Oracle International Corporation

Yang Zhao

Nicholas John Allen

Padmanabhan Krishnan

Cristina Nicole Cifuentes

Nathan Robert Albert Keynes

David John-Bruce Meibusch

Raghavendra Kagalavadi Ramesh

A method may include detecting a first sub-flow, by executing a local defect analysis on code starting at a sink instruction, to a load instruction performing reading a first value using a first variable. The first sub-flow may include a first label of a first defect. The method may further include detecting a second sub-flow, by executing the local defect analysis on the code starting at a store instruction, to a load instruction performing writing a second value using a second variable. The second sub-flow may include a second label of a second defect. The method may further include determining that the first variable and the second variable are potential aliases by determining that the first label matches the second label, and obtaining, based on determining that the first variable and the second variable are potential aliases, a nonlocal flow by connecting the first sub-flow and the second sub-flow.

Alias analysis using labelled access paths

A method for executing a second-order taint analysis on library code may include generating, by executing a first-order taint analysis on the library code starting at a sink, a first execution path from a load instruction to the sink. The load instruction may perform: reading a first value using a first global identifier. The method may further include determining a store instruction by matching the load instruction and the store instruction. The store instruction may perform: writing a second value using a second global identifier. The method may further include, generating a second execution path from the store instruction to the load instruction, generating, by executing the first-order taint analysis on the library code starting at the store instruction, a third execution path from an entry point to the store instruction, and forming a potential second-order taint flow by joining the first, second, and third execution paths.

Detecting second-order security vulnerabilities in libraries

A method may include obtaining original source code including entities. The entities each correspond to a location in the original source code. The method may further include during an offline phase and by a computer processor, generating, from the original source code, (i) a dependency graph including nodes corresponding to the entities and (ii) a location index that maps each location in the original source code to one of the nodes, and during an online phase following the offline phase and using the dependency graph and the location index: identifying modified locations in the original source code by comparing modified source code to the original source code, obtaining, for each of the modified locations and by searching the location index, matching nodes, determining, for each of the matching nodes, impacted nodes reachable from the matching node, and identifying, using the location index, impacted entities corresponding to the impacted nodes.

Fast change impact analysis tool for large-scale software systems

A method may include obtaining original source code including entities. The entities each correspond to a location in the original source code. The method may further include generating, from the original source code, a dependency graph including nodes corresponding to the entities, extracting a location index that maps each location in the original source code to one of the nodes, identifying modified locations in the original source code by comparing modified source code to the original source code, obtaining, for each of the modified locations and by searching the location index, matching nodes, determining, for each of the matching nodes, impacted nodes reachable from the matching node, and identifying, using the location index, impacted entities corresponding to the impacted nodes.

A method for performing a static analysis may include extracting, from a caller function in code, a context-free inter-procedural rule including a callsite and a return value of a callee function. The callsite may invoke the callee function. The method may further include extracting, from the caller function, a context-sensitive parameter mapping rule that maps an input parameter of the callee function to an invocation value provided by the caller function at the callsite, deriving a derived value for the callsite using the context-free inter-procedural rule and the context-sensitive parameter mapping rule, and identifying a defect in the code by performing the static analysis using the derived value for the callsite.

Compositional string analysis

A method may include generating, for a concurrent application, an execution trace that includes operations, extracting actor pairs from the execution trace, assigning each of the operations to an actor pair, and generating vector clocks for the operations. Each vector clock may include a clock value for each of the actor pairs.

Happens-before-based dynamic concurrency analysis for actor-based programs

A method may include obtaining a concurrent application including processes, each including operations, and obtaining an initial hybrid timestamp for an initial operation of a process. The initial hybrid timestamp may include a vector list timestamp including vector clocks, each including a clock value for each of the processes. The method may further include determining a synchronization category for a next operation of the process, and in response to the synchronization category indicating that the next operation does not require inter-process synchronization, generating a next hybrid timestamp for the next operation. The next hybrid timestamp may include a differential timestamp relative to the initial hybrid timestamp.

Growing community of inventors

Brisbane, Australia

Yang Zhao