as analysis information, and related to the sorting rule based on the analysis information and the sorting rule And the process of selecting the tool indication.

  According to the present invention, it is possible to provide an indication sorting device or the like that makes it possible to efficiently identify the indication of the static verification device.

It is a figure showing composition of an indication sorting device in a 1st embodiment of the present invention. It is a figure which shows an example of the classification | selection rule used with the indication classification | selection apparatus in the 1st Embodiment of this invention. It is a figure which shows the example of the information regarding the tool indication used by the analysis part of the indication classification | selection apparatus in the 1st Embodiment of this invention. It is a figure which shows the example of the analysis information which is an analysis result in the analysis part of the indication classification | selection apparatus in the 1st Embodiment of this invention. It is a figure which shows the example of the procedure of the classification in the classification | category part of the indication classification | selection apparatus in the 1st Embodiment of this invention. It is a flowchart which shows an example of operation | movement of the indication classification | selection apparatus in the 1st Embodiment of this invention. It is a flowchart which shows another example of operation | movement of the indication classification | selection apparatus in the 1st Embodiment of this invention. It is a figure showing an example of composition of a static verification system which has an indication sorting device in an embodiment of the present invention. It is a figure showing an example of an information processor which realizes an indication classification device etc. in an embodiment etc. of the present invention.

  Embodiments of the present invention will be described with reference to the accompanying drawings. In the embodiment of the present invention, each component of each device indicates a block of a function unit. Each component of each device can be realized, for example, by an arbitrary combination of an information processing device 500 as shown in FIG. 9 and software. The information processing apparatus 500 includes the following configuration, as an example.

・ CPU (Central Processing Unit) 501
ROM (Read Only Memory) 502
RAM (Ramdom Access Memory) 503
The program 504 loaded to the RAM 503
A storage device 505 for storing the program 504
· Drive device 507 for reading and writing the recording medium 506
A communication interface 508 connected to the network 509
・ Input / output interface 510 for data input / output
.Buses 511 connecting each component
There are various modifications in the implementation method of each device. For example, each device can be realized as a dedicated device. Each device can be realized by a combination of a plurality of devices.

First Embodiment
First, a first embodiment of the present invention will be described. FIG. 1 is a view showing a pointing and sorting apparatus according to a first embodiment of the present invention. FIG. 2 is a diagram showing an example of the sorting rule used in the indication sorting device according to the first embodiment of the present invention. FIG. 3 is a diagram showing an example of information on tool indication used in the analysis unit of the indication / sorting device according to the first embodiment of the present invention. FIG. 4 is a diagram showing an example of analysis information which is an analysis result in the analysis unit of the indication / selection device according to the first embodiment of the present invention. FIG. 5: is a figure which shows the example of the procedure of the classification | category in the classification | category part of the indication classification | selection apparatus in the 1st Embodiment of this invention. FIG. 6 is a flowchart showing an example of the operation of the indication / sorting device in the first embodiment of the present invention. FIG. 7 is a flow chart showing another example of the operation of the indication / sorting device in the first embodiment of the present invention.

  As shown in FIG. 1, the indication / sorting device 100 according to the first embodiment of the present invention includes a sorting rule acquisition unit 110, an analysis unit 120, and a sorting unit 130. The sorting rule obtaining unit 110 obtains a sorting rule indicating a condition for sorting a tool indication which is a result of the source code being verified by the static verification device. The analysis unit 120 derives analysis information that associates the tool indication with the information on the source code. The sorting unit 130 sorts tool indications related to the sorting rule based on the analysis information and the sorting rule.

  Then, each component of the indication classification | selection apparatus 100 in embodiment of this invention is demonstrated.

  The sorting rule acquisition unit 110 acquires the sorting rule as described above. The sorting rules represent conditions for sorting tool indications indicated from the static verification device. The tool point is a point indicated as a problem of source code from the static verification device as a result of verifying the program source code in the static verification device.

  FIG. 2 shows an example of the sorting rule. In the example shown in FIG. 2, three sorting rules are given. The sorting rule includes, as an example, a sorting rule number, a problem rule name, a processing position, a processing type, and information on the left side and the right side which are information related to the source code.

  The sorting rule number represents a number uniquely assigned to each condition for sorting tool indications in the sorting rule. In the example shown in FIG. 2, serial numbers are assigned to the three sorting rules.

