svf-lib 1.0.1499 → 1.0.1501

package/SVF-linux/svf/include/AbstractExecution/IntervalExeState.h

@@ -140,11 +140,11 @@ public:
 
     VAddrs &getVAddrs(u32_t id) override
     {
-        auto it = globalES._varToVAddrs.find(id);
-        if (it != globalES._varToVAddrs.end())
+        auto it = _varToVAddrs.find(id);
+        if (it != _varToVAddrs.end())
             return it->second;
         else
-            return _varToVAddrs[id];
+            return globalES._varToVAddrs[id];
     }
 
     inline bool inVarToIValTable(u32_t id) const
@@ -201,14 +201,24 @@ public:
     ///  [], call getValueExpr()
     inline IntervalValue &operator[](u32_t varId)
     {
-        auto it = globalES._varToItvVal.find(varId);
-        if (it != globalES._varToItvVal.end())
+        auto localIt = _varToItvVal.find(varId);
+        if(localIt != _varToItvVal.end())
+            return localIt->second;
+        else
         {
-            return it->second;
+            return globalES._varToItvVal[varId];
         }
-        else
+    }
+
+    inline void cpyItvToLocal(u32_t varId)
+    {
+        auto localIt = _varToItvVal.find(varId);
+        // local already have varId
+        if (localIt != _varToItvVal.end()) return;
+        auto globIt = globalES._varToItvVal.find(varId);
+        if (globIt != globalES._varToItvVal.end())
         {
-            return _varToItvVal[varId];
+            _varToItvVal[varId] = globIt->second;
         }
     }
 
@@ -370,16 +380,29 @@ public:
 
     static bool lessThanVarToValMap(const VarToValMap &lhs, const VarToValMap &rhs)
     {
+        if (lhs.empty()) return !rhs.empty();
         for (const auto &item: lhs)
         {
             auto it = rhs.find(item.first);
+            if (it == rhs.end()) return false;
             // judge from expr id
-            if (!item.second.equals(it->second))
-            {
-                return !item.second.geq(it->second);
-            }
+            if (item.second.geq(it->second)) return false;
         }
-        return false;
+        return true;
+    }
+
+    // lhs >= rhs
+    static bool geqVarToValMap(const VarToValMap &lhs, const VarToValMap &rhs)
+    {
+        if (rhs.empty()) return true;
+        for (const auto &item: rhs)
+        {
+            auto it = lhs.find(item.first);
+            if (it == lhs.end()) return false;
+            // judge from expr id
+            if (!it->second.geq(item.second)) return false;
+        }
+        return true;
     }
 
     bool operator==(const IntervalExeState &rhs) const
@@ -395,15 +418,13 @@ public:
 
     bool operator<(const IntervalExeState &rhs) const
     {
-        // judge from path constraint
-        return (lessThanVarToValMap(_varToItvVal, rhs.getVarToVal()) ||
-                lessThanVarToValMap(_locToItvVal, rhs.getLocToVal()));
+        return !(*this >= rhs);
     }
 
 
     bool operator>=(const IntervalExeState &rhs) const
     {
-        return !(*this < rhs);
+        return geqVarToValMap(_varToItvVal, rhs.getVarToVal()) && geqVarToValMap(_locToItvVal, rhs.getLocToVal());
     }
 
     void clear()

package/SVF-linux/svf/include/AbstractExecution/IntervalValue.h

@@ -438,9 +438,19 @@ public:
         }
     }
 
-    std::string toString() const
+    const std::string toString() const
     {
-        return "[" + lb().to_string() + ", " + ub().to_string() + "]";
+        std::string str;
+        std::stringstream rawStr(str);
+        if (this->isBottom())
+        {
+            rawStr << "⊥";
+        }
+        else
+        {
+            rawStr << "[" << lb().to_string() << ", " << ub().to_string() << "]";
+        }
+        return rawStr.str();
     }
 
