svf-lib 1.0.1927 → 1.0.1929
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/SVF-linux/Release-build/bin/ae +0 -0
- package/SVF-linux/Release-build/bin/svf-ex +0 -0
- package/SVF-linux/Release-build/include/AE/Core/AbstractState.h +18 -310
- package/SVF-linux/Release-build/include/AE/Core/IntervalValue.h +1 -0
- package/SVF-linux/Release-build/include/AE/Core/RelExeState.h +1 -1
- package/SVF-linux/Release-build/include/AE/Svfexe/AbstractInterpretation.h +12 -13
- package/SVF-linux/Release-build/include/AE/Svfexe/ICFGSimplification.h +1 -2
- package/SVF-linux/Release-build/include/AE/Svfexe/{SVFIR2ItvExeState.h → SVFIR2AbsState.h} +34 -37
- package/SVF-linux/Release-build/lib/cmake/SVF/SVFConfig.cmake +10 -10
- package/SVF-linux/Release-build/lib/libSvfCore.a +0 -0
- package/package.json +1 -1
- package/SVF-linux/Release-build/include/AE/Core/ConsExeState.h +0 -453
- package/SVF-linux/Release-build/include/AE/Core/ExeState.h +0 -304
- package/SVF-linux/Release-build/include/AE/Core/SingleAbsValue.h +0 -477
- package/SVF-linux/Release-build/include/AE/Core/SymState.h +0 -221
- package/SVF-linux/Release-build/include/AE/Svfexe/SVFIR2ConsExeState.h +0 -148
|
Binary file
|
|
Binary file
|
|
@@ -43,7 +43,6 @@
|
|
|
43
43
|
#ifndef Z3_EXAMPLE_INTERVAL_DOMAIN_H
|
|
44
44
|
#define Z3_EXAMPLE_INTERVAL_DOMAIN_H
|
|
45
45
|
|
|
46
|
-
#include "AE/Core/ExeState.h"
|
|
47
46
|
#include "AE/Core/IntervalValue.h"
|
|
48
47
|
#include "AE/Core/AbstractValue.h"
|
|
49
48
|
#include "Util/Z3Expr.h"
|
|
@@ -54,7 +53,7 @@ namespace SVF
|
|
|
54
53
|
{
|
|
55
54
|
class AbstractState
|
|
56
55
|
{
|
|
57
|
-
friend class
|
|
56
|
+
friend class SVFIR2AbsState;
|
|
58
57
|
friend class RelationSolver;
|
|
59
58
|
public:
|
|
60
59
|
typedef Map<u32_t, AbstractValue> VarToAbsValMap;
|
|
@@ -63,7 +62,9 @@ public:
|
|
|
63
62
|
|
|
64
63
|
public:
|
|
65
64
|
/// default constructor
|
|
66
|
-
AbstractState()
|
|
65
|
+
AbstractState()
|
|
66
|
+
{
|
|
67
|
+
}
|
|
67
68
|
|
|
68
69
|
AbstractState(VarToAbsValMap&_varToValMap, LocToAbsValMap&_locToValMap) : _varToAbsVal(_varToValMap),
|
|
69
70
|
_locToAbsVal(_locToValMap) {}
|
|
@@ -183,6 +184,20 @@ public:
|
|
|
183
184
|
return _varToAbsVal.at(varId);
|
|
184
185
|
}
|
|
185
186
|
|
|
187
|
+
/// get memory addresses of variable
|
|
188
|
+
AbstractValue &getAddrs(u32_t id)
|
|
189
|
+
{
|
|
190
|
+
if (_varToAbsVal.find(id)!= _varToAbsVal.end())
|
|
191
|
+
{
|
|
192
|
+
return _varToAbsVal[id];
|
|
193
|
+
}
|
|
194
|
+
else
|
|
195
|
+
{
|
|
196
|
+
_varToAbsVal[id] = AddressValue();
|
|
197
|
+
return _varToAbsVal[id];
|
|
198
|
+
}
|
|
199
|
+
}
|
|
200
|
+
|
|
186
201
|
/// whether the variable is in varToAddrs table
|
|
187
202
|
inline bool inVarToAddrsTable(u32_t id) const
|
|
188
203
|
{
|
|
@@ -437,314 +452,7 @@ protected:
|
|
|
437
452
|
|
|
438
453
|
};
|
|
439
454
|
|
|
440
|
-
class SparseAbstractState : public AbstractState
|
|
441
|
-
{
|
|
442
|
-
friend class SVFIR2ItvExeState;
|
|
443
|
-
friend class RelationSolver;
|
|
444
|
-
|
|
445
|
-
public:
|
|
446
