svf-lib 1.0.2083 → 1.0.2085

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,216 +0,0 @@
1
- //===- BufOverflowChecker.cpp -- BufOVerflowChecker Client for Abstract Execution---//
2
- //
3
- // SVF: Static Value-Flow Analysis
4
- //
5
- // Copyright (C) <2013-> <Yulei Sui>
6
- //
7
-
8
- // This program is free software: you can redistribute it and/or modify
9
- // it under the terms of the GNU Affero General Public License as published by
10
- // the Free Software Foundation, either version 3 of the License, or
11
- // (at your option) any later version.
12
-
13
- // This program is distributed in the hope that it will be useful,
14
- // but WITHOUT ANY WARRANTY; without even the implied warranty of
15
- // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16
- // GNU Affero General Public License for more details.
17
-
18
- // You should have received a copy of the GNU Affero General Public License
19
- // along with this program. If not, see <http://www.gnu.org/licenses/>.
20
- //
21
- //===----------------------------------------------------------------------===//
22
-
23
-
24
- //
25
- // Created by Jiawei Wang on 2024/1/12.
26
- // The implementation is based on
27
- // Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
28
- // 46th International Conference on Software Engineering. (ICSE24)
29
- //
30
-
31
- #include "AE/Svfexe/AbstractInterpretation.h"
32
-
33
- namespace SVF
34
- {
35
-
36
- struct BufOverflowException: public std::exception
37
- {
38
- public:
39
- BufOverflowException(std::string msg, u32_t allocLb,
40
- u32_t allocUb, u32_t accessLb, u32_t accessUb, const SVFValue* allocVal) :
41
- _msg(msg), _allocLb(allocLb), _allocUb(allocUb),
42
- _accessLb(accessLb), _accessUb(accessUb), _allocVar(allocVal)
43
- {
44
- }
45
-
46
- u32_t getAllocLb() const
47
- {
48
- return _allocLb;
49
- }
50
-
51
- void setAllocLb(u32_t allocLb)
52
- {
53
- _allocLb = allocLb;
54
- }
55
-
56
- u32_t getAllocUb() const
57
- {
58
- return _allocUb;
59
- }
60
-
61
- void setAllocUb(u32_t allocUb)
62
- {
63
- _allocUb = allocUb;
64
- }
65
-
66
- u32_t getAccessLb() const
67
- {
68
- return _accessLb;
69
- }
70
-
71
- void setAccessLb(u32_t accessLb)
72
- {
73
- _accessLb = accessLb;
74
- }
75
-
76
- u32_t getAccessUb() const
77
- {
78
- return _accessUb;
79
- }
80
-
81
- void setAccessUb(u32_t accessUb)
82
- {
83
- _accessUb = accessUb;
84
- }
85
-
86
- const SVFValue* getAllocVar() const
87
- {
88
- return _allocVar;
89
- }
90
-
91
- const char* what() const noexcept override
92
- {
93
- return _msg.c_str();
94
- }
95
-
96
-
97
- protected:
98
- std::string _msg;
99
- u32_t _allocLb, _allocUb, _accessLb, _accessUb;
100
- const SVFValue* _allocVar;
101
- };
102
-
103
- class BufOverflowChecker: public AbstractInterpretation
104
- {
105
- public:
106
- BufOverflowChecker() : AbstractInterpretation()
107
- {
108
- initExtFunMap();
109
- _kind = AEKind::BufOverflowChecker;
110
- initExtAPIBufOverflowCheckRules();
111
- }
112
-
113
- static bool classof(const AbstractInterpretation* ae)
114
- {
115
- return ae->getKind() == AEKind::BufOverflowChecker;
116
- }
117
-
118
- protected:
119
- /**
120
- * the map of external function to its API type
121
- *
122
- * it initialize the ext apis about buffer overflow checking
123
- */
124
- virtual void initExtFunMap() override;
125
-
126
- /**
127
- * the map of ext apis of buffer overflow checking rules
128
- *
129
- * it initialize the rules of extapis about buffer overflow checking
130
- * e.g. memcpy(dst, src, sz) -> we check allocSize(dst)>=sz and allocSize(src)>=sz
131
- */
132
- void initExtAPIBufOverflowCheckRules();
133
-
134
- /**
135
- * handle external function call regarding buffer overflow checking
136
- * e.g. memcpy(dst, src, sz) -> we check allocSize(dst)>=sz and allocSize(src)>=sz
137
- *
138
- * @param call call node whose callee is external function