 }; // end class IntervalValue

package/SVF-osx/svf/include/SABER/FileChecker.h

@@ -73,8 +73,6 @@ public:
     }
     /// Report file/close bugs
     void reportBug(ProgSlice* slice);
-    void reportNeverClose(const SVFGNode* src);
-    void reportPartialClose(const SVFGNode* src);
 };
 
 } // End namespace SVF

package/SVF-osx/svf/include/SABER/LeakChecker.h

@@ -93,8 +93,6 @@ protected:
     /// Report leaks
     //@{
     virtual void reportBug(ProgSlice* slice) override;
-    void reportNeverFree(const SVFGNode* src);
-    void reportPartialLeak(const SVFGNode* src);
     //@}
 
     /// Validate test cases for regression test purpose

package/SVF-osx/svf/include/SABER/ProgSlice.h

@@ -41,6 +41,7 @@
 #include "Util/WorkList.h"
 #include "Graphs/SVFG.h"
 #include "Util/DPItem.h"
+#include "Util/SVFBugReport.h"
 
 namespace SVF
 {
@@ -201,6 +202,8 @@ public:
     }
     /// Evaluate final condition
     std::string evalFinalCond() const;
+    /// Add final condition to eventStack
+    void evalFinalCond2Event(GenericBug::EventStack &eventStack) const;
     //@}
 
 protected:

package/SVF-osx/svf/include/SABER/SrcSnkDDA.h

@@ -37,11 +37,11 @@
 #ifndef SRCSNKANALYSIS_H_
 #define SRCSNKANALYSIS_H_
 
-
-#include "Util/GraphReachSolver.h"
 #include "Graphs/SVFGOPT.h"
 #include "SABER/ProgSlice.h"
 #include "SABER/SaberSVFGBuilder.h"
+#include "Util/GraphReachSolver.h"
+#include "Util/SVFBugReport.h"
 
 namespace SVF
 {
@@ -77,6 +77,7 @@ protected:
     SaberSVFGBuilder memSSA;
     SVFG* svfg;
     PTACallGraph* ptaCallGraph;
+    SVFBugReport report; /// Bug Reporter
 
 public:
 