|
-
static SparseAbstractState globalES;
|
|
447
|
-
|
|
448
|
-
public:
|
|
449
|
-
/// default constructor
|
|
450
|
-
SparseAbstractState() : AbstractState() {}
|
|
451
|
-
|
|
452
|
-
SparseAbstractState(VarToAbsValMap&_varToValMap, LocToAbsValMap&_locToValMap) : AbstractState(_varToValMap, _locToValMap) {}
|
|
453
|
-
|
|
454
|
-
/// copy constructor
|
|
455
|
-
SparseAbstractState(const SparseAbstractState&rhs) : AbstractState(rhs)
|
|
456
|
-
{
|
|
457
|
-
|
|
458
|
-
}
|
|
459
|
-
|
|
460
|
-
virtual ~SparseAbstractState() = default;
|
|
461
|
-
|
|
462
|
-
SparseAbstractState&operator=(const SparseAbstractState&rhs)
|
|
463
|
-
{
|
|
464
|
-
AbstractState::operator=(rhs);
|
|
465
|
-
return *this;
|
|
466
|
-
}
|
|
467
|
-
|
|
468
|
-
virtual void printExprValues(std::ostream &oss) const;
|
|
469
|
-
|
|
470
|
-
/// move constructor
|
|
471
|
-
SparseAbstractState(SparseAbstractState&&rhs) : AbstractState(std::move(rhs))
|
|
472
|
-
{
|
|
473
|
-
|
|
474
|
-
}
|
|
475
|
-
|
|
476
|
-
/// operator= move constructor
|
|
477
|
-
SparseAbstractState&operator=(SparseAbstractState&&rhs)
|
|
478
|
-
{
|
|
479
|
-
AbstractState::operator=(std::move(rhs));
|
|
480
|
-
return *this;
|
|
481
|
-
}
|
|
482
|
-
|
|
483
|
-
public:
|
|
484
|
-
|
|
485
|
-
/// get memory addresses of variable
|
|
486
|
-
AbstractValue &getAddrs(u32_t id)
|
|
487
|
-
{
|
|
488
|
-
if (_varToAbsVal.find(id)!= _varToAbsVal.end())
|
|
489
|
-
{
|
|
490
|
-
return _varToAbsVal[id];
|
|
491
|
-
}
|
|
492
|
-
else if (globalES._varToAbsVal.find(id)!= globalES._varToAbsVal.end())
|
|
493
|
-
{
|
|
494
|
-
return globalES._varToAbsVal[id];
|
|
495
|
-
}
|
|
496
|
-
else
|
|
497
|
-
{
|
|
498
|
-
globalES._varToAbsVal[id] = AddressValue();
|
|
499
|
-
return globalES._varToAbsVal[id];
|
|
500
|
-
}
|
|
501
|
-
}
|
|
502
|
-
|
|
503
|
-
/// get abstract value of variable
|
|
504
|
-
inline AbstractValue &operator[](u32_t varId)
|
|
505
|
-
{
|
|
506
|
-
auto localIt = _varToAbsVal.find(varId);
|
|
507
|
-
if(localIt != _varToAbsVal.end())
|
|
508
|
-
return localIt->second;
|
|
509
|
-
else
|
|
510
|
-
{
|
|
511
|
-
return globalES._varToAbsVal[varId];
|
|
512
|
-
}
|
|
513
|
-
}
|
|
514
|
-
|
|
515
|
-
/// whether the variable is in varToAddrs table
|
|
516
|
-
inline bool inVarToAddrsTable(u32_t id) const
|
|
517
|
-
{
|
|
518
|
-
if (_varToAbsVal.find(id)!= _varToAbsVal.end())
|
|
519
|
-
{
|
|
520
|
-
if (_varToAbsVal.at(id).isAddr())
|
|
521
|
-
{
|
|
522
|
-
return true;
|
|
523
|
-
}
|
|
524
|
-
else
|
|
525
|
-
{
|
|
526
|
-
return false;
|
|
527
|
-
}
|
|
528
|
-
}
|
|
529
|
-
else if (globalES._varToAbsVal.find(id)!= globalES._varToAbsVal.end())
|
|
530
|
-
{
|
|
531
|
-
if (globalES._varToAbsVal[id].isAddr())
|
|
532
|
-
{
|
|
533
|
-
return true;
|
|
534
|
-
}
|
|
535
|
-
else
|
|
536
|
-
{
|
|
537
|
-
return false;
|
|
538
|
-
}
|
|
539
|
-
}
|
|
540
|
-
else
|
|
541
|
-
{
|
|
542
|
-
return false;
|
|
543
|
-
}
|
|
544
|
-
}
|
|
545
|
-
|
|
546
|
-
/// whether the variable is in varToVal table
|
|
547
|
-
inline bool inVarToValTable(u32_t id) const
