svf-lib 1.0.1783 → 1.0.1785

package/SVF-linux/svf/include/CFL/CFLSVFGBuilder.h

@@ -0,0 +1,58 @@
+//===- CFLSVFGBuilder.h -- Building SVFG for CFL--------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013->  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+//
+// Created by Xiao on 30/12/23.
+//
+
+#ifndef SVF_CFLSVFGBUILDER_H
+#define SVF_CFLSVFGBUILDER_H
+
+#include "SABER/SaberSVFGBuilder.h"
+
+namespace SVF
+{
+
+class CFLSVFGBuilder: public SaberSVFGBuilder
+{
+public:
+    typedef Set<const SVFGNode*> SVFGNodeSet;
+    typedef Map<NodeID, PointsTo> NodeToPTSSMap;
+    typedef FIFOWorkList<NodeID> WorkList;
+
+    /// Constructor
+    CFLSVFGBuilder() = default;
+
+    /// Destructor
+    virtual ~CFLSVFGBuilder() = default;
+
+protected:
+    /// Re-write create SVFG method
+    virtual void buildSVFG();
+
+    /// Remove Incoming Edge for strong-update (SU) store instruction
+    /// Because the SU node does not receive indirect value
+    virtual void rmIncomingEdgeForSUStore(BVDataPTAImpl* pta);
+};
+
+}
+#endif //SVF_CFLSVFGBUILDER_H

package/SVF-linux/svf/include/CFL/CFLVF.h

@@ -33,7 +33,7 @@
 
 #include "CFL/CFLBase.h"
 #include "CFL/CFLStat.h"
-#include "SABER/SaberSVFGBuilder.h"
+#include "CFL/CFLSVFGBuilder.h"
 #include "WPA/Andersen.h"
 
 namespace SVF
@@ -59,7 +59,7 @@ public:
     void buildCFLGraph();
 
 private:
-    SaberSVFGBuilder memSSA;
+    CFLSVFGBuilder memSSA;
     SVFG* svfg;
 };
 

package/SVF-linux/svf/include/Graphs/SVFG.h

@@ -66,6 +66,7 @@ class SVFG : public VFG
 {
     friend class SVFGBuilder;
     friend class SaberSVFGBuilder;
+    friend class CFLSVFGBuilder;
     friend class TaintSVFGBuilder;
     friend class DDASVFGBuilder;
     friend class MTASVFGBuilder;

package/SVF-linux/svf/include/SABER/ProgSlice.h

@@ -58,6 +58,9 @@ public:
     typedef FIFOWorkList<const SVFGNode*> VFWorkList;		    ///< worklist for value-flow guard computation
     typedef FIFOWorkList<const SVFBasicBlock*> CFWorkList;	///< worklist for control-flow guard computation
 
+    typedef SaberCondAllocator::SVFGNodeToSVFGNodeSetMap SVFGNodeToSVFGNodeSetMap;
+
+
     /// Constructor
     ProgSlice(const SVFGNode* src, SaberCondAllocator* pa, const SVFG* graph):
         root(src), partialReachable(false), fullReachable(false), reachGlob(false),
@@ -296,6 +299,14 @@ protected:
         finalCond = cond;
     }
 
+    /// Compute invalid branch condition stemming from removed strong update value-flow edges
+    Condition computeInvalidCondFromRemovedSUVFEdge(const SVFGNode * cur);
+
+    const SVFGNodeToSVFGNodeSetMap& getRemovedSUVFEdges() const
+    {
+        return pathAllocator->getRemovedSUVFEdges();
+    }
+
 private:
     SVFGNodeSet forwardslice;				///<  the forward slice
     SVFGNodeSet backwardslice;				///<  the backward slice

package/SVF-linux/svf/include/SABER/SaberCondAllocator.h

@@ -56,6 +56,7 @@ public:
     typedef Map<const SVFFunction*,  BasicBlockSet> FunToExitBBsMap;  ///< map a function to all its basic blocks calling program exit
     typedef Map<const SVFBasicBlock*, Condition> BBToCondMap;	///< map a basic block to its condition during control-flow guard computation
     typedef FIFOWorkList<const SVFBasicBlock*> CFWorkList;	///< worklist for control-flow guard computation
+    typedef Map<const SVFGNode*, Set<const SVFGNode*>> SVFGNodeToSVFGNodeSetMap;
 
 
     /// Constructor
@@ -239,6 +240,12 @@ public:
         setCondInst(condition, inst);
         negConds.set(condition.id());
     }
+
+    SVFGNodeToSVFGNodeSetMap & getRemovedSUVFEdges()
+    {
+        return removedSUVFEdges;
+    }
+
 private:
 