139
- */
140
- void handleExtAPI(const CallICFGNode *call) override;
141
- /**
142
- * detect buffer overflow from strcpy like apis
143
- * e.g. strcpy(dst, src), if dst is shorter than src, we will throw buffer overflow
144
- *
145
- * @param call call node whose callee is strcpy-like external function
146
- * @return true if the buffer overflow is detected
147
- */
148
- bool detectStrcpy(const CallICFGNode *call);
149
- /**
150
- * detect buffer overflow from strcat like apis
151
- * e.g. strcat(dst, src), if dst is shorter than src, we will throw buffer overflow
152
- *
153
- * @param call call node whose callee is strcpy-like external function
154
- * @return true if the buffer overflow is detected
155
- */
156
- bool detectStrcat(const CallICFGNode *call);
157
-
158
- /**
159
- * detect buffer overflow by giving a var and a length
160
- * e.g. int x[10]; x[10] = 1;
161
- * we call canSafelyAccessMemory(x, 11 * sizeof(int));
162
- *
163
- * @param value the value of the buffer overflow checkpoint
164
- * @param len the length of the buffer overflow checkpoint
165
- * @return true if the buffer overflow is detected
166
- */
167
- bool canSafelyAccessMemory(const SVFValue *value, const IntervalValue &len, const ICFGNode *curNode);
168
-
169
- private:
170
- /**
171
- * handle SVF statement regarding buffer overflow checking
172
- *
173
- * @param stmt SVF statement
174
- */
175
- virtual void handleSVFStatement(const SVFStmt *stmt) override;
176
-
177
- // TODO: will delete later
178
- virtual void handleSingletonWTO(const ICFGSingletonWTO *icfgSingletonWto) override
179
- {
180
- AbstractInterpretation::handleSingletonWTO(icfgSingletonWto);
181
- const ICFGNode* repNode = _icfg->getRepNode(icfgSingletonWto->getICFGNode());
182
- if (_abstractTrace.count(repNode) == 0)
183
- {
184
- return;
185
- }
186
- const std::vector<const ICFGNode*>& worklist_vec = _icfg->getSubNodes(icfgSingletonWto->getICFGNode());
187
-
188
- for (auto it = worklist_vec.begin(); it != worklist_vec.end(); ++it)
189
- {
190
- const ICFGNode* curNode = *it;
191
- detectBufOverflow(curNode);
192
- }
193
- }
194
-
195
- /**
196
- * check buffer overflow at ICFGNode which is a checkpoint
197
- *
198
- * @param node ICFGNode
199
- * @return true if the buffer overflow is detected
200
- */
201
- bool detectBufOverflow(const ICFGNode *node);
202
-
203
- /**
204
- * add buffer overflow bug to recoder
205
- *
206
- * @param e the exception that is thrown by BufOverflowChecker
207
- * @param node ICFGNode that causes the exception
208
- */
209
- void addBugToRecoder(const BufOverflowException& e, const ICFGNode* node);
210
-
211
- private:
212
- Map<NodeID, const GepStmt*> _addrToGep;
213
- Map<std::string, std::vector<std::pair<u32_t, u32_t>>> _extAPIBufOverflowCheckRules;
214
-
215
- };
216
- }
@@ -1,44 +0,0 @@
1
- //===- ICFGSimplification.h -- Simplify ICFG----------------------------------//
2
- //
3
- // SVF: Static Value-Flow Analysis
4
- //
5
- // Copyright (C) <2013-> <Yulei Sui>
6
- //
7
-
8
- // This program is free software: you can redistribute it and/or modify
9
- // it under the terms of the GNU Affero General Public License as published by
10
- // the Free Software Foundation, either version 3 of the License, or
11
- // (at your option) any later version.
12
-
13
- // This program is distributed in the hope that it will be useful,
14
- // but WITHOUT ANY WARRANTY; without even the implied warranty of
15
- // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16
- // GNU Affero General Public License for more details.
17
-
18
- // You should have received a copy of the GNU Affero General Public License
19
- // along with this program. If not, see <http://www.gnu.org/licenses/>.
20
- //
21
- //===----------------------------------------------------------------------===//
22
-
23
-
24
- //
25
- // Created by Jiawei Wang on 2024/2/25.