|
|
548
|
-
{
|
|
549
|
-
if (_varToAbsVal.find(id)!= _varToAbsVal.end())
|
|
550
|
-
{
|
|
551
|
-
if (_varToAbsVal.at(id).isInterval())
|
|
552
|
-
{
|
|
553
|
-
return true;
|
|
554
|
-
}
|
|
555
|
-
else
|
|
556
|
-
{
|
|
557
|
-
return false;
|
|
558
|
-
}
|
|
559
|
-
}
|
|
560
|
-
else if (globalES._varToAbsVal.find(id)!= globalES._varToAbsVal.end())
|
|
561
|
-
{
|
|
562
|
-
if (globalES._varToAbsVal[id].isInterval())
|
|
563
|
-
{
|
|
564
|
-
return true;
|
|
565
|
-
}
|
|
566
|
-
else
|
|
567
|
-
{
|
|
568
|
-
return false;
|
|
569
|
-
}
|
|
570
|
-
}
|
|
571
|
-
else
|
|
572
|
-
{
|
|
573
|
-
return false;
|
|
574
|
-
}
|
|
575
|
-
}
|
|
576
|
-
|
|
577
|
-
/// whether the memory address stores memory addresses
|
|
578
|
-
inline bool inLocToAddrsTable(u32_t id) const
|
|
579
|
-
{
|
|
580
|
-
if (_locToAbsVal.find(id)!= _locToAbsVal.end())
|
|
581
|
-
{
|
|
582
|
-
if (_locToAbsVal.at(id).isAddr())
|
|
583
|
-
{
|
|
584
|
-
return true;
|
|
585
|
-
}
|
|
586
|
-
else
|
|
587
|
-
{
|
|
588
|
-
return false;
|
|
589
|
-
}
|
|
590
|
-
}
|
|
591
|
-
else if (globalES._locToAbsVal.find(id)!= globalES._locToAbsVal.end())
|
|
592
|
-
{
|
|
593
|
-
if (globalES._locToAbsVal[id].isAddr())
|
|
594
|
-
{
|
|
595
|
-
return true;
|
|
596
|
-
}
|
|
597
|
-
else
|
|
598
|
-
{
|
|
599
|
-
return false;
|
|
600
|
-
}
|
|
601
|
-
}
|
|
602
|
-
else
|
|
603
|
-
{
|
|
604
|
-
return false;
|
|
605
|
-
}
|
|
606
|
-
}
|
|
607
|
-
|
|
608
|
-
/// whether the memory address stores abstract value
|
|
609
|
-
inline bool inLocToValTable(u32_t id) const
|
|
610
|
-
{
|
|
611
|
-
if (_locToAbsVal.find(id)!= _locToAbsVal.end())
|
|
612
|
-
{
|
|
613
|
-
if (_locToAbsVal.at(id).isInterval())
|
|
614
|
-
{
|
|
615
|
-
return true;
|
|
616
|
-
}
|
|
617
|
-
else
|
|
618
|
-
{
|
|
619
|
-
return false;
|
|
620
|
-
}
|
|
621
|
-
}
|
|
622
|
-
else if (globalES._locToAbsVal.find(id)!= globalES._locToAbsVal.end())
|
|
623
|
-
{
|
|
624
|
-
if (globalES._locToAbsVal[id].isInterval())
|
|
625
|
-
{
|
|
626
|
-
return true;
|
|
627
|
-
}
|
|
628
|
-
else
|
|
629
|
-
{
|
|
630
|
-
return false;
|
|
631
|
-
}
|
|
632
|
-
}
|
|
633
|
-
else
|
|
634
|
-
{
|
|
635
|
-
return false;
|
|
636
|
-
}
|
|
637
|
-
}
|
|
638
|
-
|
|
639
|
-
inline bool inLocalLocToValTable(u32_t id) const
|
|
640
|
-
{
|
|
641
|
-
if (_locToAbsVal.find(id)!= _locToAbsVal.end())
|
|
642
|
-
{
|
|
643
|
-
return _locToAbsVal.at(id).isInterval();
|
|
644
|
-
}
|
|
645
|
-
else
|
|
646
|
-
return false;
|
|
647
|
-
}
|
|
648
|
-
|
|
649
|
-
inline bool inLocalLocToAddrsTable(u32_t id) const
|
|
650
|
-
{
|
|
651
|
-
if (_locToAbsVal.find(id)!= _locToAbsVal.end())
|
|
652
|
-
{
|
|
653
|
-
return _locToAbsVal.at(id).isAddr();
|
|
654
|
-
}
|
|
655
|
-
else
|
|
656
|
-
return false;
|
|
657
|
-
}
|
|
658
|
-
|
|
659
|
-
public:
|
|
660
|
-
|
|
661
|
-
inline void cpyItvToLocal(u32_t varId)
|
|
662
|
-
{
|
|
663
|
-
auto localIt = _varToAbsVal.find(varId);
|
|
664
|
-
// local already have varId
|
|
665
|
-
if (localIt != _varToAbsVal.end()) return;