  The problem rule name is prepared in advance by, for example, a static verification device, and the name of a rule (hereinafter referred to as a "problem rule" as necessary) regarding a problem detected as a tool indication by the static verification device It is information to represent. That is, as the problem rule name, the rule of the static verification device to be sorted by the indication sorting device 100 in the present embodiment is designated. In the example of the sorting rule used in the present embodiment, one problem rule name is designated for one sorting rule.

  In the example shown in FIG. 2, in the sorting rule of which the sorting rule number is 1, a rule of “MemoryLeak” indicating the possibility of a memory leak is designated as a problem rule name. Similarly, in the sorting rule with the sorting rule number 2, a rule "nonEval" indicating the possibility of a problem regarding the evaluation of the conditional expression is designated as a problem rule name. Further, in the sorting rule with the sorting rule number 3, a rule “NullPointer” indicating the possibility of referring to a null pointer is designated as the problem rule name.

  The processing position is information indicating the order relation of processing on the source code related to the tool indication sorted using the sorting rule. In the present embodiment, as shown in FIG. 2, the item of the processing position is selected from three of “problem creation line”, “middle” and “problem occurrence line”.

  "Problem making lines" are places in the source code where processing that may cause problems pointed out as static tools by the static verification device is performed. The "intermediate" is a part related to the processing in the source code from the processing that causes the problem pointed out as a tool pointing from the static verification device to the processing in the middle from the problem may actually occur. The "problem occurrence line" is a place in the source code where a problem pointed out by the static verification device as a tool indication may actually occur.

  In addition, according to the type of tool indication to be sorted, the intention of the user of the pointed sorter in this embodiment, etc., one or more processing positions are designated as needed for each sorting rule. Ru. In addition, a plurality of processing positions of the same type may be designated as processing positions for each sorting rule.

  In the present embodiment, as shown in FIG. 2, in the sorting rule whose sorting rule number is 1, the processing position where the “problem occurrence row” is specified is designated. Also in the sorting rule whose sorting rule number is 2, as in the sorting rule whose sorting rule number is 1, the processing position where the “problem occurrence line” is specified is specified. Further, in the sorting rule of which the sorting rule number is 3, processing positions to be “problem making row”, “middle” and “problem occurrence row” are designated.

  The process type indicates the type of process performed in the source code associated with the process position described above. In the present embodiment, the item of the processing type is selected from three of “Insert”, “Eval” and “reference” as shown in FIG. A process type is designated for each of the process positions described above.

"Insert" indicates that processing such as substitution is performed at the relevant place in the source code. “Eval” indicates that processing such as evaluation of conditional expressions and values is performed at relevant places in the source code.
Also, "reference" indicates that a reference such as a value is made at a relevant place in the source code.

In the present embodiment, as shown in FIG. 2, in the sorting rule whose sorting rule number is 1, the processing type of “Insert” is designated for the processing position which is the “problem occurrence row”. Further, in the sorting rule whose sorting rule number is 1, the processing type of "Eval" is designated for the processing position which is the "problem occurrence row".
In the sorting rule with sorting rule No. 3, for the processing position of “Problem creating line”, for “Insert”, for “Processing position” of “Intermediate”, for “Eval” for processing position of “problem occurrence line” Each of the processing types of "Eval" is designated.

  The left side and the right side, which are information related to the source code, indicate the contents of the process executed by the source code related to the processing position and the processing type described above. The information on the left side and the right side is collectively referred to as processing information. In the present embodiment, the contents of processing in the source code are described using a regular expression description and information of a specific variable separated by a “%” symbol. In the present embodiment, as information on a specific variable, a variable related to a problem pointed out as a tool in the static verification device (hereinafter referred to as “problem variable”) is displayed in the form of% ERROR_VAL%. Be done.

  The format of the information shown in the left side and the right side is determined according to the processing type described above. When the processing type is “Insert”, the left side and the right side indicate processing assumed to be performed on the left side and the right side in the source code associated with each of the processing position and the processing type.

  When the processing type is “Eval” or “reference”, the left side indicates a position corresponding to each of the processing position and processing type in the source code. Then, in this case, the right side indicates that there is no processing or the like corresponding to the source code in the form of "-".