     /// Allocate path condition for every basic block
@@ -299,6 +306,7 @@ private:
     NodeBS negConds;                        ///bit vector for distinguish neg
     std::vector<Condition> conditionVec;          /// vector storing z3expression
     static u32_t totalCondNum; /// a counter for fresh condition
+    SVFGNodeToSVFGNodeSetMap removedSUVFEdges;
 
 protected:
     BBCondMap bbConds;						///< map basic block to its successors/predecessors branch conditions

package/SVF-linux/svf/include/SABER/SaberSVFGBuilder.h

@@ -34,9 +34,12 @@
 #include "SVFIR/SVFValue.h"
 #include "Util/WorkList.h"
 
+
 namespace SVF
 {
 
+class SaberCondAllocator;
+
 class SaberSVFGBuilder : public SVFGBuilder
 {
 
@@ -62,6 +65,11 @@ public:
         svfg->addActualParmVFGNode(pagNode, cs);
     }
 
+    void setSaberCondAllocator(SaberCondAllocator* allocator)
+    {
+        saberCondAllocator = allocator;
+    }
+
 protected:
     /// Re-write create SVFG method
     virtual void buildSVFG();
@@ -69,7 +77,7 @@ protected:
     /// Return TRUE if this is a strong update STORE statement.
     bool isStrongUpdate(const SVFGNode* node, NodeID& singleton, BVDataPTAImpl* pta);
 
-private:
+protected:
     /// Remove direct value-flow edge to a dereference point for Saber source-sink memory error detection
     /// for example, given two statements: p = alloc; q = *p, the direct SVFG edge between them is deleted
     /// Because those edges only stand for values used at the dereference points but they can not pass the value to other definitions
@@ -77,7 +85,7 @@ private:
 
     /// Remove Incoming Edge for strong-update (SU) store instruction
     /// Because the SU node does not receive indirect value
-    void rmIncomingEdgeForSUStore(BVDataPTAImpl* pta);
+    virtual void rmIncomingEdgeForSUStore(BVDataPTAImpl* pta);
 
     /// Add actual parameter SVFGNode for 1st argument of a deallocation like external function
     /// In order to path sensitive leak detection
@@ -97,6 +105,8 @@ private:
     PointsTo globs;
     /// Store all global SVFG nodes
     SVFGNodeSet globSVFGNodes;
+
+    SaberCondAllocator* saberCondAllocator;
 };
 
 } // End namespace SVF

package/SVF-osx/svf/include/CFL/CFLSVFGBuilder.h

@@ -0,0 +1,58 @@
+//===- CFLSVFGBuilder.h -- Building SVFG for CFL--------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013->  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+//
+// Created by Xiao on 30/12/23.
+//
+
+#ifndef SVF_CFLSVFGBUILDER_H
+#define SVF_CFLSVFGBUILDER_H
+
+#include "SABER/SaberSVFGBuilder.h"
+
+namespace SVF
+{
+
+class CFLSVFGBuilder: public SaberSVFGBuilder
+{
+public:
+    typedef Set<const SVFGNode*> SVFGNodeSet;
+    typedef Map<NodeID, PointsTo> NodeToPTSSMap;
+    typedef FIFOWorkList<NodeID> WorkList;
+
+    /// Constructor
+    CFLSVFGBuilder() = default;
+
+    /// Destructor
+    virtual ~CFLSVFGBuilder() = default;
+
+protected:
+    /// Re-write create SVFG method
+    virtual void buildSVFG();
+
+    /// Remove Incoming Edge for strong-update (SU) store instruction
+    /// Because the SU node does not receive indirect value
+    virtual void rmIncomingEdgeForSUStore(BVDataPTAImpl* pta);
+};
+
+}
+#endif //SVF_CFLSVFGBUILDER_H

package/SVF-osx/svf/include/CFL/CFLVF.h

@@ -32,7 +32,7 @@
 
 #include "CFL/CFLBase.h"
 #include "CFL/CFLStat.h"
-#include "SABER/SaberSVFGBuilder.h"
+#include "CFL/CFLSVFGBuilder.h"
 #include "WPA/Andersen.h"
 
 namespace SVF
@@ -58,7 +58,7 @@ public:
     void buildCFLGraph();
 
 private:
-    SaberSVFGBuilder memSSA;
+    CFLSVFGBuilder memSSA;
     SVFG* svfg;
 };
 

package/SVF-osx/svf/include/Graphs/SVFG.h

@@ -65,6 +65,7 @@ class SVFG : public VFG
 {
     friend class SVFGBuilder;
     friend class SaberSVFGBuilder;
+    friend class CFLSVFGBuilder;
     friend class TaintSVFGBuilder;
     friend class DDASVFGBuilder;
     friend class MTASVFGBuilder;

package/SVF-osx/svf/include/SABER/ProgSlice.h

@@ -58,6 +58,8 @@ public:
     typedef FIFOWorkList<const SVFGNode*> VFWorkList;		    ///< worklist for value-flow guard computation
     typedef FIFOWorkList<const SVFBasicBlock*> CFWorkList;	///< worklist for control-flow guard computation
 