|
|
666
|
-
auto globIt = globalES._varToAbsVal.find(varId);
|
|
667
|
-
if (globIt != globalES._varToAbsVal.end())
|
|
668
|
-
{
|
|
669
|
-
_varToAbsVal[varId] = globIt->second;
|
|
670
|
-
}
|
|
671
|
-
}
|
|
672
|
-
|
|
673
|
-
/// domain widen with other, and return the widened domain
|
|
674
|
-
SparseAbstractState widening(const SparseAbstractState&other);
|
|
675
|
-
|
|
676
|
-
/// domain narrow with other, and return the narrowed domain
|
|
677
|
-
SparseAbstractState narrowing(const SparseAbstractState&other);
|
|
678
|
-
|
|
679
|
-
/// domain widen with other, important! other widen this.
|
|
680
|
-
void widenWith(const SparseAbstractState&other);
|
|
681
|
-
|
|
682
|
-
/// domain join with other, important! other widen this.
|
|
683
|
-
void joinWith(const SparseAbstractState&other);
|
|
684
|
-
|
|
685
|
-
/// domain narrow with other, important! other widen this.
|
|
686
|
-
void narrowWith(const SparseAbstractState&other);
|
|
687
|
-
|
|
688
|
-
/// domain meet with other, important! other widen this.
|
|
689
|
-
void meetWith(const SparseAbstractState&other);
|
|
690
|
-
|
|
691
|
-
u32_t hash() const;
|
|
692
|
-
|
|
693
|
-
public:
|
|
694
|
-
|
|
695
|
-
inline AbstractValue &load(u32_t addr)
|
|
696
|
-
{
|
|
697
|
-
assert(isVirtualMemAddress(addr) && "not virtual address?");
|
|
698
|
-
u32_t objId = getInternalID(addr);
|
|
699
|
-
auto it = _locToAbsVal.find(objId);
|
|
700
|
-
if(it != _locToAbsVal.end())
|
|
701
|
-
return it->second;
|
|
702
|
-
else
|
|
703
|
-
{
|
|
704
|
-
auto globIt = globalES._locToAbsVal.find(objId);
|
|
705
|
-
if(globIt != globalES._locToAbsVal.end())
|
|
706
|
-
return globIt->second;
|
|
707
|
-
else
|
|
708
|
-
{
|
|
709
|
-
return globalES._locToAbsVal[objId];
|
|
710
|
-
}
|
|
711
|
-
|
|
712
|
-
}
|
|
713
|
-
}
|
|
714
|
-
|
|
715
|
-
bool equals(const SparseAbstractState&other) const;
|
|
716
|
-
|
|
717
|
-
bool operator==(const SparseAbstractState&rhs) const
|
|
718
|
-
{
|
|
719
|
-
return eqVarToValMap(_varToAbsVal, rhs._varToAbsVal) &&
|
|
720
|
-
eqVarToValMap(_locToAbsVal, rhs._locToAbsVal);
|
|
721
|
-
}
|
|
722
|
-
|
|
723
|
-
bool operator!=(const SparseAbstractState&rhs) const
|
|
724
|
-
{
|
|
725
|
-
return !(*this == rhs);
|
|
726
|
-
}
|
|
727
|
-
|
|
728
|
-
bool operator<(const SparseAbstractState&rhs) const
|
|
729
|
-
{
|
|
730
|
-
return !(*this >= rhs);
|
|
731
|
-
}
|
|
732
|
-
|
|
733
|
-
|
|
734
|
-
bool operator>=(const SparseAbstractState&rhs) const
|
|
735
|
-
{
|
|
736
|
-
return geqVarToValMap(_varToAbsVal, rhs.getVarToVal()) && geqVarToValMap(_locToAbsVal, rhs._locToAbsVal);
|
|
737
|
-
}
|
|
738
|
-
};
|
|
739
455
|
}
|
|
740
456
|
|
|
741
|
-
template<>
|
|
742
|
-
struct std::hash<SVF::SparseAbstractState>
|
|
743
|
-
{
|
|
744
|
-
size_t operator()(const SVF::SparseAbstractState&exeState) const
|
|
745
|
-
{
|
|
746
|
-
return exeState.hash();
|
|
747
|
-
}
|
|
748
|
-
};
|
|
749
457
|
|
|
750
458
|
#endif //Z3_EXAMPLE_INTERVAL_DOMAIN_H
|
|
@@ -28,17 +28,16 @@
|
|
|
28
28
|
// Created by Jiawei Wang on 2024/1/10.