  In the present embodiment, as shown in FIG. 2, in the sorting rule with the sorting rule number 1, the left side is “*”. The right side is “realloc. * (% ERROR_VAL%). Note that“ * ”given to the left side indicates“ * ”(asterisk) generally used in regular expressions and an arbitrary character string As described above, by making it possible to express using a regular expression, any condition can be easily specified as the processing information, including the case where there is no particular condition.

  In the above example, the left side and the right side indicate that it relates to the process of substituting the return value of the realloc function or the like that performs the process of reallocating the memory block with the problem variable described above as an argument. Therefore, this sorting rule indicates that the tool issues associated with the memory leak resulting from the execution of the realloc function that performs the process of reassigning the memory block are sorted out.

  In the present embodiment, in the sorting rule whose sorting rule number is 2, the left side is “^ [] =% ERROR_VAL%”. Also, the right side is "-". Therefore, this sorting rule indicates that in the evaluation of a conditional expression etc., the tool indication that arises due to substituting the value of the problem variable into another object is sorted out.

  In addition, in the sorting rule of sorting rule number 3, regarding the processing position of “Problem making lines”, “*” is on the left side and “malloc” on the right side. In addition, regarding the processing of “middle”, the left side is “if (% ERROR_VAL%. *! = NULL)” and the right side is “−”. Then, regarding the processing position of the “problem occurrence line”, “*” is given to the left side, and “¥ *. *% ERROR_VAL%” is given to the right side. This sorting rule indicates that, after the execution of the malloc function that allocates a memory block, it is possible to sort out a tool indication about a NULL pointer reference that occurs due to the reference of the variable while the problem variable indicates NULL.

  The sorting rule acquisition unit 110 acquires the above-described sorting rule by any method. For example, the sorting rule acquisition unit 110 may be configured to edit each item included in the above-described sorting rule. In this case, the sorting rule acquisition unit 110 executes addition, deletion, and addition, update, and deletion of each item included in the sorting rule. That is, the sorting rule acquisition unit 110 acquires the sorting rule edited as described above.

  In addition, the sorting rule acquisition unit 110 may be configured to acquire a sorting rule created by another tool or system. In this case, the sorting rule acquisition unit 110 acquires the sorting rule via a communication network or an arbitrary storage unit such as a file or a memory.

  In the example of FIG. 2, an example in which three rules are specified as the problem rule name is shown. However, any rule whose verification is performed by the static verification device can be specified as the problem rule name. Further, with respect to the rules shown as the problem rule names in FIG. 2, the sorting rule acquisition unit 110 may acquire and use sorting rules having contents different from those in FIG. 2.

  The analysis unit 120 derives analysis information. The analysis information is information that associates the tool indication with the information on the source code, as described above. The analysis unit 120 derives analysis information by acquiring source code to be verified in the static verification apparatus and information on a tool indication indicated from the static verification apparatus with respect to the source code.

  FIG. 3 is an example of information on a list of tool indications used in the analysis unit 120. The information on the list of tool issues shown in FIG. 3 is information on “problem rule name”, “problem variable name”, and “file name” and “line number” which are source information, for the tool issue shown from the static verification device. It is a list of the information which put together for each tool issue.

In FIG. 3, it is pointed out that the tool pointed out that the pointed number is 1 may fall under the problem rule MemoryLeak (that is, memory leak) for the variable buffer pointed out as the problem variable name. Indicates that. Also, the problem with this tool pointed out at least the files a. c and d. It is shown that it occurs in the process shown in each line number in c.
Similarly, the tool indicated by the indicated number 2 or 3 corresponds to the problem indicated by the problem rule for the variable indicated as the problem variable at the position of the line number in the file indicated as the source information. It indicates that there is a possibility.

  The problem rule name and the problem variable name indicate the same contents as the problem rule name and the problem variable name described above in the description of the sorting rule. Further, the information on the file name and the line number indicates the file name on which the process related to the problem rule described above is performed in the source code to be verified, and the line number in the file name.

  The analysis unit 120 may acquire a tool indication indicated from the static verification device, for example, for each indication, and appropriately generate information in the form shown in FIG. In addition, the analysis unit 120 may obtain information on a list of tool indications that has been compiled in advance in the format of FIG. 3 or the like in the static verification device.

  FIG. 4 is a diagram showing an example of analysis information derived by the analysis unit 120. As shown in FIG. In the example shown in FIG. 4, the analysis information includes the information on the processing type included in the source information and the information on the left side and the right side (that is, the processing information described above) with respect to the information on the list of tool indications shown in It is the attached information. The process type indicates the same content as the process type described above in the description of the sorting rule.