26
- //
27
- // The implementation is based on
28
- // Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
29
- // 46th International Conference on Software Engineering. (ICSE24)
30
- #include "Graphs/ICFG.h"
31
-
32
- namespace SVF
33
- {
34
-
35
- class ICFGSimplification
36
- {
37
- public:
38
- ICFGSimplification() = default;
39
-
40
- virtual ~ICFGSimplification() = default;
41
-
42
- static void mergeAdjacentNodes(ICFG* icfg);
43
- };
44
- }
@@ -1,216 +0,0 @@
1
- //===- BufOverflowChecker.cpp -- BufOVerflowChecker Client for Abstract Execution---//
2
- //
3
- // SVF: Static Value-Flow Analysis
4
- //
5
- // Copyright (C) <2013-> <Yulei Sui>
6
- //
7
-
8
- // This program is free software: you can redistribute it and/or modify
9
- // it under the terms of the GNU Affero General Public License as published by
10
- // the Free Software Foundation, either version 3 of the License, or
11
- // (at your option) any later version.
12
-
13
- // This program is distributed in the hope that it will be useful,
14
- // but WITHOUT ANY WARRANTY; without even the implied warranty of
15
- // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16
- // GNU Affero General Public License for more details.
17
-
18
- // You should have received a copy of the GNU Affero General Public License
19
- // along with this program. If not, see <http://www.gnu.org/licenses/>.
20
- //
21
- //===----------------------------------------------------------------------===//
22
-
23
-
24
- //
25
- // Created by Jiawei Wang on 2024/1/12.
26
- // The implementation is based on
27
- // Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
28
- // 46th International Conference on Software Engineering. (ICSE24)
29
- //
30
-
31
- #include "AE/Svfexe/AbstractInterpretation.h"
32
-
33
- namespace SVF
34
- {
35
-
36
- struct BufOverflowException: public std::exception
37
- {
38
- public:
39
- BufOverflowException(std::string msg, u32_t allocLb,
40
- u32_t allocUb, u32_t accessLb, u32_t accessUb, const SVFValue* allocVal) :
41
- _msg(msg), _allocLb(allocLb), _allocUb(allocUb),
42
- _accessLb(accessLb), _accessUb(accessUb), _allocVar(allocVal)
43
- {
44
- }
45
-
46
- u32_t getAllocLb() const
47
- {
48
- return _allocLb;
49
- }
50
-
51
- void setAllocLb(u32_t allocLb)
52
- {
53
- _allocLb = allocLb;
54
- }
55
-
56
- u32_t getAllocUb() const
57
- {
58
- return _allocUb;
59
- }
60
-
61
- void setAllocUb(u32_t allocUb)
62
- {
63
- _allocUb = allocUb;
64
- }
65
-
66
- u32_t getAccessLb() const
67
- {
68
- return _accessLb;
69
- }
70
-
71
- void setAccessLb(u32_t accessLb)
72
- {
73
- _accessLb = accessLb;
74
- }
75
-
76
- u32_t getAccessUb() const
77
- {
78
- return _accessUb;
79
- }
80
-
81
- void setAccessUb(u32_t accessUb)
82
- {
83
- _accessUb = accessUb;
84
- }
85
-
86
- const SVFValue* getAllocVar() const
87
- {
88
- return _allocVar;
89
- }
90
-
91
- const char* what() const noexcept override
92
- {
93
- return _msg.c_str();
94
- }
95
-
96
-
97
- protected:
98
- std::string _msg;
99
- u32_t _allocLb, _allocUb, _accessLb, _accessUb;
100
- const SVFValue* _allocVar;
101
- };
102
-
103
- class BufOverflowChecker: public AbstractInterpretation
104
- {
105
- public:
106
- BufOverflowChecker() : AbstractInterpretation()
107
- {
108
- initExtFunMap();
109
- _kind = AEKind::BufOverflowChecker;
110
- initExtAPIBufOverflowCheckRules();
111
- }
112
-
113
- static bool classof(const AbstractInterpretation* ae)
114
- {
115
- return ae->getKind() == AEKind::BufOverflowChecker;
116
- }
117
-
118
- protected:
119
- /**
120
- * the map of external function to its API type
121
- *
122
- * it initialize the ext apis about buffer overflow checking
123
- */
124
- virtual void initExtFunMap() override;
125
-
126
- /**
127
- * the map of ext apis of buffer overflow checking rules
128
- *
129
- * it initialize the rules of extapis about buffer overflow checking
130
- * e.g. memcpy(dst, src, sz) -> we check allocSize(dst)>=sz and allocSize(src)>=sz
131
- */
132
- void initExtAPIBufOverflowCheckRules();
133
-
134
- /**
135
- * handle external function call regarding buffer overflow checking
136
- * e.g. memcpy(dst, src, sz) -> we check allocSize(dst)>=sz and allocSize(src)>=sz
137
- *
138
- * @param call call node whose callee is external function
139
- */
140