package/SVF-osx/svf/include/Util/SVFBugReport.h

@@ -0,0 +1,424 @@
+//===- SVFBugReport.h -- Base class for statistics---------------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013->  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+//
+// Created by JoelYang on 2023/4/19.
+//
+
+#ifndef SVF_BUGRECODER_H
+#define SVF_BUGRECODER_H
+
+#include <vector>
+#include "SVFIR/SVFValue.h"
+#include "SVFIR/SVFVariables.h"
+#include "SVFIR/SVFStatements.h"
+#include "Graphs/ICFGNode.h"
+#include <string>
+#include <map>
+#include "Util/cJSON.h"
+#include <set>
+
+namespace SVF
+{
+
+/*!
+ * Bug Detector Recoder
+ */
+
+
+class GenericEvent
+{
+public:
+    enum EventType {Branch, Caller, CallSite, Loop, SourceInst};
+
+protected:
+    EventType eventType;
+
+public:
+    GenericEvent(EventType eventType): eventType(eventType) { };
+    virtual ~GenericEvent() = default;
+
+    inline EventType getEventType() const
+    {
+        return eventType;
+    }
+    virtual const std::string getEventDescription() const = 0;
+    virtual const std::string getFuncName() const = 0;
+    virtual const std::string getEventLoc() const = 0;
+};
+
+class BranchEvent: public GenericEvent
+{
+    /// branch statement and branch condition true or false
+protected:
+    const SVFInstruction *branchInst;
+    bool branchSuccessFlg;
+
+public:
+    BranchEvent(const SVFInstruction *branchInst, bool branchSuccessFlg):
+        GenericEvent(GenericEvent::Branch), branchInst(branchInst), branchSuccessFlg(branchSuccessFlg) { }
+
+    const std::string getEventDescription() const;
+    const std::string getFuncName() const;
+    const std::string getEventLoc() const;
+
+    /// ClassOf
+    static inline bool classof(const GenericEvent* event)
+    {
+        return event->getEventType() == GenericEvent::Branch;
+    }
+};
+
+class CallSiteEvent: public GenericEvent
+{
+protected:
+    const CallICFGNode *callSite;
+
+public:
+    CallSiteEvent(const CallICFGNode *callSite): GenericEvent(GenericEvent::CallSite), callSite(callSite) { }
+    const std::string getEventDescription() const;
+    const std::string getFuncName() const;
+    const std::string getEventLoc() const;
+
+    /// ClassOf
+    static inline bool classof(const GenericEvent* event)
+    {
+        return event->getEventType() == GenericEvent::CallSite;
+    }
+};
+
+class SourceInstEvent : public GenericEvent
+{
+protected:
+    const SVFInstruction *sourceSVFInst;
+
+public:
+    SourceInstEvent(const SVFInstruction *sourceSVFInst):
+        GenericEvent(GenericEvent::SourceInst), sourceSVFInst(sourceSVFInst) { }
+
+    const std::string getEventDescription() const;
+    const std::string getFuncName() const;
+    const std::string getEventLoc() const;
+
+    /// ClassOf
+    static inline bool classof(const GenericEvent* event)
+    {
+        return event->getEventType() == GenericEvent::SourceInst;
+    }
+};
+
+class GenericBug
+{
+public:
+    typedef std::vector<const GenericEvent *> EventStack;
+
+public:
+    enum BugType {FULLBUFOVERFLOW, PARTIALBUFOVERFLOW, NEVERFREE, PARTIALLEAK, DOUBLEFREE, FILENEVERCLOSE, FILEPARTIALCLOSE};
+
+protected:
+    BugType bugType;
+    EventStack bugEventStack;
+
+public:
+    /// note: should be initialized with a bugEventStack
+    GenericBug(BugType bugType, EventStack bugEventStack):
+        bugType(bugType), bugEventStack(bugEventStack)
+    {
+        assert(bugEventStack.size() != 0 && "bugEventStack should NOT be empty!");
+    }
+    virtual ~GenericBug() = default;
+    //GenericBug(const GenericBug &) = delete;
+    /// returns bug type
+    inline BugType getBugType() const
+    {
+        return bugType;
+    }
+    /// returns bug location as json format string
+    const std::string getLoc() const;
+    /// return bug source function name
+    const std::string getFuncName() const;
+
+    inline const EventStack& getEventStack() const
+    {
+        return bugEventStack;
+    }
+
+    virtual cJSON *getBugDescription() const = 0;
