svf-lib 1.0.1374 → 1.0.1376

package/SVF-osx/svf/include/SABER/SrcSnkDDA.h

@@ -0,0 +1,321 @@
+//===- SrcSnkDDA.h -- Source-sink analyzer-----------------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013->  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * SrcSnkDDA.h
+ *
+ *  Created on: Apr 1, 2014
+ *      Author: Yulei Sui
+ *
+ * The implementation is based on
+ * (1) Yulei Sui, Ding Ye, and Jingling Xue. "Static Memory Leak Detection Using Full-Sparse Value-Flow Analysis".
+ * 2012 International Symposium on Software Testing and Analysis (ISSTA'12)
+ *
+ * (2) Yulei Sui, Ding Ye, and Jingling Xue. "Detecting Memory Leaks Statically with Full-Sparse Value-Flow Analysis".
+ * IEEE Transactions on Software Engineering (TSE'14)
+ */
+
+#ifndef SRCSNKANALYSIS_H_
+#define SRCSNKANALYSIS_H_
+
+
+#include "Util/GraphReachSolver.h"
+#include "Graphs/SVFGOPT.h"
+#include "SABER/ProgSlice.h"
+#include "SABER/SaberSVFGBuilder.h"
+
+namespace SVF
+{
+
+typedef GraphReachSolver<SVFG*,CxtDPItem> CFLSrcSnkSolver;
+
+/*!
+ * General source-sink analysis, which serves as a base analysis to be extended for various clients
+ */
+class SrcSnkDDA : public CFLSrcSnkSolver
+{
+
+public:
+    typedef ProgSlice::SVFGNodeSet SVFGNodeSet;
+    typedef Map<const SVFGNode*,ProgSlice*> SVFGNodeToSliceMap;
+    typedef SVFGNodeSet::const_iterator SVFGNodeSetIter;
+    typedef CxtDPItem DPIm;
+    typedef Set<DPIm> DPImSet;							///< dpitem set
+    typedef Map<const SVFGNode*, DPImSet> SVFGNodeToDPItemsMap; 	///< map a SVFGNode to its visited dpitems
+    typedef Set<const CallICFGNode*> CallSiteSet;
+    typedef NodeBS SVFGNodeBS;
+    typedef ProgSlice::VFWorkList WorkList;
+
+private:
+    ProgSlice* _curSlice;		/// current program slice
+    SVFGNodeSet sources;		/// source nodes
+    SVFGNodeSet sinks;		/// source nodes
+    std::unique_ptr<SaberCondAllocator> saberCondAllocator;
+    SVFGNodeToDPItemsMap nodeToDPItemsMap;	///<  record forward visited dpitems
+    SVFGNodeSet visitedSet;	///<  record backward visited nodes
+
+protected:
+    SaberSVFGBuilder memSSA;
+    SVFG* svfg;
+    PTACallGraph* ptaCallGraph;
+
+public:
+
+    /// Constructor
+    SrcSnkDDA() : _curSlice(nullptr), svfg(nullptr), ptaCallGraph(nullptr)
+    {
+        saberCondAllocator = std::make_unique<SaberCondAllocator>();
+    }
+    /// Destructor
+    ~SrcSnkDDA() override
+    {
+        svfg = nullptr;
+
+        delete _curSlice;
+        _curSlice = nullptr;
+
+        /// the following shared by multiple checkers, thus can not be released.
