svf-lib 1.0.1999 → 1.0.2001
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/SVF-linux/Release-build/bin/ae +0 -0
- package/SVF-linux/Release-build/bin/svf-ex +0 -0
- package/SVF-linux/Release-build/include/AE/Core/AbstractValue.h +6 -287
- package/SVF-linux/Release-build/include/AE/Svfexe/AbstractInterpretation.h +6 -6
- package/SVF-linux/Release-build/include/AE/Svfexe/BufOverflowChecker.h +1 -1
- package/SVF-linux/Release-build/include/AE/Svfexe/SVFIR2AbsState.h +2 -2
- package/SVF-linux/Release-build/lib/libSvfCore.a +0 -0
- package/SVF-osx/Release-build/bin/ae +0 -0
- package/SVF-osx/Release-build/bin/cfl +0 -0
- package/SVF-osx/Release-build/bin/dvf +0 -0
- package/SVF-osx/Release-build/bin/llvm2svf +0 -0
- package/SVF-osx/Release-build/bin/mta +0 -0
- package/SVF-osx/Release-build/bin/saber +0 -0
- package/SVF-osx/Release-build/bin/svf-ex +0 -0
- package/SVF-osx/Release-build/bin/wpa +0 -0
- package/SVF-osx/Release-build/include/AE/Core/AbstractValue.h +6 -287
- package/SVF-osx/Release-build/include/AE/Svfexe/AbstractInterpretation.h +6 -6
- package/SVF-osx/Release-build/include/AE/Svfexe/BufOverflowChecker.h +1 -1
- package/SVF-osx/Release-build/include/AE/Svfexe/SVFIR2AbsState.h +2 -2
- package/SVF-osx/Release-build/lib/libSvfCore.a +0 -0
- package/SVF-osx/Release-build/lib/libSvfLLVM.a +0 -0
- package/package.json +1 -1
|
Binary file
|
|
Binary file
|
|
@@ -168,317 +168,36 @@ public:
|
|
|
168
168
|
AbstractValue(const IntervalValue& ival) : type(IntervalType), interval(ival) {}
|
|
169
169
|
|
|
170
170
|
AbstractValue(const AddressValue& addr) : type(AddressType), addr(addr) {}
|
|
171
|
-
|
|
171
|
+
|
|
172
172
|
IntervalValue& getInterval()
|
|
173
173
|
{
|
|
174
174
|
if (isUnknown())
|
|
175
175
|
{
|
|
176
176
|
interval = IntervalValue::top();
|
|
177
177
|
}
|
|
178
|
-
assert(isInterval());
|
|
178
|
+
assert(isInterval() && "Attempting to retrieve an AbstractValue that is not an Interval!");
|
|
179
179
|
return interval;
|
|
180
180
|
}
|
|
181
181
|
|
|
182
|
-
//
|
|
183
182
|
const IntervalValue getInterval() const
|
|
184
183
|
{
|
|
185
|
-
assert(isInterval());
|
|
184
|
+
assert(isInterval() && "Attempting to retrieve an AbstractValue that is not an Interval!");
|
|
186
185
|
return interval;
|
|
187
186
|
}
|
|
188
187
|
|
|
189
188
|
AddressValue& getAddrs()
|
|
190
189
|
{
|
|
191
|
-
assert(isAddr());
|
|
190
|
+
assert(isAddr() && "Attempting to retrieve an AbstractValue that is not an Address!");
|
|
192
191
|
return addr;
|
|
193
192
|
}
|
|
194
193
|
|
|
195
194
|
const AddressValue getAddrs() const
|
|
196
195
|
{
|
|
197
|
-
assert(isAddr());
|
|
196
|
+
assert(isAddr() && "Attempting to retrieve an AbstractValue that is not an Address!");
|
|
198
197
|
return addr;
|
|
199
198
|
}
|
|
200
|
-
~AbstractValue() {};
|
|
201
|
-
|
|
202
|
-
|
|
203
|
-
// interval visit funcs
|
|
204
|
-
bool isTop() const
|
|
205
|
-
{
|
|
206
|
-
assert(isInterval());
|
|
207
|
-
return interval.isTop();
|
|
208
|
-
}
|
|
209
|
-
|
|
210
|
-
bool isBottom() const
|
|
211
|
-
{
|
|
212
|
-
assert(isInterval());
|
|
213
|
-
return interval.isBottom();
|
|
214
|
-
}
|
|
215
|
-
|
|
216
|
-
const BoundedInt& lb() const
|
|
217
|
-
{
|
|
218
|
-
assert(isInterval());
|
|
219
|
-
return interval.lb();
|
|
220
|
-
}
|
|
221
|
-
|
|
222
|
-
const BoundedInt& ub() const
|
|
223
|
-
{
|
|
224
|
-
assert(isInterval());
|
|
225
|
-
return interval.ub();
|
|
226
|
-
}
|
|
227
|
-
|
|
228
|
-
void setLb(const BoundedInt& lb)
|
|
229
|
-
{
|
|
230
|
-
assert(isInterval());
|
|
231
|
-
interval.setLb(lb);
