Accurate call graph extraction of programs with function pointers using type signatures

Abstract

Software engineers need to understand programs in order to effectively maintain them. The call graph, which presents the calling relationships between functions, is a useful representation of a program that can aid understanding. For programs that do not use function pointers, the call graph can be extracted simply by parsing the program. However, for programs that use function pointers, call graph extraction is nontrivial. Many widely used C programs utilize function pointers for efficiency and ease of implementation. We present a technique called type signature filtering for improving call graph extraction in the presence of function pointers. Filtering can be accomplished in a single pass after pointer analysis is complete, making it reusable across different analyses. Our results show that for many programs our technique yields a call graph that is nearly identical to the true call graph, even if a naive pointer analysis is used.