- void handleExtAPI(const CallICFGNode *call) override;
141
- /**
142
- * detect buffer overflow from strcpy like apis
143
- * e.g. strcpy(dst, src), if dst is shorter than src, we will throw buffer overflow
144
- *
145
- * @param call call node whose callee is strcpy-like external function
146
- * @return true if the buffer overflow is detected
147
- */
148
- bool detectStrcpy(const CallICFGNode *call);
149
- /**
150
- * detect buffer overflow from strcat like apis
151
- * e.g. strcat(dst, src), if dst is shorter than src, we will throw buffer overflow
152
- *
153
- * @param call call node whose callee is strcpy-like external function
154
- * @return true if the buffer overflow is detected
155
- */
156
- bool detectStrcat(const CallICFGNode *call);
157
-
158
- /**
159
- * detect buffer overflow by giving a var and a length
160
- * e.g. int x[10]; x[10] = 1;
161
- * we call canSafelyAccessMemory(x, 11 * sizeof(int));
162
- *
163
- * @param value the value of the buffer overflow checkpoint
164
- * @param len the length of the buffer overflow checkpoint
165
- * @return true if the buffer overflow is detected
166
- */
167
- bool canSafelyAccessMemory(const SVFValue *value, const IntervalValue &len, const ICFGNode *curNode);
168
-
169
- private:
170
- /**
171
- * handle SVF statement regarding buffer overflow checking
172
- *
173
- * @param stmt SVF statement
174
- */
175
- virtual void handleSVFStatement(const SVFStmt *stmt) override;
176
-
177
- // TODO: will delete later
178
- virtual void handleSingletonWTO(const ICFGSingletonWTO *icfgSingletonWto) override
179
- {
180
- AbstractInterpretation::handleSingletonWTO(icfgSingletonWto);
181
- const ICFGNode* repNode = _icfg->getRepNode(icfgSingletonWto->getICFGNode());
182
- if (_abstractTrace.count(repNode) == 0)
183
- {
184
- return;
185
- }
186
- const std::vector<const ICFGNode*>& worklist_vec = _icfg->getSubNodes(icfgSingletonWto->getICFGNode());
187
-
188
- for (auto it = worklist_vec.begin(); it != worklist_vec.end(); ++it)
189
- {
190
- const ICFGNode* curNode = *it;
191
- detectBufOverflow(curNode);
192
- }
193
- }
194
-
195
- /**
196
- * check buffer overflow at ICFGNode which is a checkpoint
197
- *
198
- * @param node ICFGNode
199
- * @return true if the buffer overflow is detected
200
- */
201
- bool detectBufOverflow(const ICFGNode *node);
202
-
203
- /**
204
- * add buffer overflow bug to recoder
205
- *
206
- * @param e the exception that is thrown by BufOverflowChecker
207
- * @param node ICFGNode that causes the exception
208
- */
209
- void addBugToRecoder(const BufOverflowException& e, const ICFGNode* node);
210
-
211
- private:
212
- Map<NodeID, const GepStmt*> _addrToGep;
213
- Map<std::string, std::vector<std::pair<u32_t, u32_t>>> _extAPIBufOverflowCheckRules;
214
-
215
- };
216
- }
@@ -1,44 +0,0 @@
1
- //===- ICFGSimplification.h -- Simplify ICFG----------------------------------//
2
- //
3
- // SVF: Static Value-Flow Analysis
4
- //
5
- // Copyright (C) <2013-> <Yulei Sui>
6
- //
7
-
8
- // This program is free software: you can redistribute it and/or modify
9
- // it under the terms of the GNU Affero General Public License as published by
10
- // the Free Software Foundation, either version 3 of the License, or
11
- // (at your option) any later version.
12
-
13
- // This program is distributed in the hope that it will be useful,
14
- // but WITHOUT ANY WARRANTY; without even the implied warranty of
15
- // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16
- // GNU Affero General Public License for more details.
17
-
18
- // You should have received a copy of the GNU Affero General Public License
19
- // along with this program. If not, see <http://www.gnu.org/licenses/>.
20
- //
21
- //===----------------------------------------------------------------------===//
22
-
23
-
24
- //
25
- // Created by Jiawei Wang on 2024/2/25.
26
- //
27
- // The implementation is based on
28
- // Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
29
- // 46th International Conference on Software Engineering. (ICSE24)
30
- #include "Graphs/ICFG.h"
31
-
32
- namespace SVF
33
- {
34
-
35
- class ICFGSimplification
36
- {
37
- public:
38
- ICFGSimplification() = default;
39
-
40
- virtual ~ICFGSimplification() = default;
41
-
42
- static void mergeAdjacentNodes(ICFG* icfg);
43
- };
44
- }