boomerang.results

Class NullPointerDereference

java.lang.Object

boomerang.results.NullPointerDereference

All Implemented Interfaces:

AffectedLocation

public class NullPointerDereference
extends Object
implements AffectedLocation

Field Summary

Fields

Modifier and Type	Field and Description
static int	RULE_INDEX

Constructor Summary

Constructors

Constructor and Description
NullPointerDereference(ControlFlowGraph.Edge statement)
NullPointerDereference(Query query, ControlFlowGraph.Edge statement, Val variable, wpds.impl.PAutomaton<Statement,sync.pds.solver.nodes.INode<Val>> openingContext, wpds.impl.PAutomaton<Statement,sync.pds.solver.nodes.INode<Val>> closingContext, List<PathElement> dataFlowPath)

Method Summary

Modifier and Type	Method and Description
wpds.impl.PAutomaton<Statement,sync.pds.solver.nodes.INode<Val>>	getClosingContext() The closing context of a NullPointer provides the call stack via which a variable containing null returns to a caller.
List<PathElement>	getDataFlowPath()
String	getMessage()
Method	getMethod() Returns the method of the statement at which the null pointer occurs.
wpds.impl.PAutomaton<Statement,sync.pds.solver.nodes.INode<Val>>	getOpeningContext() The opening context of a NullPointer provides the call stack under which the null pointer occurs.
Query	getQuery()
int	getRuleIndex()
ControlFlowGraph.Edge	getSourceStatement() The source statement of the data-flow, i.e., the statement that assigns null to a variable.
Val	getSourceVariable() The source variable at the source statement.
ControlFlowGraph.Edge	getStatement() The statement at which a null pointer occurred.
Val	getVariable() The variable that contains "null" and which provokes at the statement a NullPointerException.
static boolean	isNullPointerNode(sync.pds.solver.nodes.Node<ControlFlowGraph.Edge,Val> nullPointerNode)
String	toString()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Detail

RULE_INDEX

public static final int RULE_INDEX

See Also:

Constant Field Values

Constructor Detail

NullPointerDereference

public NullPointerDereference(ControlFlowGraph.Edge statement)

NullPointerDereference

public NullPointerDereference(Query query,
                              ControlFlowGraph.Edge statement,
                              Val variable,
                              wpds.impl.PAutomaton<Statement,sync.pds.solver.nodes.INode<Val>> openingContext,
                              wpds.impl.PAutomaton<Statement,sync.pds.solver.nodes.INode<Val>> closingContext,
                              List<PathElement> dataFlowPath)

Method Detail

getVariable

public Val getVariable()

The variable that contains "null" and which provokes at the statement a NullPointerException.

Specified by:

getVariable in interface AffectedLocation

Returns:

the variable that contains a null pointer

getDataFlowPath

public List<PathElement> getDataFlowPath()

Specified by:

getDataFlowPath in interface AffectedLocation

getMessage

public String getMessage()

Specified by:

getMessage in interface AffectedLocation

getRuleIndex

public int getRuleIndex()

Specified by:

getRuleIndex in interface AffectedLocation

getStatement

public ControlFlowGraph.Edge getStatement()

The statement at which a null pointer occurred.

A null pointer can occur at three different types of statements: y = x.toString(); or y = lengthof(x); or y = x.f;

Specified by:

getStatement in interface AffectedLocation

Returns:

the statement where the respective getVariable is null

getSourceStatement

public ControlFlowGraph.Edge getSourceStatement()

The source statement of the data-flow, i.e., the statement that assigns null to a variable.

Examples are: x = null or x = System.getProperty(...).

Returns:

The source statement of the data-flow/null pointer.

getSourceVariable

public Val getSourceVariable()

The source variable at the source statement. At a statement x = null or x = System.getProperty, this will be the variable x.

Returns:

The source variable of the data-flow propagation

getMethod

public Method getMethod()

Returns the method of the statement at which the null pointer occurs.

Returns:

The SootMethod of the null pointer statement

getOpeningContext

public wpds.impl.PAutomaton<Statement,sync.pds.solver.nodes.INode<Val>> getOpeningContext()

The opening context of a NullPointer provides the call stack under which the null pointer occurs.

 main(){
        Object x = null;
        foo(x); //call site context "c1"
        Object y = new Object();
        foo(y); //call site context "c2"
 }
 foo(Object z){
        z.toString() //<- Variable z is null here under context c1, but *not* under c2)
 }
 

In the example above, z is null under the calling context of call site c1.

In the case of branching, there can be multiple call site contexts leading to a null pointer. Therefore, the opening context is represented as an automaton (or graph). The edges of the automaton are labeled by the call sites, the nodes are labeled by variables or by variables at a context. For the example above, the automaton contains a transition with label foo(x)

Returns:

The automaton representation of the opening context.

getClosingContext

public wpds.impl.PAutomaton<Statement,sync.pds.solver.nodes.INode<Val>> getClosingContext()

The closing context of a NullPointer provides the call stack via which a variable containing null returns to a caller.

 main(){
        Object x;
  if(...){
                x = returnNull(); //b1
  } else {
        x = returnNotNull(); //b2
  }
        x.toString() //<- Variable x is null here when the program executes along branch b1
 }
 Object returnNull(){
        Object y = null;
  return y;
 }
 

In the case above, a null pointer exception occurs when the program executes along branch b1.

There can be multiple contexts leading to a null pointer. Therefore, the closing context is represented as an automaton (or graph). The edges of the automaton are labeled by the call sites, the nodes are labeled by variables or by variables at a context. For the example above, the automaton contains a transition with label returnNull(). This indicates, that the null pointer only occurs along branch b1 but not b2.

Returns:

The automaton representation of the closing context.

toString

public String toString()

Overrides:

toString in class Object

getQuery

public Query getQuery()

isNullPointerNode

public static boolean isNullPointerNode(sync.pds.solver.nodes.Node<ControlFlowGraph.Edge,Val> nullPointerNode)