|
|
232
|
-
}
|
|
233
|
-
|
|
234
|
-
void setUb(const BoundedInt& ub)
|
|
235
|
-
{
|
|
236
|
-
assert(isInterval());
|
|
237
|
-
interval.setUb(ub);
|
|
238
|
-
}
|
|
239
|
-
|
|
240
|
-
void setValue(const BoundedInt &lb, const BoundedInt &ub)
|
|
241
|
-
{
|
|
242
|
-
assert(isInterval());
|
|
243
|
-
interval.setValue(lb, ub);
|
|
244
|
-
}
|
|
245
|
-
|
|
246
|
-
bool is_zero() const
|
|
247
|
-
{
|
|
248
|
-
assert(isInterval());
|
|
249
|
-
return interval.is_zero();
|
|
250
|
-
}
|
|
251
|
-
|
|
252
|
-
bool is_infinite() const
|
|
253
|
-
{
|
|
254
|
-
assert(isInterval());
|
|
255
|
-
return interval.is_infinite();
|
|
256
|
-
}
|
|
257
|
-
|
|
258
|
-
bool is_int() const
|
|
259
|
-
{
|
|
260
|
-
assert(isInterval());
|
|
261
|
-
return interval.is_int();
|
|
262
|
-
}
|
|
263
|
-
|
|
264
|
-
bool is_real() const
|
|
265
|
-
{
|
|
266
|
-
assert(isInterval());
|
|
267
|
-
return interval.is_real();
|
|
268
|
-
}
|
|
269
|
-
|
|
270
|
-
s64_t getIntNumeral() const
|
|
271
|
-
{
|
|
272
|
-
assert(isInterval());
|
|
273
|
-
return interval.getIntNumeral();
|
|
274
|
-
}
|
|
275
|
-
|
|
276
|
-
double getRealNumeral() const
|
|
277
|
-
{
|
|
278
|
-
assert(isInterval());
|
|
279
|
-
return interval.getRealNumeral();
|
|
280
|
-
}
|
|
281
|
-
|
|
282
|
-
bool is_numeral() const
|
|
283
|
-
{
|
|
284
|
-
assert(isInterval());
|
|
285
|
-
return interval.is_numeral();
|
|
286
|
-
}
|
|
287
|
-
|
|
288
|
-
void set_to_bottom()
|
|
289
|
-
{
|
|
290
|
-
assert(isInterval());
|
|
291
|
-
interval.set_to_bottom();
|
|
292
|
-
}
|
|
293
|
-
|
|
294
|
-
void set_to_top()
|
|
295
|
-
{
|
|
296
|
-
assert(isInterval());
|
|
297
|
-
interval.set_to_top();
|
|
298
|
-
}
|
|
299
199
|
|
|
300
|
-
|
|
301
|
-
{
|
|
302
|
-
assert(isInterval() && other.isInterval());
|
|
303
|
-
return interval.leq(other.interval);
|
|
304
|
-
}
|
|
305
|
-
|
|
306
|
-
bool geq(const AbstractValue &other) const
|
|
307
|
-
{
|
|
308
|
-
assert(isInterval() && other.isInterval());
|
|
309
|
-
return interval.geq(other.interval);
|
|
310
|
-
}
|
|
311
|
-
|
|
312
|
-
bool contains(s64_t n) const
|
|
313
|
-
{
|
|
314
|
-
assert(isInterval());
|
|
315
|
-
return interval.contains(n);
|
|
316
|
-
}
|
|
317
|
-
// operator +-*/%>< >= <= << >> & | ^
|
|
318
|
-
AbstractValue operator+(const AbstractValue &other) const
|
|
319
|
-
{
|
|
320
|
-
assert(isInterval() && other.isInterval());
|
|
321
|
-
return interval + other.interval;
|
|
322
|
-
}
|
|
323
|
-
AbstractValue operator+(const IntervalValue &other) const
|
|
324
|
-
{
|
|
325
|
-
assert(isInterval());
|
|
326
|
-
return interval + other;
|
|
327
|
-
}
|
|
328
|
-
|
|
329
|
-
AbstractValue operator-(const AbstractValue &other) const
|
|
330
|
-
{
|
|
331
|
-
assert(isInterval() && other.isInterval());
|
|
332
|
-
return interval - other.interval;
|
|
333
|
-
}
|
|
334
|
-
AbstractValue operator-(const IntervalValue &other) const
|
|
335
|
-
{
|
|
336
|
-
assert(isInterval());
|
|
337
|
-
return interval - other;
|
|
338
|
-
}
|
|
339
|
-
|
|
340
|
-
AbstractValue operator*(const AbstractValue &other) const
|
|
341
|
-
{
|
|
342
|
-
assert(isInterval() && other.isInterval());
|
|
343
|
-
return interval * other.interval;
|
|
344
|
-
}
|
|
345
|
-
AbstractValue operator*(const IntervalValue &other) const
|
|
346
|
-
{
|
|
347
|
-
assert(isInterval());
|
|
348
|
-
return interval * other;
|
|
349
|
-
}
|
|
350
|
-
|
|
351
|
-
AbstractValue operator/(const AbstractValue &other) const
|
|
352
|
-
{
|
|
353
|
-
assert(isInterval() && other.isInterval());
|
|
354
|
-