+        //if (ptaCallGraph != nullptr)
+        //    delete ptaCallGraph;
+        //ptaCallGraph = nullptr;
+
+        //if(pathCondAllocator)
+        //    delete pathCondAllocator;
+        //pathCondAllocator = nullptr;
+    }
+
+    /// Start analysis here
+    virtual void analyze(SVFModule* module);
+
+    /// Initialize analysis
+    virtual void initialize(SVFModule* module);
+
+    /// Finalize analysis
+    virtual void finalize()
+    {
+        dumpSlices();
+    }
+
+    /// Get SVFIR
+    SVFIR* getPAG() const
+    {
+        return SVFIR::getPAG();
+    }
+
+    /// Get SVFG
+    inline const SVFG* getSVFG() const
+    {
+        return graph();
+    }
+
+    /// Get Callgraph
+    inline PTACallGraph* getCallgraph() const
+    {
+        return ptaCallGraph;
+    }
+
+    /// Whether this svfg node may access global variable
+    inline bool isGlobalSVFGNode(const SVFGNode* node) const
+    {
+        return memSSA.isGlobalSVFGNode(node);
+    }
+    /// Slice operations
+    //@{
+    virtual void setCurSlice(const SVFGNode* src);
+
+    inline ProgSlice* getCurSlice() const
+    {
+        return _curSlice;
+    }
+    inline void addSinkToCurSlice(const SVFGNode* node)
+    {
+        _curSlice->addToSinks(node);
+        addToCurForwardSlice(node);
+    }
+    inline bool isInCurForwardSlice(const SVFGNode* node)
+    {
+        return _curSlice->inForwardSlice(node);
+    }
+    inline bool isInCurBackwardSlice(const SVFGNode* node)
+    {
+        return _curSlice->inBackwardSlice(node);
+    }
+    inline void addToCurForwardSlice(const SVFGNode* node)
+    {
+        _curSlice->addToForwardSlice(node);
+    }
+    inline void addToCurBackwardSlice(const SVFGNode* node)
+    {
+        _curSlice->addToBackwardSlice(node);
+    }
+    //@}
+
+    /// Initialize sources and sinks
+    ///@{
+    virtual void initSrcs() = 0;
+    virtual void initSnks() = 0;
+    virtual bool isSourceLikeFun(const SVFFunction* fun)
+    {
+        return false;
+    }
+
+    virtual bool isSinkLikeFun(const SVFFunction* fun)
+    {
+        return false;
+    }
+
+    bool isSource(const SVFGNode* node) const
+    {
+        return getSources().find(node)!=getSources().end();
+    }
+
+    bool isSink(const SVFGNode* node) const
+    {
+        return getSinks().find(node)!=getSinks().end();
+    }
+    ///@}
+
+    /// Identify allocation wrappers
+    bool isInAWrapper(const SVFGNode* src, CallSiteSet& csIdSet);
+
+    /// report bug on the current analyzed slice
+    virtual void reportBug(ProgSlice* slice) = 0;
+
+    /// Get sources/sinks
+    //@{
+    inline const SVFGNodeSet& getSources() const
+    {
+        return sources;
+    }
+    inline SVFGNodeSetIter sourcesBegin() const
+    {
+        return sources.begin();
+    }
+    inline SVFGNodeSetIter sourcesEnd() const
+    {
+        return sources.end();
+    }
+    inline void addToSources(const SVFGNode* node)
+    {
+        sources.insert(node);
+    }
+    inline const SVFGNodeSet& getSinks() const
+    {
+        return sinks;
+    }
+    inline SVFGNodeSetIter sinksBegin() const
+    {
+        return sinks.begin();
+    }
+    inline SVFGNodeSetIter sinksEnd() const
+    {
+        return sinks.end();
+    }
+    inline void addToSinks(const SVFGNode* node)
+    {
+        sinks.insert(node);
+    }
+    //@}
+
+    /// Get saber condition allocator
+    SaberCondAllocator* getSaberCondAllocator() const
+    {
+        return saberCondAllocator.get();
+    }
+
+protected:
+    /// Forward traverse
+    inline void FWProcessCurNode(const DPIm& item) override
+    {
+        const SVFGNode* node = getNode(item.getCurNodeID());
+        if(isSink(node))
+        {
+            addSinkToCurSlice(node);
+            _curSlice->setPartialReachable();
+        }
+        else