+    virtual void printBugToTerminal() const = 0;
+};
+
+class BufferOverflowBug: public GenericBug
+{
+protected:
+    s64_t allocLowerBound, allocUpperBound, accessLowerBound, accessUpperBound;
+
+public:
+    BufferOverflowBug(GenericBug::BugType bugType, const EventStack &eventStack,
+                      s64_t allocLowerBound, s64_t allocUpperBound,
+                      s64_t accessLowerBound, s64_t accessUpperBound):
+        GenericBug(bugType, eventStack), allocLowerBound(allocLowerBound),
+        allocUpperBound(allocUpperBound), accessLowerBound(accessLowerBound),
+        accessUpperBound(accessUpperBound) { }
+
+    cJSON *getBugDescription() const;
+    void printBugToTerminal() const;
+
+    /// ClassOf
+    static inline bool classof(const GenericBug *bug)
+    {
+        return bug->getBugType() == GenericBug::PARTIALBUFOVERFLOW || bug->getBugType() == GenericBug::FULLBUFOVERFLOW;
+    }
+};
+
+class FullBufferOverflowBug: public BufferOverflowBug
+{
+public:
+    FullBufferOverflowBug(const EventStack &eventStack,
+                          s64_t allocLowerBound, s64_t allocUpperBound,
+                          s64_t accessLowerBound, s64_t accessUpperBound):
+        BufferOverflowBug(GenericBug::FULLBUFOVERFLOW, eventStack, allocLowerBound,
+                          allocUpperBound, accessLowerBound, accessUpperBound) { }
+
+    /// ClassOf
+    static inline bool classof(const GenericBug *bug)
+    {
+        return bug->getBugType() == GenericBug::FULLBUFOVERFLOW;
+    }
+};
+
+class PartialBufferOverflowBug: public BufferOverflowBug
+{
+public:
+    PartialBufferOverflowBug( const EventStack &eventStack,
+                              s64_t allocLowerBound, s64_t allocUpperBound,
+                              s64_t accessLowerBound, s64_t accessUpperBound):
+        BufferOverflowBug(GenericBug::PARTIALBUFOVERFLOW, eventStack, allocLowerBound,
+                          allocUpperBound, accessLowerBound, accessUpperBound) { }
+
+    /// ClassOf
+    static inline bool classof(const GenericBug *bug)
+    {
+        return bug->getBugType() == GenericBug::PARTIALBUFOVERFLOW;
+    }
+};
+
+class NeverFreeBug : public GenericBug
+{
+public:
+    NeverFreeBug(const EventStack &bugEventStack):
+        GenericBug(GenericBug::NEVERFREE, bugEventStack) {  };
+
+    cJSON *getBugDescription() const;
+    void printBugToTerminal() const;
+
+    /// ClassOf
+    static inline bool classof(const GenericBug *bug)
+    {
+        return bug->getBugType() == GenericBug::NEVERFREE;
+    }
+};
+
+class PartialLeakBug : public GenericBug
+{
+public:
+    PartialLeakBug(const EventStack &bugEventStack):
+        GenericBug(GenericBug::PARTIALLEAK, bugEventStack) { }
+
+    cJSON *getBugDescription() const;
+    void printBugToTerminal() const;
+
+    /// ClassOf
+    static inline bool classof(const GenericBug *bug)
+    {
+        return bug->getBugType() == GenericBug::PARTIALLEAK;
+    }
+};
+
+class DoubleFreeBug : public GenericBug
+{
+public:
+    DoubleFreeBug(const EventStack &bugEventStack):
+        GenericBug(GenericBug::PARTIALLEAK, bugEventStack) { }
+
+    cJSON *getBugDescription() const;
+    void printBugToTerminal() const;
+
+    /// ClassOf
+    static inline bool classof(const GenericBug *bug)
+    {
+        return bug->getBugType() == GenericBug::DOUBLEFREE;
+    }
+};
+
+class FileNeverCloseBug : public GenericBug
+{
+public:
+    FileNeverCloseBug(const EventStack &bugEventStack):
+        GenericBug(GenericBug::NEVERFREE, bugEventStack) {  };
+
+    cJSON *getBugDescription() const;
+    void printBugToTerminal() const;
+
+    /// ClassOf
+    static inline bool classof(const GenericBug *bug)
+    {
+        return bug->getBugType() == GenericBug::FILENEVERCLOSE;
+    }
+};
+
+class FilePartialCloseBug : public GenericBug
+{
+public:
+    FilePartialCloseBug(const EventStack &bugEventStack):
+        GenericBug(GenericBug::PARTIALLEAK, bugEventStack) { }
+
+    cJSON *getBugDescription() const;
+    void printBugToTerminal() const;