return interval / other.interval;
|
|
355
|
-
}
|
|
356
|
-
AbstractValue operator/(const IntervalValue &other) const
|
|
357
|
-
{
|
|
358
|
-
assert(isInterval());
|
|
359
|
-
return interval / other;
|
|
360
|
-
}
|
|
361
|
-
|
|
362
|
-
AbstractValue operator%(const AbstractValue &other) const
|
|
363
|
-
{
|
|
364
|
-
assert(isInterval() && other.isInterval());
|
|
365
|
-
return interval % other.interval;
|
|
366
|
-
}
|
|
367
|
-
AbstractValue operator%(const IntervalValue &other) const
|
|
368
|
-
{
|
|
369
|
-
assert(isInterval());
|
|
370
|
-
return interval % other;
|
|
371
|
-
}
|
|
372
|
-
|
|
373
|
-
AbstractValue operator>>(const AbstractValue &other) const
|
|
374
|
-
{
|
|
375
|
-
assert(isInterval() && other.isInterval());
|
|
376
|
-
return interval >> other.interval;
|
|
377
|
-
}
|
|
378
|
-
AbstractValue operator>>(const IntervalValue &other) const
|
|
379
|
-
{
|
|
380
|
-
assert(isInterval());
|
|
381
|
-
return interval >> other;
|
|
382
|
-
}
|
|
383
|
-
|
|
384
|
-
AbstractValue operator<<(const AbstractValue &other) const
|
|
385
|
-
{
|
|
386
|
-
assert(isInterval() && other.isInterval());
|
|
387
|
-
return interval << other.interval;
|
|
388
|
-
}
|
|
389
|
-
AbstractValue operator<<(const IntervalValue &other) const
|
|
390
|
-
{
|
|
391
|
-
assert(isInterval());
|
|
392
|
-
return interval << other;
|
|
393
|
-
}
|
|
394
|
-
|
|
395
|
-
AbstractValue operator&(const AbstractValue &other) const
|
|
396
|
-
{
|
|
397
|
-
assert(isInterval() && other.isInterval());
|
|
398
|
-
return interval & other.interval;
|
|
399
|
-
}
|
|
400
|
-
AbstractValue operator&(const IntervalValue &other) const
|
|
401
|
-
{
|
|
402
|
-
assert(isInterval());
|
|
403
|
-
return interval & other;
|
|
404
|
-
}
|
|
405
|
-
|
|
406
|
-
AbstractValue operator|(const AbstractValue &other) const
|
|
407
|
-
{
|
|
408
|
-
assert(isInterval() && other.isInterval());
|
|
409
|
-
return interval | other.interval;
|
|
410
|
-
}
|
|
411
|
-
AbstractValue operator|(const IntervalValue &other) const
|
|
412
|
-
{
|
|
413
|
-
assert(isInterval());
|
|
414
|
-
return interval | other;
|
|
415
|
-
}
|
|
416
|
-
|
|
417
|
-
AbstractValue operator^(const AbstractValue &other) const
|
|
418
|
-
{
|
|
419
|
-
assert(isInterval() && other.isInterval());
|
|
420
|
-
return interval ^ other.interval;
|
|
421
|
-
}
|
|
422
|
-
AbstractValue operator^(const IntervalValue &other) const
|
|
423
|
-
{
|
|
424
|
-
assert(isInterval());
|
|
425
|
-
return interval ^ other;
|
|
426
|
-
}
|
|
427
|
-
|
|
428
|
-
AbstractValue operator>(const AbstractValue &other) const
|
|
429
|
-
{
|
|
430
|
-
assert(isInterval() && other.isInterval());
|
|
431
|
-
return interval > other.interval;
|
|
432
|
-
}
|
|
433
|
-
AbstractValue operator>(const IntervalValue &other) const
|
|
434
|
-
{
|
|
435
|
-
assert(isInterval());
|
|
436
|
-
return interval > other;
|
|
437
|
-
}
|
|
438
|
-
|
|
439
|
-
AbstractValue operator<(const AbstractValue &other) const
|
|
440
|
-
{
|
|
441
|
-
assert(isInterval() && other.isInterval());
|
|
442
|
-
return interval < other.interval;
|
|
443
|
-
}
|
|
444
|
-
AbstractValue operator<(const IntervalValue &other) const
|
|
445
|
-
{
|
|
446
|
-
assert(isInterval());
|
|
447
|
-
return interval < other;
|
|
448
|
-
}
|
|
449
|
-
|
|
450
|
-
AbstractValue operator>=(const AbstractValue &other) const
|
|
451
|
-
{
|
|
452
|
-
assert(isInterval() && other.isInterval());
|
|
453
|
-
return interval >= other.interval;
|
|
454
|
-
}
|
|
455
|
-
AbstractValue operator>=(const IntervalValue &other) const
|
|
456
|
-
{
|
|
457
|
-