+    typedef SaberCondAllocator::SVFGNodeToSVFGNodeSetMap SVFGNodeToSVFGNodeSetMap;
+
     /// Constructor
     ProgSlice(const SVFGNode* src, SaberCondAllocator* pa, const SVFG* graph):
         root(src), partialReachable(false), fullReachable(false), reachGlob(false),
@@ -296,6 +298,14 @@ protected:
         finalCond = cond;
     }
 
+    /// Compute invalid branch condition stemming from removed strong update value-flow edges
+    Condition computeInvalidCondFromRemovedSUVFEdge(const SVFGNode * cur);
+
+    const SVFGNodeToSVFGNodeSetMap& getRemovedSUVFEdges() const
+    {
+        return pathAllocator->getRemovedSUVFEdges();
+    }
+
 private:
     SVFGNodeSet forwardslice;				///<  the forward slice
     SVFGNodeSet backwardslice;				///<  the backward slice

package/SVF-osx/svf/include/SABER/SaberCondAllocator.h

@@ -55,6 +55,7 @@ public:
     typedef Map<const SVFFunction*,  BasicBlockSet> FunToExitBBsMap;  ///< map a function to all its basic blocks calling program exit
     typedef Map<const SVFBasicBlock*, Condition> BBToCondMap;	///< map a basic block to its condition during control-flow guard computation
     typedef FIFOWorkList<const SVFBasicBlock*> CFWorkList;	///< worklist for control-flow guard computation
+    typedef Map<const SVFGNode*, Set<const SVFGNode*>> SVFGNodeToSVFGNodeSetMap;
 
     /// Constructor
     SaberCondAllocator();
@@ -236,6 +237,12 @@ public:
         setCondInst(condition, inst);
         negConds.set(condition.id());
     }
+
+    SVFGNodeToSVFGNodeSetMap & getRemovedSUVFEdges()
+    {
+        return removedSUVFEdges;
+    }
+
 private:
 
     /// Allocate path condition for every basic block
@@ -295,6 +302,7 @@ private:
     NodeBS negConds;                        ///bit vector for distinguish neg
     std::vector<Condition> conditionVec;          /// vector storing z3expression
     static u32_t totalCondNum; /// a counter for fresh condition
+    SVFGNodeToSVFGNodeSetMap removedSUVFEdges;
 
 protected:
     BBCondMap bbConds;						///< map basic block to its successors/predecessors branch conditions

package/SVF-osx/svf/include/SABER/SaberSVFGBuilder.h

@@ -37,6 +37,8 @@
 namespace SVF
 {
 
+class SaberCondAllocator;
+
 class SaberSVFGBuilder : public SVFGBuilder
 {
 
@@ -62,6 +64,11 @@ public:
         svfg->addActualParmVFGNode(pagNode, cs);
     }
 
+    void setSaberCondAllocator(SaberCondAllocator* allocator)
+    {
+        saberCondAllocator = allocator;
+    }
+
 protected:
     /// Re-write create SVFG method
     virtual void buildSVFG();
@@ -69,7 +76,7 @@ protected:
     /// Return TRUE if this is a strong update STORE statement.
     bool isStrongUpdate(const SVFGNode* node, NodeID& singleton, BVDataPTAImpl* pta);
 
-private:
+protected:
     /// Remove direct value-flow edge to a dereference point for Saber source-sink memory error detection
     /// for example, given two statements: p = alloc; q = *p, the direct SVFG edge between them is deleted
     /// Because those edges only stand for values used at the dereference points but they can not pass the value to other definitions
@@ -77,7 +84,7 @@ private:
 
     /// Remove Incoming Edge for strong-update (SU) store instruction
     /// Because the SU node does not receive indirect value
-    void rmIncomingEdgeForSUStore(BVDataPTAImpl* pta);
+    virtual void rmIncomingEdgeForSUStore(BVDataPTAImpl* pta);
 
     /// Add actual parameter SVFGNode for 1st argument of a deallocation like external function
     /// In order to path sensitive leak detection
@@ -97,6 +104,8 @@ private:
     PointsTo globs;
     /// Store all global SVFG nodes
     SVFGNodeSet globSVFGNodes;
+
+    SaberCondAllocator* saberCondAllocator;
 };
 
 } // End namespace SVF

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svf-lib",
-  "version": "1.0.1783",
+  "version": "1.0.1785",
   "description": "SVF's npm support",
   "main": "index.js",
   "scripts": {