+            addToCurForwardSlice(node);
+    }
+    /// Backward traverse
+    inline void BWProcessCurNode(const DPIm& item) override
+    {
+        const SVFGNode* node = getNode(item.getCurNodeID());
+        if(isInCurForwardSlice(node))
+        {
+            addToCurBackwardSlice(node);
+        }
+    }
+    /// Propagate information forward by matching context
+    void FWProcessOutgoingEdge(const DPIm& item, SVFGEdge* edge) override;
+    /// Propagate information backward without matching context, as forward analysis already did it
+    void BWProcessIncomingEdge(const DPIm& item, SVFGEdge* edge) override;
+    /// Whether has been visited or not, in order to avoid recursion on SVFG
+    //@{
+    inline bool forwardVisited(const SVFGNode* node, const DPIm& item)
+    {
+        SVFGNodeToDPItemsMap::const_iterator it = nodeToDPItemsMap.find(node);
+        if(it!=nodeToDPItemsMap.end())
+            return it->second.find(item)!=it->second.end();
+        else
+            return false;
+    }
+    inline void addForwardVisited(const SVFGNode* node, const DPIm& item)
+    {
+        nodeToDPItemsMap[node].insert(item);
+    }
+    inline bool backwardVisited(const SVFGNode* node)
+    {
+        return visitedSet.find(node)!=visitedSet.end();
+    }
+    inline void addBackwardVisited(const SVFGNode* node)
+    {
+        visitedSet.insert(node);
+    }
+    inline void clearVisitedMap()
+    {
+        nodeToDPItemsMap.clear();
+        visitedSet.clear();
+    }
+    //@}
+
+    /// Whether it is all path reachable from a source
+    virtual bool isAllPathReachable()
+    {
+        return _curSlice->isAllReachable();
+    }
+    /// Whether it is some path reachable from a source
+    virtual bool isSomePathReachable()
+    {
+        return _curSlice->isPartialReachable();
+    }
+    /// Dump SVFG with annotated slice informaiton
+    //@{
+    void dumpSlices();
+    void annotateSlice(ProgSlice* slice);
+    void printZ3Stat();
+    //@}
+
+};
+
+} // End namespace SVF
+
+#endif /* SRCSNKANALYSIS_H_ */

package/SVF-osx/svf/include/SABER/SrcSnkSolver.h

@@ -0,0 +1,186 @@
+//===- SrcSnkSolver.h -- CFL reachability solver---------------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013->  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * SrcSnkSolver.h
+ *
+ *  Created on: Apr 1, 2014
+ *      Author: Yulei Sui
+ */
+
+#ifndef CFLSOLVER_H_
+#define CFLSOLVER_H_
+
+#include "Util/WorkList.h"
+#include "Util/DPItem.h"
+
+namespace SVF
+{
+
+/*
+ * Generic CFL solver for demand-driven analysis based on different graphs (e.g. SVFIR, VFG, ThreadVFG)
+ * Extend this class for sophisticated CFL-reachability resolution (e.g. field, flow, path)
+ */
+template<class GraphType, class DPIm = DPItem>
+class SrcSnkSolver
+{
+
+public:
+    ///Define the GTraits and node iterator
+    typedef SVF::GraphTraits<GraphType> GTraits;
+    typedef typename GTraits::NodeType          GNODE;
+    typedef typename GTraits::EdgeType          GEDGE;
+    typedef typename GTraits::nodes_iterator node_iterator;
+    typedef typename GTraits::ChildIteratorType child_iterator;
+
+    /// Define inverse GTraits and note iterator
+    typedef SVF::GraphTraits<SVF::Inverse<GNODE *> > InvGTraits;
+    typedef typename InvGTraits::ChildIteratorType inv_child_iterator;
+
+    /// Define worklist
+    typedef FIFOWorkList<DPIm> WorkList;
+
+protected:
+
+    /// Constructor
+    SrcSnkSolver(): _graph(nullptr)
+    {
+    }
+    /// Destructor
+    virtual ~SrcSnkSolver()
+    {
+    }
+    /// Get/Set graph methods
+    //@{
+    const inline GraphType graph() const
+    {
+        return _graph;
+    }
+    inline void setGraph(GraphType g)
+    {
+        _graph = g;
+    }
+    //@}
+
+    inline GNODE* getNode(NodeID id) const
+    {