assert(isInterval());
|
|
458
|
-
return interval >= other;
|
|
459
|
-
}
|
|
460
|
-
|
|
461
|
-
AbstractValue operator<=(const AbstractValue &other) const
|
|
462
|
-
{
|
|
463
|
-
assert(isInterval() && other.isInterval());
|
|
464
|
-
return interval <= other.interval;
|
|
465
|
-
}
|
|
466
|
-
AbstractValue operator<=(const IntervalValue &other) const
|
|
467
|
-
{
|
|
468
|
-
assert(isInterval());
|
|
469
|
-
return interval <= other;
|
|
470
|
-
}
|
|
471
|
-
|
|
472
|
-
|
|
473
|
-
// address visit funcs
|
|
474
|
-
std::pair<AddressValue::AddrSet::iterator, bool> insertAddr(u32_t id) // insertAddr
|
|
475
|
-
{
|
|
476
|
-
assert(isAddr());
|
|
477
|
-
return addr.insert(id);
|
|
478
|
-
}
|
|
479
|
-
|
|
480
|
-
// TODO: equals, join_with, meet_with, widen_with, narrow_with, toString,
|
|
481
|
-
// These should be merged with AddressValue
|
|
200
|
+
~AbstractValue() {};
|
|
482
201
|
|
|
483
202
|
bool equals(const AbstractValue &rhs) const
|
|
484
203
|
{
|
|
@@ -264,9 +264,9 @@ protected:
|
|
|
264
264
|
* e.g. source code str = "abc", return 3
|
|
265
265
|
*
|
|
266
266
|
* @param strValue SVFValue of string
|
|
267
|
-
* @return
|
|
267
|
+
* @return IntervalValue of string length
|
|
268
268
|
*/
|
|
269
|
-
|
|
269
|
+
IntervalValue getStrlen(AbstractState& as, const SVF::SVFValue *strValue);
|
|
270
270
|
|
|
271
271
|
/**
|
|
272
272
|
* get memory allocation size
|
|
@@ -275,9 +275,9 @@ protected:
|
|
|
275
275
|
* memset(arr, 1, 10* sizeof(int))
|
|
276
276
|
* when we trace the 'arr', we can get the alloc size [40, 40]
|
|
277
277
|
* @param value to be traced
|
|
278
|
-
* @return
|
|
278
|
+
* @return IntervalValue of allocation size
|
|
279
279
|
*/
|
|
280
|
-
|
|
280
|
+
IntervalValue traceMemoryAllocationSize(AbstractState& as, const SVFValue *value);
|
|
281
281
|
/**
|
|
282
282
|
* execute strcpy in abstract execution
|
|
283
283
|
* e.g arr = new char[10]
|
|
@@ -304,7 +304,7 @@ protected:
|
|
|
304
304
|
* we can set arr[3]='d', arr[4]='e', arr[5]='\0'
|
|
305
305
|
* @param call callnode of memcpy like api
|
|
306
306
|
*/
|
|
307
|
-
virtual void handleMemcpy(AbstractState& as, const SVFValue* dst, const SVFValue* src,
|
|
307
|
+
virtual void handleMemcpy(AbstractState& as, const SVFValue* dst, const SVFValue* src, IntervalValue len, u32_t start_idx);
|
|
308
308
|
/**
|
|
309
309
|
* execute memset in abstract execution
|
|
310
310
|
* e.g arr = new char[10]
|
|
@@ -312,7 +312,7 @@ protected:
|
|
|
312
312
|
* we can set arr[0]='c', arr[1]='c', arr[2]='\0'
|
|
313
313
|
* @param call callnode of memset like api
|
|
314
314
|
*/
|
|
315
|
-
virtual void handleMemset(AbstractState& as, const SVFValue* dst,
|
|
315
|
+
virtual void handleMemset(AbstractState& as, const SVFValue* dst, IntervalValue elem, IntervalValue len);
|
|
316
316
|
|
|
317
317
|
/**
|
|
318
318
|
* if this NodeID in SVFIR is a pointer, get the pointee type
|
|
@@ -164,7 +164,7 @@ protected:
|
|
|
164
164
|
* @param len the length of the buffer overflow checkpoint
|
|
165
165
|
* @return true if the buffer overflow is detected
|
|
166
166
|
*/
|
|
167
|
-
bool canSafelyAccessMemory(const SVFValue *value, const
|
|
167
|
+
bool canSafelyAccessMemory(const SVFValue *value, const IntervalValue &len, const ICFGNode *curNode);
|
|
168
168
|
|
|
169
169
|
private:
|
|
170
170
|
/**
|
|
@@ -81,10 +81,10 @@ public:
|
|
|
81
81
|
/// e.g. GepStmt* gep = [i32*10], x, and x is [0,3]
|
|
82
82
|
/// std::pair<s32_t, s32_t> byteOffset = getByteOffset(gep);
|
|
83
83
|
/// byteOffset should be [0, 12] since i32 is 4 bytes.
