Recitation 8: Static Analysis

Transcription

1 Recitation 8: Static Analysis GOALS This recitation seeks to prepare you for Homework 6. More generally, the goals of this recitation are: Practice creating control flow graphs, Understand data flow analysis, Practice applying static analysis to program code, Practice understanding and extracting useful information from code disassembly. PART 1: CONTROL FLOW GRAPH Consider the following program: import java.io.fileinputstream; import java.io.fileoutputstream; import java.io.inputstream; import java.io.outputstream; public class StreamDemo { public static void main(string[] args) throws Exception { OutputStream os = null; InputStream is = new FileInputStream("in.txt"); int i; try { os = new FileOutputStream("out.txt"); System.out.println("Copying in progress..."); while ((i = is.read())!= -1) { // Read till the end of the stream os.write(i); if (os!= null) { os.close(); catch (Exception e) { e.printstacktrace(); is.close(); ACTIVITIES

2 1. Identify the problem with the code and suggest a way to fix it. 2. Create a control flow graph for the main() method. Part 2: FindBugs 1. Set up Findbugs to run in Eclipse 1. Follow the instructions at to download Findbugs for Eclipse (use the official release site and download all the Findbugs packages) 2. Download Eclipse PDE 1. Navigate to 2. Drag the install button from the page to your running Eclipse program 2. Create the Findbugs control flow graph output to see the results *You ll be using the Findbugs plugin named ControlFlowPrinterPlugin in the Piazza resource page, (on the page where the homeworks are) in the recitation section. You ll also be using the file StreamDemo.java, which is the Java file of part 1. It may be a good idea for you to download the plugin and then skip to step i. Follow the steps the rest of the way to see the Findbugs output, and then later do steps 1 through 8 to set up your own plugin. 1. Create an empty plugin project in Eclipse (or create a Java Project and then right-click on the project, select Configure and then convert to plug-in project) 2. Select the MANIFEST.MF file and click the add button in the required plugins 1. (In the Dependencies tab) Search for Findbugs and select the plugin that appears. The required plugins list should now show the findbugs plugin. 2. (In the Extensions tab) Search for the findbugsplugin and add that to the list. 3. (In the MANIFEST.MF tab) change the line that reads Bundle-SymbolicName: ControlFlowPrinterPlugin to Bundle-SymbolicName: ControlFlowPrinterPlugin;singleton:=true 3. Copy bcel-5.2.jar and findbugs.jar into your project (add them to the build path) - these files are in the plugin on the Piazza page 4. Create a file for your plugin (this can be a class file) in the src folder. Name a package and then create a class which extends CFGDetector. 1. Eclipse should throw an error that you have an unimplemented method so add that method to get rid of the compile error. 2. If you started with any other classes in your source file, delete those classes. 3. Have the file look similar to the sample ControlFlowPrinter.java - my advice is to copy the methods over from the sample plugin on piazza 5. Select the plugin.xml tab and change the code to read, where <package.detectorclassname> is replaced with the package and file of your bug detector:

3 plugin.xml: <?xml version="1.0" encoding="utf-8"?> <?eclipse version="3.4"?> <plugin> <extension id="<package.detectorclassname> point="edu.umd.cs.findbugs.plugin.eclipse.findbugsplugins"> <findbugsplugin fbpluginid="<package.detectorclassname>" librarypath="./bin" /> </extension> </plugin> 6. Select the build.properties tab and change it to read: source.. = src/ output.. = bin/ bin.includes = META-INF/,\.,\ plugin.xml 7. Create a file findbugs.xml in the src folder 1. Change the provider attribute value to your initials 2. from the sample findbugs.xml file, change the class to <package.detectorclassname>, where <package.detectorclassname> is the package and classname of your plugin 3. change the abbrev value to an abbreviation of the bug (or something short) 4. change the type to CFGPRINTERROR (or whatever you used in the detector file) 8. Create a file messages.xml in the src folder 1. change the Detector s value to <package.detectorclassname> 2. change the bug pattern to CFGPRINTERROR (or whatever you used in the detector file) 3. Change description text to descriptions of the error 4. In the BugCode, change the abbrev value to an abbreviation of the bug and the element text to a longer version of the detected bug. 9. Right click your project, select Run as and select Eclipse Application - another Eclipse application should start 10.Create new project with a new Java file in this new Eclipse Application instance. Make the file contain the code from the original control flow section (StreamDemo.java). 11.Single click the project and then select Project then Properties from the Toolbar 12.In the new menu, select Findbugs (then check the print output in the original Eclipse application, if you have a stack trace that mentions your plugin, there was an error along the way and you need to correct the error and then restart the second Eclipse application) 13.Assuming everything went well, check Enable Project Specific Setting and then select the Detector Configuration Tab 1. uncheck all of the default Findbugs checks and make sure your new detector check is enabled - this is not required but it speeds up running your check multiple times which your will be doing when debugging your plugin. Then click ok 14.Right click your project and select the Findbugs option. The detector should run and display 2 errors. One for the default class constructor (which doesn t even have to written out) and one for the main method.