+
+    /// ClassOf
+    static inline bool classof(const GenericBug *bug)
+    {
+        return bug->getBugType() == GenericBug::FILEPARTIALCLOSE;
+    }
+};
+
+class SVFBugReport
+{
+public:
+    SVFBugReport() = default;
+    ~SVFBugReport();
+    typedef SVF::Set<const GenericBug *> BugSet;
+    typedef SVF::Set<const GenericEvent *> EventSet;
+
+protected:
+    BugSet bugSet;    // maintain bugs
+    EventSet eventSet;// maintain added events
+
+public:
+    /*
+     * function: pass bug type (i.e., GenericBug::NEVERFREE) and eventStack as parameter,
+     *      it will add the bug into bugQueue.
+     * usage: addSaberBug(GenericBug::NEVERFREE, eventStack)
+     */
+    void addSaberBug(GenericBug::BugType bugType, const GenericBug::EventStack &eventStack)
+    {
+        /// resign added events
+        for(auto eventPtr : eventStack)
+        {
+            eventSet.insert(eventPtr);
+        }
+
+        /// create and add the bug
+        GenericBug *newBug = nullptr;
+        switch(bugType)
+        {
+        case GenericBug::NEVERFREE:
+        {
+            newBug = new NeverFreeBug(eventStack);
+            bugSet.insert(newBug);
+            break;
+        }
+        case GenericBug::PARTIALLEAK:
+        {
+            newBug = new PartialLeakBug(eventStack);
+            bugSet.insert(newBug);
+            break;
+        }
+        case GenericBug::DOUBLEFREE:
+        {
+            newBug = new DoubleFreeBug(eventStack);
+            bugSet.insert(newBug);
+            break;
+        }
+        case GenericBug::FILENEVERCLOSE:
+        {
+            newBug = new FileNeverCloseBug(eventStack);
+            bugSet.insert(newBug);
+            break;
+        }
+        case GenericBug::FILEPARTIALCLOSE:
+        {
+            newBug = new FilePartialCloseBug(eventStack);
+            bugSet.insert(newBug);
+            break;
+        }
+        default:
+        {
+            assert(false && "saber does NOT have this bug type!");
+            break;
+        }
+        }
+
+        // when add a bug, also print it to terminal
+        newBug->printBugToTerminal();
+    }
+
+    /*
+     * function: pass bug type (i.e., GenericBug::FULLBUFOVERFLOW) and eventStack as parameter,
+     *      it will add the bug into bugQueue.
+     * usage: addAbsExecBug(GenericBug::FULLBUFOVERFLOW, eventStack, 0, 10, 11, 11)
+     */
+    void addAbsExecBug(GenericBug::BugType bugType, const GenericBug::EventStack &eventStack,
+                       s64_t allocLowerBound, s64_t allocUpperBound, s64_t accessLowerBound, s64_t accessUpperBound)
+    {
+        /// resign added events
+        for(auto eventPtr : eventStack)
+        {
+            eventSet.insert(eventPtr);
+        }
+
+        /// add bugs
+        GenericBug *newBug = nullptr;
+        switch(bugType)
+        {
+        case GenericBug::FULLBUFOVERFLOW:
+        {
+            newBug = new FullBufferOverflowBug(eventStack, allocLowerBound, allocUpperBound, accessLowerBound, accessUpperBound);
+            bugSet.insert(newBug);
+            break;
+        }
+        case GenericBug::PARTIALBUFOVERFLOW:
+        {
+            newBug = new PartialBufferOverflowBug(eventStack, allocLowerBound, allocUpperBound, accessLowerBound, accessUpperBound);
+            bugSet.insert(newBug);
+            break;
+        }
+        default:
+        {
+            assert(false && "Abstract Execution does NOT hava his bug type!");
+            break;
+        }
+        }
+
+        // when add a bug, also print it to terminal
+        newBug->printBugToTerminal();
+    }
+
+    /*
+     * function: pass file path, open the file and dump bug report as JSON format
+     * usage: dumpToFile("/path/to/file")
+     */
+    void dumpToJsonFile(const std::string& filePath);
+};
+}
+
+#endif

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svf-lib",
-  "version": "1.0.1499",
+  "version": "1.0.1501",
   "description": "SVF's npm support",
   "main": "index.js",
   "scripts": {