|
|
84
|
-
|
|
84
|
+
IntervalValue getByteOffset(const AbstractState& es, const GepStmt *gep);
|
|
85
85
|
|
|
86
86
|
/// Return the offset expression of a GepStmt
|
|
87
|
-
|
|
87
|
+
IntervalValue getElementIndex(const AbstractState& es, const GepStmt *gep);
|
|
88
88
|
|
|
89
89
|
|
|
90
90
|
static z3::context &getContext()
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
Binary file
|
|
@@ -168,317 +168,36 @@ public:
|
|
|
168
168
|
AbstractValue(const IntervalValue& ival) : type(IntervalType), interval(ival) {}
|
|
169
169
|
|
|
170
170
|
AbstractValue(const AddressValue& addr) : type(AddressType), addr(addr) {}
|
|
171
|
-
|
|
171
|
+
|
|
172
172
|
IntervalValue& getInterval()
|
|
173
173
|
{
|
|
174
174
|
if (isUnknown())
|
|
175
175
|
{
|
|
176
176
|
interval = IntervalValue::top();
|
|
177
177
|
}
|
|
178
|
-
assert(isInterval());
|
|
178
|
+
assert(isInterval() && "Attempting to retrieve an AbstractValue that is not an Interval!");
|
|
179
179
|
return interval;
|
|
180
180
|
}
|
|
181
181
|
|
|
182
|
-
//
|
|
183
182
|
const IntervalValue getInterval() const
|
|
184
183
|
{
|
|
185
|
-
assert(isInterval());
|
|
184
|
+
assert(isInterval() && "Attempting to retrieve an AbstractValue that is not an Interval!");
|
|
186
185
|
return interval;
|
|
187
186
|
}
|
|
188
187
|
|
|
189
188
|
AddressValue& getAddrs()
|
|
190
189
|
{
|
|
191
|
-
assert(isAddr());
|
|
190
|
+
assert(isAddr() && "Attempting to retrieve an AbstractValue that is not an Address!");
|
|
192
191
|
return addr;
|
|
193
192
|
}
|
|
194
193
|
|
|
195
194
|
const AddressValue getAddrs() const
|
|
196
195
|
{
|
|
197
|
-
assert(isAddr());
|
|
196
|
+
assert(isAddr() && "Attempting to retrieve an AbstractValue that is not an Address!");
|
|
198
197
|
return addr;
|
|
199
198
|
}
|
|
200
|
-
~AbstractValue() {};
|
|
201
|
-
|
|
202
|
-
|
|
203
|
-
// interval visit funcs
|
|
204
|
-
bool isTop() const
|
|
205
|
-
{
|
|
206
|
-
assert(isInterval());
|
|
207
|
-
return interval.isTop();
|
|
208
|
-
}
|
|
209
|
-
|
|
210
|
-
bool isBottom() const
|
|
211
|
-
{
|
|
212
|
-
assert(isInterval());
|
|
213
|
-
return interval.isBottom();
|
|
214
|
-
}
|
|
215
|
-
|
|
216
|
-
const BoundedInt& lb() const
|
|
217
|
-
{
|
|
218
|
-
assert(isInterval());
|
|
219
|
-
return interval.lb();
|
|
220
|
-
}
|
|
221
|
-
|
|
222
|
-
const BoundedInt& ub() const
|
|
223
|
-
{
|
|
224
|
-
assert(isInterval());
|
|
225
|
-
return interval.ub();
|
|
226
|
-
}
|
|
227
|
-
|
|
228
|
-
void setLb(const BoundedInt& lb)
|
|
229
|
-
{
|
|
230
|
-
assert(isInterval());
|
|
231
|
-
interval.setLb(lb);
|
|
232
|
-
}
|
|
233
|
-
|
|
234
|
-
void setUb(const BoundedInt& ub)
|
|
235
|
-
{
|
|
236
|
-
assert(isInterval());
|
|
237
|
-
interval.setUb(ub);
|
|
238
|
-
}
|
|
239
|
-
|
|
240
|
-
void setValue(const BoundedInt &lb, const BoundedInt &ub)
|
|
241
|
-
{
|
|
242
|
-
assert(isInterval());
|
|
243
|
-
interval.setValue(lb, ub);
|
|
244
|
-
}
|
|
245
|
-
|
|
246
|
-
bool is_zero() const
|
|
247
|
-
{
|
|
248
|
-
assert(isInterval());
|
|
249
|
-
return interval.is_zero();
|
|
250
|
-
}
|
|
251
|
-
|
|
252
|
-
bool is_infinite() const
|
|
253
|
-
{
|
|
254
|
-
assert(isInterval());
|
|
255
|
-
return interval.is_infinite();
|
|
256
|
-
}
|
|
257
|
-
|
|
258
|
-
bool is_int() const
|
|
259
|
-
{
|
|
260
|
-
assert(isInterval());
|
|
261
|
-
return interval.is_int();
|
|
262
|
-
}
|
|
263
|
-
|
|
264
|
-