  The analysis unit 120 derives analysis information with reference to the corresponding line of the source code indicated by the source information included in the tool indication, for example, regarding the information on the list of the tool indication shown in FIG. 3.

  More specifically, the analysis unit 120 refers to the corresponding line or the like of the source code based on the source information indicated by the information on the list of tool indications shown in FIG. 3. Then, the analysis unit 120 determines and determines the processing type and the information on the left side and the right side based on the description of the corresponding line etc. of the source code.

  That is, when there is a description indicating processing related to conditional branching such as if, switch, for, while, etc., in the corresponding line of the source code, the analysis unit 120 determines the processing type as “Eval”. If the processing type is not "Eval", the analysis unit 120 determines that the processing type is "Insert" when there is a description related to substitution such as "=" in the corresponding line of the source code. Then, when the processing type is neither “Eval” nor “Insert”, the analysis unit 120 determines the processing type as “reference”.

  Further, when the processing type is “Insert”, the analysis unit 120 sets the left side and the right side of the description related to substitution such as “=” in the corresponding line of the source code as the left side and the right side in the analysis information. Then, when the processing type is “Eval” or “reference”, the analysis unit 120 sets the description of the corresponding line of the source code as the left side in the analysis information. In this case, the analysis unit sets the right side in the analysis information to “−” described above.

  In the example illustrated in FIG. 4, for example, with respect to the tool indication having an indication number of 1, the analysis unit 120 at least performs at least a. c and d. See c. In this example, files a. c and d. c is described in the C ++ language, and it is assumed that the line number 10 (ie, the 10th line of the file a.c) has a description of "pointer = malloc (10);". Note that poiner is a variable, which is a function that allocates malloc memory blocks, and “=” indicates assignment. In this case, the analysis unit 120 determines that the process type is “Insert” because substitution is performed in the process of the line number as an analysis result of the line number. Then, the analysis unit 120 determines the left side as “pointer” and the right side as “malloc (10)” according to the determined processing type.

  Also, file a. It is assumed that the description “printf (“% s ”, test)” is present in the line number 12 of c. In this case, the analysis unit 120 determines that the process type is “reference”, as the process at the line number is not a process relating to substitution or the like or conditional branching as an analysis result on the line number. Then, the analysis unit 120 determines that the left side is “printf (“% s ”, test)” and the right side is “−” to indicate that there is no corresponding process according to the determined process type. .

  Similarly, file d. It is assumed that the description of “if (buffer! = NULL)” is present at line 15 of c. In this case, the analysis unit 120 determines that the processing type is “Eval” because the processing at the line number is a description related to a conditional branch as an analysis result on the line number. Then, the analysis unit sets the left side as “if (buffer! = NULL)” and the right side as “−” according to the determined processing type.

  The analysis unit 120 analyzes the other lines included in the source information in each tool indication according to the same procedure, and derives the analysis result.

  The sorting unit 130 sorts the tool indications related to the sorting rule based on the analysis information and the sorting rule as described above. That is, the sorting unit 130 extracts, from among the tool indications, the required indications based on the conditions specified in the sorting rule. When a rule as shown in FIG. 2 is acquired in the classification rule acquisition unit 110 as a classification rule, the classification unit 130, for example, as shown in FIG. 5, selects tool indications related to the classification rule.

  First, as shown in (1) of FIG. 5, the sorting unit 130 determines the problem rule name specified in one of the sorting rules and the problem rule pointed out by the tool indicated in the analysis information. Confirm the name and.

  If an issue about the same problem rule name as a problem rule name designated in one of the sorting rules does not exist in the tool issue included in the analysis information, the sorting unit 130 issues an issue that should be sorted regarding the relevant problem rule name I do not have. If an indication about the problem rule name is present in the tool indication, the selecting unit 130 determines the tool indication that the indication about the problem rule name is a tool indication candidate related to the selection rule.

  In the example of FIG. 5, for example, with respect to the selection rule of rule number 1, the selection unit 130 confirms whether or not a tool indication whose problem rule name is “MemoryLeak” is included in the analysis information. In the example of FIG. 5, the tool indication of the indication number 1 exists as a tool indication on the same problem rule name. Therefore, the sorting unit 130 determines the tool indication of the indication number 1 as a candidate for a tool indication related to the selection rule, and continues the processing.