4 15.Go back to the original Eclipse application and either expand the console output or copy the output in the console into another text editor so it easier to read (click in the console, ctrl+a, and then ctrl+v) 16.Examine the control flow graph of the method. Notice how all statements in Java can throw a runtime exception and thus blocks are commonly only one statement long. Also note that the instructions are in Java Byte Code, the assembly language of the Java Virtual Machine. The byte code is how other languages like Scala, are able to interact with Java. The byte code is explained in the next section. 17.If you have time, draw out the control flow graph created by findbugs to see how it differs from the control flow graph from part 1. PART 3: CODE DISASSEMBLY To see the Java Byte code generated by a Java file, first compile the file and then run javap -c on the compiled class file. Javap will produce a similar output to the one below when ran on StreamDemo.java. The first method below is the default constructor for the class. The second method is the main method from above. Java Byte Code consists of instructions that operate on the JVM stack. This simplified the instruction set and supports a wider range of computers. For example aconst_null pushes null on the stack. Then astore_1 saves the null value as the first local variable. These two instructions are the result of translating OutputStream os = null to byte code. Use to look up what specific instructions do. Some instructions, such as 37: if_icmpeq 48 contain a reference to another instruction. This statement is saying, if the top two integers on the stack are equal, then jump to instruction 48. Otherwise continue on. Other instructions contain references to outside tables. 8: invokespecial #4 // Method java/io/fileinputstream."<init>":(ljava/lang/string;)v the #4 refers to the line printed after the comment. The total command is to invoke the method <init> (which creates a new instance of the object), has the parameter of type string (Ljava/lang/String means the class type java/lang/string) and returns a void type other than the object instantiated. The exception table at the end of the printout Exception table: from to target type Class java/lang/exception says that from instruction 12 to instruction 56 any Exception thrown will jump to instruction 59. This corresponds to the try-catch statement in the program. Running: $ javac StreamDemo.java $ javap -c StreamDemo.class produces the following output for the main() method: public class StreamDemo { public StreamDemo(); Code: 0: aload_0 1: invokespecial #1 // Method java/lang/object."<init>":()v

5 4: return public static void main(java.lang.string[]) throws java.lang.exception; Code: 0: aconst_null 1: astore_1 2: new #2 // class java/io/fileinputstream 5: dup 6: ldc #3 // String in.txt 8: invokespecial #4 // Method java/io/fileinputstream."<init>":(ljava/lang/string;)v 11: astore_2 12: new #5 // class java/io/fileoutputstream 15: dup 16: ldc #6 // String out.txt 18: invokespecial #7 // Method java/io/fileoutputstream."<init>":(ljava/lang/string;)v 21: astore_1 22: getstatic #8 // Field java/lang/system.out:ljava/io/printstream; 25: ldc #9 // String Copying in progress... 27: invokevirtual #10 // Method java/io/printstream.println:(ljava/lang/string;)v 30: aload_2 31: invokevirtual #11 // Method java/io/inputstream.read:()i 34: dup 35: istore_3 36: iconst_m1 37: if_icmpeq 48 40: aload_1 41: iload_3 42: invokevirtual #12 // Method java/io/outputstream.write:(i)v 45: goto 30 48: aload_1 49: ifnull 56 52: aload_1 53: invokevirtual #13 // Method java/io/outputstream.close:()v 56: goto 66 59: astore 4 61: aload 4 63: invokevirtual #15 // Method java/lang/exception.printstacktrace:()v 66: aload_2 67: invokevirtual #16 // Method java/io/inputstream.close:()v 70: return Exception table: from to target type Class java/lang/exception ACTIVITIES 1. Identify what lines of the javap output correspond to the if statement, the while loop, and the exception handling. 2. Identify the problem with the code in the javap output.