bool is_real() const
|
|
265
|
-
{
|
|
266
|
-
assert(isInterval());
|
|
267
|
-
return interval.is_real();
|
|
268
|
-
}
|
|
269
|
-
|
|
270
|
-
s64_t getIntNumeral() const
|
|
271
|
-
{
|
|
272
|
-
assert(isInterval());
|
|
273
|
-
return interval.getIntNumeral();
|
|
274
|
-
}
|
|
275
|
-
|
|
276
|
-
double getRealNumeral() const
|
|
277
|
-
{
|
|
278
|
-
assert(isInterval());
|
|
279
|
-
return interval.getRealNumeral();
|
|
280
|
-
}
|
|
281
|
-
|
|
282
|
-
bool is_numeral() const
|
|
283
|
-
{
|
|
284
|
-
assert(isInterval());
|
|
285
|
-
return interval.is_numeral();
|
|
286
|
-
}
|
|
287
|
-
|
|
288
|
-
void set_to_bottom()
|
|
289
|
-
{
|
|
290
|
-
assert(isInterval());
|
|
291
|
-
interval.set_to_bottom();
|
|
292
|
-
}
|
|
293
|
-
|
|
294
|
-
void set_to_top()
|
|
295
|
-
{
|
|
296
|
-
assert(isInterval());
|
|
297
|
-
interval.set_to_top();
|
|
298
|
-
}
|
|
299
199
|
|
|
300
|
-
|
|
301
|
-
{
|
|
302
|
-
assert(isInterval() && other.isInterval());
|
|
303
|
-
return interval.leq(other.interval);
|
|
304
|
-
}
|
|
305
|
-
|
|
306
|
-
bool geq(const AbstractValue &other) const
|
|
307
|
-
{
|
|
308
|
-
assert(isInterval() && other.isInterval());
|
|
309
|
-
return interval.geq(other.interval);
|
|
310
|
-
}
|
|
311
|
-
|
|
312
|
-
bool contains(s64_t n) const
|
|
313
|
-
{
|
|
314
|
-
assert(isInterval());
|
|
315
|
-
return interval.contains(n);
|
|
316
|
-
}
|
|
317
|
-
// operator +-*/%>< >= <= << >> & | ^
|
|
318
|
-
AbstractValue operator+(const AbstractValue &other) const
|
|
319
|
-
{
|
|
320
|
-
assert(isInterval() && other.isInterval());
|
|
321
|
-
return interval + other.interval;
|
|
322
|
-
}
|
|
323
|
-
AbstractValue operator+(const IntervalValue &other) const
|
|
324
|
-
{
|
|
325
|
-
assert(isInterval());
|
|
326
|
-
return interval + other;
|
|
327
|
-
}
|
|
328
|
-
|
|
329
|
-
AbstractValue operator-(const AbstractValue &other) const
|
|
330
|
-
{
|
|
331
|
-
assert(isInterval() && other.isInterval());
|
|
332
|
-
return interval - other.interval;
|
|
333
|
-
}
|
|
334
|
-
AbstractValue operator-(const IntervalValue &other) const
|
|
335
|
-
{
|
|
336
|
-
assert(isInterval());
|
|
337
|
-
return interval - other;
|
|
338
|
-
}
|
|
339
|
-
|
|
340
|
-
AbstractValue operator*(const AbstractValue &other) const
|
|
341
|
-
{
|
|
342
|
-
assert(isInterval() && other.isInterval());
|
|
343
|
-
return interval * other.interval;
|
|
344
|
-
}
|
|
345
|
-
AbstractValue operator*(const IntervalValue &other) const
|
|
346
|
-
{
|
|
347
|
-
assert(isInterval());
|
|
348
|
-
return interval * other;
|
|
349
|
-
}
|
|
350
|
-
|
|
351
|
-
AbstractValue operator/(const AbstractValue &other) const
|
|
352
|
-
{
|
|
353
|
-
assert(isInterval() && other.isInterval());
|
|
354
|
-
return interval / other.interval;
|
|
355
|
-
}
|
|
356
|
-
AbstractValue operator/(const IntervalValue &other) const
|
|
357
|
-
{
|
|
358
|
-
assert(isInterval());
|
|
359
|
-
return interval / other;
|
|
360
|
-
}
|
|
361
|
-
|
|
362
|
-
AbstractValue operator%(const AbstractValue &other) const
|
|
363
|
-
{
|
|
364
|
-
assert(isInterval() && other.isInterval());
|
|
365
|
-
return interval % other.interval;
|
|
366
|
-
}
|
|
367
|
-
AbstractValue operator%(const IntervalValue &other) const
|
|
368
|
-
{
|
|
369
|
-
assert(isInterval());
|
|
370
|
-
return interval % other;
|
|
371
|
-
}
|
|
372
|
-
|
|
373
|
-
AbstractValue operator>>(const AbstractValue &other) const
|
|
374
|