  When an indication about the problem rule name is present in the tool indication, as shown in (2) of FIG. 5, the selecting unit 130 confirms in the tool indication based on the designation of the processing position included in the selection rule. Identify the target process. That is, according to the designation of the processing position designated by one of the above-described sorting rules, the sorting unit 130 identifies the processing to be confirmed in the tool indication described above.

  Specifically, in the case where the processing position is “problem creation row”, the sorting unit 130 performs the processing in the first row in the tool indication specified earlier. Decide as the target of confirmation. In addition, when the processing position is “middle”, the sorting unit 130 determines the processing except the processing in the first and last lines in the tool indication specified earlier as the target of confirmation. When the processing position is the “problem occurrence row”, the sorting unit 130 determines the processing in the last row as the target of confirmation in the tool indication designated earlier.

  In the example of FIG. 5, in the sorting rule of rule number 1, “problem occurrence line” is designated as the processing position. Therefore, the sorting unit 130 determines the processing in the last line (that is, the processing in the line number 20 of the file d.c) among the source information included in the tool indication of the indication number 1 determined previously as the target of confirmation. Do.

  When a plurality of processing positions are designated in the sorting rule, the sorting unit 130 specifies, for each of the processing positions, a line on which a process to be confirmed in tool indication is performed.

  When the process to be confirmed is determined in the tool indication, the selecting unit 130 confirms the process type as shown in (3) of FIG. That is, the sorting unit 130 checks whether the process type specified in one of the above-described sorting rules matches the process type in the process to be confirmed in the sorting rule determined in the previous process. Do.

  If these two processing types match, the sorting unit 130 continues the processing, assuming that the tool indication being determined is a candidate for a rule related to the sorting rule. If these two processing types do not match, the sorting unit 130 determines that the tool indication being determined has no indication to be sorted.

  In the example shown in FIG. 5, in the selection rule of rule number 1, there is one process designated as the process position. And the processing type regarding the processing position concerned is "Insert". In addition, the processing type in the line specified above in the tool indication is "Insert" as well. Therefore, the sorting unit 130 continues the process as the tool indication is a candidate of a rule related to the sorting rule of rule number 1.

  When “middle” is designated as the processing position of the sorting rule, there may be a plurality of lines relating to processing for which confirmation of the processing type is required in the tool indication. In this case, the sorting unit 130 checks the process type of the process included in the tool indication for all the processes for which the process position of “middle” is specified in the sorting rule. When the processing type matches any one of the processes included in the tool indication for all the lines related to the process for which “middle” is designated at the process position of the selection rule, the selection unit 130 sets the tool indication to the selection rule Assume that it is a candidate for related rules.

  When confirmation regarding the processing type is performed in the tool indication, the selection unit 130 confirms the left side and the right side as shown in FIG. 5 (4). That is, the sorting unit 130 compares the left side and the right side, which are processing information regarding each processing position in the sorting rule, with the left side and the right side regarding the row specified in the tool indication in the analysis information. Then, the sorting unit 130 determines, for example, whether it can be determined that the two left sides and the right sides described above match.

In the sorting rule, the left side and the right side are described using a regular expression or the like. When the left side and the right side of the previously specified line in the tool indication correspond to the regular expressions described as the left side and the right side, the selecting unit 130 determines that these correspond to each other.
Further, in the sorting rule, as described above, the problem variable may be represented in the form of% ERROR_VAL% on the left side or the right side. The sorting unit 130 may obtain information on the variable with reference to the item of “problem variable name” in the tool indication.

  Then, when it is determined that the two left sides and the right sides described above match, the sorting unit 130 sorts the corresponding tool indication as related to the sorting rule. If it can not be determined that the two left sides and the right sides described above match, the sorting unit 130 determines that the tool indication that is the target of the confirmation does not indicate the indication to be sorted.

  In the example shown in Fig. 5, in the sorting rule of rule No. 1, the left side is "*" and the right side is "realloc. * (% ERROR_VAL%). Also, in the tool indication, the left side in the previously identified line is The right side is "realloc (buffer, 20)".

  In this case, since the left side in the sorting rule is "*", an arbitrary character string corresponds to this left side. Therefore, the sorting unit 130 determines that the left side of the sorting rule matches the left side of the tool indication.