|
|
29
29
|
//
|
|
30
30
|
|
|
31
|
-
#include "Util/SVFBugReport.h"
|
|
32
31
|
#include "AE/Core/ICFGWTO.h"
|
|
32
|
+
#include "AE/Svfexe/SVFIR2AbsState.h"
|
|
33
|
+
#include "Util/SVFBugReport.h"
|
|
33
34
|
#include "WPA/Andersen.h"
|
|
34
|
-
#include "AE/Svfexe/SVFIR2ItvExeState.h"
|
|
35
35
|
|
|
36
36
|
namespace SVF
|
|
37
37
|
{
|
|
38
38
|
class AbstractInterpretation;
|
|
39
39
|
class AEStat;
|
|
40
40
|
class AEAPI;
|
|
41
|
-
class ExeState;
|
|
42
41
|
|
|
43
42
|
template<typename T> class FILOWorkList;
|
|
44
43
|
|
|
@@ -144,10 +143,10 @@ protected:
|
|
|
144
143
|
/**
|
|
145
144
|
* Check if execution state exist by merging states of predecessor nodes
|
|
146
145
|
*
|
|
147
|
-
* @param
|
|
146
|
+
* @param block The ICFGNode to analyse
|
|
148
147
|
* @return if this node has preceding execution state
|
|
149
148
|
*/
|
|
150
|
-
bool
|
|
149
|
+
bool propogateAbsStateToCurNode(const ICFGNode* block);
|
|
151
150
|
|
|
152
151
|
/**
|
|
153
152
|
* Check if execution state exist at the branch edge
|
|
@@ -155,7 +154,7 @@ protected:
|
|
|
155
154
|
* @param intraEdge the edge from CmpStmt to the next node
|
|
156
155
|
* @return if this edge is feasible
|
|
157
156
|
*/
|
|
158
|
-
bool hasBranchES(const IntraCFGEdge* intraEdge,
|
|
157
|
+
bool hasBranchES(const IntraCFGEdge* intraEdge, AbstractState& es);
|
|
159
158
|
|
|
160
159
|
/**
|
|
161
160
|
* handle instructions in ICFGNode
|
|
@@ -221,7 +220,7 @@ protected:
|
|
|
221
220
|
* @return if this ICFGNode has preceding execution state
|
|
222
221
|
*/
|
|
223
222
|
bool hasCmpBranchES(const CmpStmt* cmpStmt, s64_t succ,
|
|
224
|
-
|
|
223
|
+
AbstractState& es);
|
|
225
224
|
|
|
226
225
|
/**
|
|
227
226
|
* Check if this SwitchInst and succ are satisfiable to the execution state.