-
{
|
|
375
|
-
assert(isInterval() && other.isInterval());
|
|
376
|
-
return interval >> other.interval;
|
|
377
|
-
}
|
|
378
|
-
AbstractValue operator>>(const IntervalValue &other) const
|
|
379
|
-
{
|
|
380
|
-
assert(isInterval());
|
|
381
|
-
return interval >> other;
|
|
382
|
-
}
|
|
383
|
-
|
|
384
|
-
AbstractValue operator<<(const AbstractValue &other) const
|
|
385
|
-
{
|
|
386
|
-
assert(isInterval() && other.isInterval());
|
|
387
|
-
return interval << other.interval;
|
|
388
|
-
}
|
|
389
|
-
AbstractValue operator<<(const IntervalValue &other) const
|
|
390
|
-
{
|
|
391
|
-
assert(isInterval());
|
|
392
|
-
return interval << other;
|
|
393
|
-
}
|
|
394
|
-
|
|
395
|
-
AbstractValue operator&(const AbstractValue &other) const
|
|
396
|
-
{
|
|
397
|
-
assert(isInterval() && other.isInterval());
|
|
398
|
-
return interval & other.interval;
|
|
399
|
-
}
|
|
400
|
-
AbstractValue operator&(const IntervalValue &other) const
|
|
401
|
-
{
|
|
402
|
-
assert(isInterval());
|
|
403
|
-
return interval & other;
|
|
404
|
-
}
|
|
405
|
-
|
|
406
|
-
AbstractValue operator|(const AbstractValue &other) const
|
|
407
|
-
{
|
|
408
|
-
assert(isInterval() && other.isInterval());
|
|
409
|
-
return interval | other.interval;
|
|
410
|
-
}
|
|
411
|
-
AbstractValue operator|(const IntervalValue &other) const
|
|
412
|
-
{
|
|
413
|
-
assert(isInterval());
|
|
414
|
-
return interval | other;
|
|
415
|
-
}
|
|
416
|
-
|
|
417
|
-
AbstractValue operator^(const AbstractValue &other) const
|
|
418
|
-
{
|
|
419
|
-
assert(isInterval() && other.isInterval());
|
|
420
|
-
return interval ^ other.interval;
|
|
421
|
-
}
|
|
422
|
-
AbstractValue operator^(const IntervalValue &other) const
|
|
423
|
-
{
|
|
424
|
-
assert(isInterval());
|
|
425
|
-
return interval ^ other;
|
|
426
|
-
}
|
|
427
|
-
|
|
428
|
-
AbstractValue operator>(const AbstractValue &other) const
|
|
429
|
-
{
|
|
430
|
-
assert(isInterval() && other.isInterval());
|
|
431
|
-
return interval > other.interval;
|
|
432
|
-
}
|
|
433
|
-
AbstractValue operator>(const IntervalValue &other) const
|
|
434
|
-
{
|
|
435
|
-
assert(isInterval());
|
|
436
|
-
return interval > other;
|
|
437
|
-
}
|
|
438
|
-
|
|
439
|
-
AbstractValue operator<(const AbstractValue &other) const
|
|
440
|
-
{
|
|
441
|
-
assert(isInterval() && other.isInterval());
|
|
442
|
-
return interval < other.interval;
|
|
443
|
-
}
|
|
444
|
-
AbstractValue operator<(const IntervalValue &other) const
|
|
445
|
-
{
|
|
446
|
-
assert(isInterval());
|
|
447
|
-
return interval < other;
|
|
448
|
-
}
|
|
449
|
-
|
|
450
|
-
AbstractValue operator>=(const AbstractValue &other) const
|
|
451
|
-
{
|
|
452
|
-
assert(isInterval() && other.isInterval());
|
|
453
|
-
return interval >= other.interval;
|
|
454
|
-
}
|
|
455
|
-
AbstractValue operator>=(const IntervalValue &other) const
|
|
456
|
-
{
|
|
457
|
-
assert(isInterval());
|
|
458
|
-
return interval >= other;
|
|
459
|
-
}
|
|
460
|
-
|
|
461
|
-
AbstractValue operator<=(const AbstractValue &other) const
|
|
462
|
-
{
|
|
463
|
-
assert(isInterval() && other.isInterval());
|
|
464
|
-
return interval <= other.interval;
|
|
465
|
-
}
|
|
466
|
-
AbstractValue operator<=(const IntervalValue &other) const
|
|
467
|
-
{
|
|
468
|
-
assert(isInterval());
|
|
469
|
-
return interval <= other;
|
|
470
|
-
}
|
|
471
|
-
|
|
472
|
-
|
|
473
|
-
// address visit funcs
|
|
474