+        return _graph->getGNode(id);
+    }
+    virtual inline NodeID getNodeIDFromItem(const DPIm& item) const
+    {
+        return item.getCurNodeID();
+    }
+    /// CFL forward traverse solve
+    virtual void forwardTraverse(DPIm& it)
+    {
+        pushIntoWorklist(it);
+
+        while (!isWorklistEmpty())
+        {
+            DPIm item = popFromWorklist();
+            FWProcessCurNode(item);
+
+            GNODE* v = getNode(getNodeIDFromItem(item));
+            child_iterator EI = GTraits::child_begin(v);
+            child_iterator EE = GTraits::child_end(v);
+            for (; EI != EE; ++EI)
+            {
+                FWProcessOutgoingEdge(item,*(EI.getCurrent()) );
+            }
+        }
+    }
+    /// CFL forward traverse solve
+    virtual void backwardTraverse(DPIm& it)
+    {
+        pushIntoWorklist(it);
+
+        while (!isWorklistEmpty())
+        {
+            DPIm item = popFromWorklist();
+            BWProcessCurNode(item);
+
+            GNODE* v = getNode(getNodeIDFromItem(item));
+            inv_child_iterator EI = InvGTraits::child_begin(v);
+            inv_child_iterator EE = InvGTraits::child_end(v);
+            for (; EI != EE; ++EI)
+            {
+                BWProcessIncomingEdge(item,*(EI.getCurrent()) );
+            }
+        }
+    }
+    /// Process the DP item
+    //@{
+    virtual void FWProcessCurNode(const DPIm&)
+    {
+    }
+    virtual void BWProcessCurNode(const DPIm&)
+    {
+    }
+    //@}
+    /// Propagation for the solving, to be implemented in the child class
+    //@{
+    virtual void FWProcessOutgoingEdge(const DPIm& item, GEDGE* edge)
+    {
+        DPIm newItem(item);
+        newItem.setCurNodeID(edge->getDstID());
+        pushIntoWorklist(newItem);
+    }
+    virtual void BWProcessIncomingEdge(const DPIm& item, GEDGE* edge)
+    {
+        DPIm newItem(item);
+        newItem.setCurNodeID(edge->getSrcID());
+        pushIntoWorklist(newItem);
+    }
+    //@}
+    /// Worklist operations
+    //@{
+    inline DPIm popFromWorklist()
+    {
+        return worklist.pop();
+    }
+    inline bool pushIntoWorklist(DPIm& item)
+    {
+        return worklist.push(item);
+    }
+    inline bool isWorklistEmpty()
+    {
+        return worklist.empty();
+    }
+    inline bool isInWorklist(DPIm& item)
+    {
+        return worklist.find(item);
+    }
+    //@}
+
+private:
+
+    /// Graph
+    GraphType _graph;
+
+    /// Worklist for resolution
+    WorkList worklist;
+
+};
+
+} // End namespace SVF
+
+#endif /* CFLSOLVER_H_ */

package/SVF-osx/svf/include/SVFIR/PAGBuilderFromFile.h

@@ -0,0 +1,80 @@
+//===- PAGBuilderFromFile.h -- Building SVFIR from File--------------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013->  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * PAGBuilderFromFile.h
+ *
+ *  Created on: 20 Sep. 2018
+ *      Author: Yulei Sui
+ */
+
+#ifndef INCLUDE_SVFIR_PAGBUILDERFROMFILE_H_
+#define INCLUDE_SVFIR_PAGBUILDERFROMFILE_H_
+
+#include "SVFIR/SVFIR.h"
+
+namespace SVF
+{
+
+/*!
+ * Build SVFIR from a user specified file (for debugging purpose)
+ */
+class PAGBuilderFromFile
+{
+
+private:
+    SVFIR* pag;
+    std::string file;
+public:
+    /// Constructor
+    PAGBuilderFromFile(std::string f) :
+        pag(SVFIR::getPAG(true)), file(f)
+    {
+    }
+    /// Destructor
+    ~PAGBuilderFromFile()
+    {
+    }
+
+    /// Return SVFIR
+    SVFIR* getPAG() const
+    {
+        return pag;
+    }
+
+    /// Return file name
+    std::string getFileName() const
+    {
+        return file;
+    }
+
+    /// Start building
+    SVFIR* build();
+
+    // Add edges
+    void addEdge(NodeID nodeSrc, NodeID nodeDst, s32_t offset,
+                 std::string edge);
+};
+
+} // End namespace SVF
+
+#endif /* INCLUDE_SVFIR_PAGBUILDERFROMFILE_H_ */