  Also, with regard to the right side in the sorting rule, regarding "realloc", the corresponding description is also described in the line specified in the tool indication. Then, since the problem variable is pointed out as "buffer" in the tool indication, "% ERROR_VAL%" on the right side in the sorting rule can be regarded as "buffer". That is, the description corresponding to “% ERROR_VAL%” on the right side of the sorting rule is described in the tool indication. Therefore, in the example illustrated in FIG. 5, the sorting unit 130 can determine that the right side of the sorting rule matches the right side of the tool indication.

  In the example shown in FIG. 5, according to the above process, the sorting unit 130 sorts the tool indication having the indication number of 1 as the indication to be sorted based on the selection rule having the selection rule number of 1.

  In addition, when there are a plurality of processes in the sorting rule and the tool indication, the sorting unit 130 checks all necessary left sides and right sides according to the processing type, the processing position, and the like.

  Further, the tool indications selected by the selection unit 130 are output through an arbitrary output unit as appropriate.

  Then, an example of operation | movement of the indication sorting apparatus 100 in the 1st Embodiment of this invention is demonstrated using FIG.

  First, the sorting rule acquisition unit 110 acquires a sorting rule which is a condition for sorting tool indications which is an output from the static verification device (step S101).

  Next, in order to derive analysis information, the analysis unit 120 acquires a source code that has been a target of verification by the tool indication and static verification apparatus (step S102). Based on the acquired tool indication and source code, the analysis unit 120 derives analysis information (step S103). When a plurality of tool indications are output from the static verification device, the analysis unit 120 may derive analysis information regarding all of them, or, based on a predetermined condition, a part of the tools may be derived. Analysis information may be derived for the indication. When a plurality of tool indications are output from the static verification device, the analysis unit 120 repeatedly derives analysis information for each tool indication until analysis information is derived regarding the required tool indications. It operates as (step S104).

  Next, the sorting unit 130 sorts tool indications related to the sorting rule based on the sorting rule and the tool indications (step S105). If a plurality of sorting rules are specified, the sorting unit 130 may sort tool indications for all sorting rules. In addition, the sorting unit 130 may derive analysis information regarding some sorting rules based on predetermined conditions and the like, such as for each problem rule name. When a plurality of sorting rules are specified, the sorting unit 130 may operate so as to repeat the sorting of the tool issues until the tool issues are sorted for the required sorting rule (step S106). .

  The tool indications selected by the selection unit 130 are output from output means (not shown) as appropriate. The output means includes display means, storage means such as files and memories, communication networks and the like. Also, the tool indications sorted by the sorting unit 130 may be output to another tool that analyzes the output from the static verification tool.

  Further, the indication / sorting device 100 in the first embodiment of the present invention may operate as shown in the flowchart of FIG. 7.

  In the flowchart shown in FIG. 7, the processes related to steps S102 to S106 are performed in the same manner as the processes to which the same numbers are attached in the flowchart shown in FIG.

  In the operation in the flowchart shown in FIG. 7, the indication / selection device 100 acquires a tool indication and a source code in step S102, and derives analysis information in steps S103 and S104. Thereafter, the indication / selection device 100 acquires, for example, the selection rule edited by the user of the static verification device or the like (step S111).

  When the sorting rule is acquired in step S111, the indication / sorting device 100 sorts the tool indication in steps S105 and S106. By doing this, the user of the static verification device refers in advance to the indication by the static verification device when selecting the indication of the static verification tool using the indication sorting device 100 in the present embodiment. Is possible. Therefore, the user of the static verification device can efficiently determine the sorting rule while referring to the indication by the static verification device.

  As described above, the indication / sorting device 100 according to the first embodiment of the present invention acquires the sorting rule on the tool indication to be sorted, analyzes the information on the tool indication and the source code, and selects the tool indication to be sorted. select. The indication / selection device 100 in the present embodiment can automatically select tool indications based on the selection rule without depending on the type of static verification device.

In addition, the tool indication selected by the indication sorting device 100 in the present embodiment is set based on the processing position of the source code, the processing type, the description of the source code, and the like included in the indication. That is, the user of the indication / sorting device 100 in the present embodiment can set in detail the condition of the tool indication to be sorted.
Then, for the indication on the source code of the tool indication to be selected, a regular expression or the like is used. That is, the user of the pointed selection device 100 in the present embodiment can easily set the selection rule.