|
-
std::pair<AddressValue::AddrSet::iterator, bool> insertAddr(u32_t id) // insertAddr
|
|
475
|
-
{
|
|
476
|
-
assert(isAddr());
|
|
477
|
-
return addr.insert(id);
|
|
478
|
-
}
|
|
479
|
-
|
|
480
|
-
// TODO: equals, join_with, meet_with, widen_with, narrow_with, toString,
|
|
481
|
-
// These should be merged with AddressValue
|
|
200
|
+
~AbstractValue() {};
|
|
482
201
|
|
|
483
202
|
bool equals(const AbstractValue &rhs) const
|
|
484
203
|
{
|
|
@@ -264,9 +264,9 @@ protected:
|
|
|
264
264
|
* e.g. source code str = "abc", return 3
|
|
265
265
|
*
|
|
266
266
|
* @param strValue SVFValue of string
|
|
267
|
-
* @return
|
|
267
|
+
* @return IntervalValue of string length
|
|
268
268
|
*/
|
|
269
|
-
|
|
269
|
+
IntervalValue getStrlen(AbstractState& as, const SVF::SVFValue *strValue);
|
|
270
270
|
|
|
271
271
|
/**
|
|
272
272
|
* get memory allocation size
|
|
@@ -275,9 +275,9 @@ protected:
|
|
|
275
275
|
* memset(arr, 1, 10* sizeof(int))
|
|
276
276
|
* when we trace the 'arr', we can get the alloc size [40, 40]
|
|
277
277
|
* @param value to be traced
|
|
278
|
-
* @return
|
|
278
|
+
* @return IntervalValue of allocation size
|
|
279
279
|
*/
|
|
280
|
-
|
|
280
|
+
IntervalValue traceMemoryAllocationSize(AbstractState& as, const SVFValue *value);
|
|
281
281
|
/**
|
|
282
282
|
* execute strcpy in abstract execution
|
|
283
283
|
* e.g arr = new char[10]
|
|
@@ -304,7 +304,7 @@ protected:
|
|
|
304
304
|
* we can set arr[3]='d', arr[4]='e', arr[5]='\0'
|
|
305
305
|
* @param call callnode of memcpy like api
|
|
306
306
|
*/
|
|
307
|
-
virtual void handleMemcpy(AbstractState& as, const SVFValue* dst, const SVFValue* src,
|
|
307
|
+
virtual void handleMemcpy(AbstractState& as, const SVFValue* dst, const SVFValue* src, IntervalValue len, u32_t start_idx);
|
|
308
308
|
/**
|
|
309
309
|
* execute memset in abstract execution
|
|
310
310
|
* e.g arr = new char[10]
|
|
@@ -312,7 +312,7 @@ protected:
|
|
|
312
312
|
* we can set arr[0]='c', arr[1]='c', arr[2]='\0'
|
|
313
313
|
* @param call callnode of memset like api
|
|
314
314
|
*/
|
|
315
|
-
virtual void handleMemset(AbstractState& as, const SVFValue* dst,
|
|
315
|
+
virtual void handleMemset(AbstractState& as, const SVFValue* dst, IntervalValue elem, IntervalValue len);
|
|
316
316
|
|
|
317
317
|
/**
|
|
318
318
|
* if this NodeID in SVFIR is a pointer, get the pointee type
|
|
@@ -164,7 +164,7 @@ protected:
|
|
|
164
164
|
* @param len the length of the buffer overflow checkpoint
|
|
165
165
|
* @return true if the buffer overflow is detected
|
|
166
166
|
*/
|
|
167
|
-
bool canSafelyAccessMemory(const SVFValue *value, const
|
|
167
|
+
bool canSafelyAccessMemory(const SVFValue *value, const IntervalValue &len, const ICFGNode *curNode);
|
|
168
168
|
|
|
169
169
|
private:
|
|
170
170
|
/**
|
|
@@ -81,10 +81,10 @@ public:
|
|
|
81
81
|
/// e.g. GepStmt* gep = [i32*10], x, and x is [0,3]
|
|
82
82
|
/// std::pair<s32_t, s32_t> byteOffset = getByteOffset(gep);
|
|
83
83
|
/// byteOffset should be [0, 12] since i32 is 4 bytes.
|
|
84
|
-
|
|
84
|
+
IntervalValue getByteOffset(const AbstractState& es, const GepStmt *gep);
|
|
85
85
|
|
|
86
86
|
/// Return the offset expression of a GepStmt
|
|
87
|
-
|
|
87
|
+
IntervalValue getElementIndex(const AbstractState& es, const GepStmt *gep);
|
|
88
88
|
|
|
89
89
|
|
|
90
90
|
static z3::context &getContext()
|
|
Binary file
|
|
Binary file
|