|
|
@@ -231,7 +230,7 @@ protected:
|
|
|
231
230
|
* @return if this ICFGNode has preceding execution state
|
|
232
231
|
*/
|
|
233
232
|
bool hasSwitchBranchES(const SVFVar* var, s64_t succ,
|
|
234
|
-
|
|
233
|
+
AbstractState& es);
|
|
235
234
|
|
|
236
235
|
|
|
237
236
|
/**
|
|
@@ -343,7 +342,7 @@ protected:
|
|
|
343
342
|
SVFIR* _svfir;
|
|
344
343
|
PTACallGraph* _callgraph;
|
|
345
344
|
/// Execution State, used to store the Interval Value of every SVF variable
|
|
346
|
-
|
|
345
|
+
SVFIR2AbsState* _svfir2ExeState;
|
|
347
346
|
AEAPI* _api{nullptr};
|
|
348
347
|
|
|
349
348
|
ICFG* _icfg;
|
|
@@ -375,9 +374,9 @@ private:
|
|
|
375
374
|
|
|
376
375
|
// helper functions in handleCycle
|
|
377
376
|
bool widenFixpointPass(const ICFGNode* cycle_head,
|
|
378
|
-
|
|
377
|
+
AbstractState& pre_es);
|
|
379
378
|
bool narrowFixpointPass(const ICFGNode* cycle_head,
|
|
380
|
-
|
|
379
|
+
AbstractState& pre_es);
|
|
381
380
|
|
|
382
381
|
protected:
|
|
383
382
|
// there data should be shared with subclasses
|
|
@@ -386,8 +385,8 @@ protected:
|
|
|
386
385
|
Set<std::string> _checkpoint_names;
|
|
387
386
|
|
|
388
387
|
private:
|
|
389
|
-
Map<const ICFGNode*,
|
|
390
|
-
Map<const ICFGNode*,
|
|
388
|
+
Map<const ICFGNode*, AbstractState> _preAbstractTrace;
|
|
389
|
+
Map<const ICFGNode*, AbstractState> _postAbstractTrace;
|
|
391
390
|
std::string _moduleName;
|
|
392
391
|
};
|
|
393
392
|
}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
//===-
|
|
1
|
+
//===- SVFIR2AbsState.h -- SVF IR Translation to Interval Domain-----//
|
|
2
2
|
//
|
|
3
3
|
// SVF: Static Value-Flow Analysis
|
|
4
4
|
//
|
|
@@ -23,7 +23,7 @@
|
|
|
23
23
|
// 46th International Conference on Software Engineering. (ICSE24)
|
|
24
24
|
//===----------------------------------------------------------------------===//
|
|
25
25
|
/*
|
|
26
|
-
*
|
|
26
|
+
* SVFIR2AbsState.h
|
|
27
27
|
*
|
|
28
28
|
* Created on: Aug 7, 2022
|
|
29
29
|
* Author: Jiawei Wang, Xiao Cheng
|
|
@@ -34,25 +34,24 @@
|
|
|
34
34
|
#define Z3_EXAMPLE_SVFIR2ITVEXESTATE_H
|
|
35
35
|
|
|
36
36
|
#include "AE/Core/AbstractState.h"
|
|
37
|
-
#include "AE/Core/ExeState.h"
|
|
38
37
|
#include "AE/Core/RelExeState.h"
|
|
39
38
|
#include "SVFIR/SVFIR.h"
|
|
40
39
|
|
|
41
40
|
namespace SVF
|
|
42
41
|
{
|
|
43
|
-
class
|
|
42
|
+
class SVFIR2AbsState
|
|
44
43
|
{
|
|
45
44
|
public:
|
|
46
45
|
static AbstractValue globalNulladdrs;
|
|
47
46
|
public:
|
|
48
|
-
|
|
47
|
+
SVFIR2AbsState(SVFIR *ir) : _svfir(ir) {}
|
|
49
48
|
|
|
50
|
-
void setEs(const
|
|
49
|
+
void setEs(const AbstractState&es)
|
|
51
50
|
{
|
|
52
51
|
_es = es;
|
|
53
52
|
}
|
|
54
53
|
|
|
55
|
-
|
|
54
|
+
AbstractState& getEs()
|
|
56
55
|
{
|
|
57
56
|
return _es;
|
|
58
57
|
}
|
|
@@ -67,9 +66,9 @@ public:
|
|
|
67
66
|
return _relEs;
|
|
68
67
|
}
|
|
69
68
|
|
|
70
|
-
void widenAddrs(
|
|
69
|
+
void widenAddrs(AbstractState&lhs, const AbstractState&rhs);
|
|
71
70
|
|
|
72
|
-
void narrowAddrs(