  Therefore, the indication sorting device 100 in the present embodiment makes it possible to efficiently confirm the indication of the static verification device.

(Application example of the indication sorting device in the embodiment of the present invention)
The indication sorting device 100 in the present embodiment is realized in various forms. As an example, the indication sorting device 100 in the present embodiment may be used alone as a single entity independent of the enactment verification device. In this case, for example, when the user of the static verification device refers to the tool indication from the static verification device, the designation / sorting device 100 is appropriately used as needed.
Further, in this case, the indication and sorting device 100 may be provided with, for example, a command line interface (CLI) so as to enable acquisition of sorting rules and tool indications and output of results. Note that the indication / filtering device 100 may have another interface such as a graphical user interface (GUI).

  In addition, as shown in FIG. 8, the indication sorting device 100 may be incorporated into a static verification system having a static verification device. FIG. 8 is a diagram showing an example of the configuration of a static verification system having the indication / sorting device in the embodiment of the present invention. In FIG. 8, the static verification system 10 includes a static verification device 11 and the above-described indication / sorting device 100. Then, the indication sorting device 100 performs sorting on a tool indication that is output when the static verification device 11 verifies.

  In addition, the static verification device 100 may be incorporated and used in an integrated development environment of software, for example, in the form of the static verification system described above.

  As mentioned above, although this invention was demonstrated with reference to embodiment, this invention is not limited to the said embodiment. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. Further, the configurations in the embodiments can be combined with each other without departing from the scope of the present invention.

10 static verification system 11 static verification device 100 indication sorting device 110 sorting rule acquisition unit 120 analysis unit 130 sorting unit 500 information processing device 501 CPU
502 ROM
503 RAM
504 program 505 storage device 506 recording medium 507 drive device 508 communication interface 509 network 510 input / output interface 511 bus

Claims (9)

A sorting rule acquiring unit for acquiring a sorting rule indicating a condition for sorting a tool indication which is a result of the source code being verified by the static verification device;
An analysis unit that associates the tool indication and information on the source code, and derives, as analysis information, information on a process type indicating the type of process in the source code included in the tool indication ;
And a sorting unit configured to sort the tool indications related to the sorting rule based on the analysis information and the sorting rule. The sorting rule acquisition means is information indicating the order relation of processing included in the tool indication as the sorting rule, and a problem creating line in which processing that may cause a problem pointed out as the tool indication is performed. Information regarding the processing position selected from three of the intermediate related to the process on the way from the process causing the problem to the time when the problem may actually occur and the problem line where the problem may actually occur The indication sorting device according to claim 1 which acquires. The sorting rule acquisition means acquires information on the processing type including substitution, evaluation, and reference indicating the type of processing to be executed in relation to the processing position as the sorting rule. Pointed sorting device.   4. The indication and sorting device according to claim 3, wherein the sorting rule acquisition unit acquires, as the sorting rule, processing information indicating contents of processing performed in the source code in relation to the processing position and the processing type.   5. The indication sorting device according to claim 4, wherein the analysis means derives processing in the source code included in the tool indication as the processing information. The sorting means sorts the tool indication included in the analysis information when the processing position, the processing type, and the processing information included in each of the analysis information and the sorting rule satisfy predetermined conditions. The indication sorting device according to any one of claims 4 to 5 . The indication sorting device according to any one of claims 1 to 6 ,
And a static verification device to verify the program source code,
The static verification system, wherein the indication / sorting device performs the sorting of the indication as the tool indication as a result of the verification performed by the static verification unit. Obtain a sorting rule that indicates the condition for sorting out tool indications that are the result of the source code being verified by the static verification device,
Associating the tool indication with the information on the source code, and deriving, as analysis information, information on a process type indicating a type of process in the source code included in the tool indication;
An index selection method for selecting the tool indication related to the selection rule based on the analysis information and the selection rule. On the computer
A process of acquiring a sorting rule indicating a condition for sorting a tool indication which is a result of the source code being verified by the static verification device;
A process of associating the tool indication and information on the source code, and deriving, as analysis information, information on a process type indicating a type of process in the source code included in the tool indication;
A program for executing processing for selecting the tool indication related to the selection rule based on the analysis information and the selection rule.

Images