为了提高程序的静态分析精度，提出了一种应用基于区域的符号化三值逻辑(region-based symbolic threevaluedlogic，简称RSTVL)的静态分析方法.RSTVL能够描述C程序运行时内存中数据结构的形态信息与变量的存储状态，以及可寻址表达式间的各种关系，包括指向关系、层次关系与取值逻辑关系.为了提高静态分析的精度，提出了一种基于RSTVL的流敏感、域敏感的过程内分析与基于符号化函数摘要的上下文敏感的过程间分析，能够精确地分析出每个程序点上的形态信息、数据流信息与指针指向关系.实验结果表明，相对于基于符号化三值逻辑的方法，该分析方法在保证一定分析效率的前提下，能够实现较高准确度的分析.

In order to improve the precision of static analysis for C procedures, this paper introduces a static analysis method applying region-based symbolic three-valued logic (RSTVL). RSTVL can describe shape of data structures, all kinds of memory states and relations of addressable expressions including alias relations, hierarchical relations and logic relations. To improve precision, a RSTVLbased analysis method is proposed to analyze the shape, dataflow and point-to relationship at every procedure point. The method facilitates flow-sensitive and field-sensitive intra-procedure, and context-sensitive inter-procedure analysis based on symbolic function summary. Experimental results validate that the porposed static analysis method offers higher precision on the precondition with no efficiency loss.

国家自然科学基金（91318301, 61202080）；国家高技术研究发展计划（863）（2012AA011201）