|
|
71
|
+
void narrowAddrs(AbstractState&lhs, const AbstractState&rhs);
|
|
73
72
|
|
|
74
73
|
/// Return the field address given a pointer points to a struct object and an offset
|
|
75
74
|
AbstractValue getGepObjAddress(u32_t pointer, APOffset offset);
|
|
@@ -102,7 +101,7 @@ public:
|
|
|
102
101
|
return Z3Expr::getContext();
|
|
103
102
|
}
|
|
104
103
|
|
|
105
|
-
void applySummary(
|
|
104
|
+
void applySummary(AbstractState&es);
|
|
106
105
|
|
|
107
106
|
|
|
108
107
|
/// Init ObjVar
|
|
@@ -145,74 +144,72 @@ public:
|
|
|
145
144
|
return _es.inLocToAddrsTable(id);
|
|
146
145
|
}
|
|
147
146
|
|
|
148
|
-
void
|
|
147
|
+
void handleAddr(const AddrStmt *addr);
|
|
149
148
|
|
|
150
|
-
void
|
|
149
|
+
void handleBinary(const BinaryOPStmt *binary);
|
|
151
150
|
|
|
152
|
-
void
|
|
151
|
+
void handleCmp(const CmpStmt *cmp);
|
|
153
152
|
|
|
154
|
-
void
|
|
153
|
+
void handleLoad(const LoadStmt *load);
|
|
155
154
|
|
|
156
|
-
void
|
|
155
|
+
void handleStore(const StoreStmt *store);
|
|
157
156
|
|
|
158
|
-
void
|
|
157
|
+
void handleCopy(const CopyStmt *copy);
|
|
159
158
|
|
|
160
|
-
void
|
|
159
|
+
void handleCall(const CallPE *callPE);
|
|
161
160
|
|
|
162
|
-
void
|
|
161
|
+
void handleRet(const RetPE *retPE);
|
|
163
162
|
|
|
164
|
-
void
|
|
163
|
+
void handleGep(const GepStmt *gep);
|
|
165
164
|
|
|
166
|
-
void
|
|
165
|
+
void handleSelect(const SelectStmt *select);
|
|
167
166
|
|
|
168
|
-
void
|
|
169
|
-
|
|
170
|
-
void translatePhi(const PhiStmt *phi);
|
|
167
|
+
void handlePhi(const PhiStmt *phi);
|
|
171
168
|
|
|
172
169
|
/// Return the internal index if idx is an address otherwise return the value of idx
|
|
173
170
|
static inline u32_t getInternalID(u32_t idx)
|
|
174
171
|
{
|
|
175
|
-
return
|
|
172
|
+
return AbstractState::getInternalID(idx);
|
|
176
173
|
}
|
|
177
174
|
|
|
178
175
|
/// The physical address starts with 0x7f...... + idx
|
|
179
176
|
static inline u32_t getVirtualMemAddress(u32_t idx)
|
|
180
177
|
{
|
|
181
|
-
return
|
|
178
|
+
return AbstractState::getVirtualMemAddress(idx);
|
|
182
179
|
}
|
|
183
180
|
|
|
184
181
|
/// Check bit value of val start with 0x7F000000, filter by 0xFF000000
|
|
185
182
|
static inline bool isVirtualMemAddress(u32_t val)
|
|
186
183
|
{
|
|
187
|
-
return
|
|
184
|
+
return AbstractState::isVirtualMemAddress(val);
|
|
188
185
|
}
|
|
189
186
|
|
|
190
187
|
protected:
|
|
191
188
|
|
|
192
|
-
void
|
|
189
|
+
void handleBinaryRel(const BinaryOPStmt *binary);
|
|
193
190
|
|
|
194
|
-
void
|
|
191
|
+
void handleCmpRel(const CmpStmt *cmp);
|
|
195
192
|
|
|
196
|
-
void
|
|
193
|
+
void handleLoadRel(const LoadStmt *load);
|
|
197
194
|
|
|
198
|
-
void
|
|
195
|
+
void handleStoreRel(const StoreStmt *store);
|
|
199
196
|
|
|
200
|
-
void
|
|
197
|
+
void handleCopyRel(const CopyStmt *copy);
|
|
201
198
|
|
|
202
|
-
void
|
|
199
|
+
void handleCallRel(const CallPE *callPE);
|
|
203
200
|
|
|
204
|
-
void
|
|
201
|
+
