Intel has released developments related to the research project ControlFlag, aimed at creating a machine learning system to improve code quality. The toolkit prepared by the project allows for identifying various errors and anomalies in source texts written in high-level languages, such as C/C++, based on a model trained on a large volume of existing code. The system is suitable for detecting different types of issues in the code, from spotting typos and incorrect type combinations to identifying missing NULL value checks in pointers and memory management problems. The ControlFlag code is written in C++ and is open under the MIT license.
The system self-trains by building a statistical model from the existing codebase of open projects published on GitHub and similar public repositories. During the training phase, the system identifies typical patterns in code constructions and builds a syntax tree of relationships between these patterns, reflecting the execution flow of the code in the program. As a result, a reference decision tree is formed, consolidating the development experience of all analyzed source texts.
For the code being examined, a similar process of identifying patterns is performed, which are then compared with the reference decision tree. Significant discrepancies with neighboring branches indicate the presence of an anomaly in the examined pattern. The system also allows not only to detect an error in the pattern but also to suggest a correction. For instance, in the OpenSSL code, a construct “(s1 == NULL) ∧ (s2 == NULL)” was identified, which appeared in the syntax tree only 8 times, while the nearest branch with the value “(s1 == NULL) || (s2 == NULL)” appeared about 7,000 times. The system also detected the anomaly “(s1 == NULL) | (s2 == NULL)” which appeared in the tree 32 times.
When analyzing the code fragment "if (x = 7) y = x;", the system determined that usually in the "if" statement a comparison of numeric values uses the construct "variable == number", hence it's highly likely that the specification "variable = number" in the "if" expression was caused by a typo. Such an error would also be caught by traditional static analyzers, but unlike them, ControlFlag does not apply preset rules that are hard to account for all possible variations, but is based on the statistics of using various constructs across a large number of projects.
As an experiment using ControlFlag on the source code of cURL, which is often cited as an example of quality and validated code, an unnoticed error was found by static analyzers in the usage of the structure element "s->keepon", which had a numeric type but was compared to the boolean value TRUE. In the OpenSSL code, in addition to the previously mentioned issue with "(s1 == NULL) ∧ (s2 == NULL)", anomalies were also found in the expressions "(-2 == rv)" (the minus was a typo) and "BIO_puts(bp, ":")".
Source: opennet.ru