void handleRetRel(const RetPE *retPE);
|
|
205
202
|
|
|
206
|
-
void
|
|
203
|
+
void handleSelectRel(const SelectStmt *select);
|
|
207
204
|
|
|
208
|
-
void
|
|
205
|
+
void handlePhiRel(const PhiStmt *phi, const ICFGNode *srcNode, const std::vector<const ICFGEdge *> &path);
|
|
209
206
|
|
|
210
207
|
private:
|
|
211
208
|
SVFIR *_svfir;
|
|
212
|
-
|
|
209
|
+
AbstractState _es;
|
|
213
210
|
RelExeState _relEs;
|
|
214
211
|
|
|
215
|
-
Map<NodeID,
|
|
212
|
+
Map<NodeID, AbstractState*> _br_cond;
|
|
216
213
|
AbstractValue getZExtValue(const SVFVar* var, const SVFType*);
|
|
217
214
|
};
|
|
218
215
|
}
|
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
####### Any changes to this file will be overwritten by the next CMake run ####
|
|
4
4
|
####### The input file was .config.cmake.in ########
|
|
5
5
|
|
|
6
|
-
get_filename_component(
|
|
6
|
+
get_filename_component(PACKAGE_${CMAKE_FIND_PACKAGE_NAME}_COUNTER_1 "${CMAKE_CURRENT_LIST_DIR}/../../../" ABSOLUTE)
|
|
7
7
|
|
|
8
8
|
macro(set_and_check _var _file)
|
|
9
9
|
set(${_var} "${_file}")
|
|
@@ -24,23 +24,23 @@ endmacro()
|
|
|
24
24
|
|
|
25
25
|
####################################################################################
|
|
26
26
|
|
|
27
|
-
set_and_check(SVF_INSTALL_ROOT "${
|
|
28
|
-
set_and_check(SVF_INSTALL_BIN_DIR "${
|
|
29
|
-
set_and_check(SVF_INSTALL_LIB_DIR "${
|
|
27
|
+
set_and_check(SVF_INSTALL_ROOT "${PACKAGE_${CMAKE_FIND_PACKAGE_NAME}_COUNTER_1}")
|
|
28
|
+
set_and_check(SVF_INSTALL_BIN_DIR "${PACKAGE_${CMAKE_FIND_PACKAGE_NAME}_COUNTER_1}/bin")
|
|
29
|
+
set_and_check(SVF_INSTALL_LIB_DIR "${PACKAGE_${CMAKE_FIND_PACKAGE_NAME}_COUNTER_1}/lib")
|
|
30
30
|
|
|
31
|
-
set(SVF_INCLUDE_PATH "${
|
|
32
|
-
set(SVF_LLVM_INCLUDE_PATH "${
|
|
31
|
+
set(SVF_INCLUDE_PATH "${PACKAGE_${CMAKE_FIND_PACKAGE_NAME}_COUNTER_1}/../svf/include")
|
|
32
|
+
set(SVF_LLVM_INCLUDE_PATH "${PACKAGE_${CMAKE_FIND_PACKAGE_NAME}_COUNTER_1}/../svf-llvm/include")
|
|
33
33
|
|
|
34
34
|
if(EXISTS ${SVF_INCLUDE_PATH} AND EXISTS ${SVF_LLVM_INCLUDE_PATH})
|
|
35
|
-
set(SVF_INSTALL_INCLUDE_DIR "${SVF_INCLUDE_PATH};${SVF_LLVM_INCLUDE_PATH};${
|
|
35
|
+
set(SVF_INSTALL_INCLUDE_DIR "${SVF_INCLUDE_PATH};${SVF_LLVM_INCLUDE_PATH};${PACKAGE_${CMAKE_FIND_PACKAGE_NAME}_COUNTER_1}/include")
|
|
36
36
|
else()
|
|
37
|
-
set_and_check(SVF_INSTALL_INCLUDE_DIR "${
|
|
37
|
+
set_and_check(SVF_INSTALL_INCLUDE_DIR "${PACKAGE_${CMAKE_FIND_PACKAGE_NAME}_COUNTER_1}/include")
|
|
38
38
|
endif()
|
|
39
39
|
|
|
40
40
|
message(STATUS "SVF_INSTALL_INCLUDE_DIR is set to: ${SVF_INSTALL_INCLUDE_DIR}")
|
|
41
41
|
|
|
42
|
-
set_and_check(SVF_INSTALL_EXTAPI_DIR "${
|
|
43
|
-
set_and_check(SVF_INSTALL_EXTAPI_FILE "${
|
|
42
|
+
set_and_check(SVF_INSTALL_EXTAPI_DIR "${PACKAGE_${CMAKE_FIND_PACKAGE_NAME}_COUNTER_1}/lib")
|
|
43
|
+
set_and_check(SVF_INSTALL_EXTAPI_FILE "${PACKAGE_${CMAKE_FIND_PACKAGE_NAME}_COUNTER_1}/lib/extapi.bc")
|
|
44
44
|
|
|
45
45
|
set(SVF_SANITIZE "")
|
|
46
46
|
|
|
Binary file
|