svf-lib 1.0.2083 → 1.0.2085
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/SVF-linux/Release-build/bin/ae +0 -0
- package/SVF-linux/Release-build/include/AE/Core/AbstractState.h +10 -8
- package/SVF-linux/Release-build/include/AE/Svfexe/AEDetector.h +322 -0
- package/SVF-linux/Release-build/include/AE/Svfexe/AbstractInterpretation.h +30 -66
- package/SVF-linux/Release-build/lib/libSvfCore.a +0 -0
- package/SVF-osx/Release-build/bin/ae +0 -0
- package/SVF-osx/Release-build/include/AE/Core/AbstractState.h +10 -8
- package/SVF-osx/Release-build/include/AE/Svfexe/AEDetector.h +322 -0
- package/SVF-osx/Release-build/include/AE/Svfexe/AbstractInterpretation.h +30 -66
- package/SVF-osx/Release-build/lib/libSvfCore.a +0 -0
- package/SVF-osx/Release-build/lib/libSvfLLVM.a +0 -0
- package/package.json +1 -1
- package/SVF-linux/Release-build/include/AE/Svfexe/BufOverflowChecker.h +0 -216
- package/SVF-linux/Release-build/include/AE/Svfexe/ICFGSimplification.h +0 -44
- package/SVF-osx/Release-build/include/AE/Svfexe/BufOverflowChecker.h +0 -216
- package/SVF-osx/Release-build/include/AE/Svfexe/ICFGSimplification.h +0 -44
|
@@ -1,216 +0,0 @@
|
|
|
1
|
-
//===- BufOverflowChecker.cpp -- BufOVerflowChecker Client for Abstract Execution---//
|
|
2
|
-
//
|
|
3
|
-
// SVF: Static Value-Flow Analysis
|
|
4
|
-
//
|
|
5
|
-
// Copyright (C) <2013-> <Yulei Sui>
|
|
6
|
-
//
|
|
7
|
-
|
|
8
|
-
// This program is free software: you can redistribute it and/or modify
|
|
9
|
-
// it under the terms of the GNU Affero General Public License as published by
|
|
10
|
-
// the Free Software Foundation, either version 3 of the License, or
|
|
11
|
-
// (at your option) any later version.
|
|
12
|
-
|
|
13
|
-
// This program is distributed in the hope that it will be useful,
|
|
14
|
-
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
15
|
-
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
16
|
-
// GNU Affero General Public License for more details.
|
|
17
|
-
|
|
18
|
-
// You should have received a copy of the GNU Affero General Public License
|
|
19
|
-
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
20
|
-
//
|
|
21
|
-
//===----------------------------------------------------------------------===//
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
//
|
|
25
|
-
// Created by Jiawei Wang on 2024/1/12.
|
|
26
|
-
// The implementation is based on
|
|
27
|
-
// Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
|
|
28
|
-
// 46th International Conference on Software Engineering. (ICSE24)
|
|
29
|
-
//
|
|
30
|
-
|
|
31
|
-
#include "AE/Svfexe/AbstractInterpretation.h"
|
|
32
|
-
|
|
33
|
-
namespace SVF
|
|
34
|
-
{
|
|
35
|
-
|
|
36
|
-
struct BufOverflowException: public std::exception
|
|
37
|
-
{
|
|
38
|
-
public:
|
|
39
|
-
BufOverflowException(std::string msg, u32_t allocLb,
|
|
40
|
-
u32_t allocUb, u32_t accessLb, u32_t accessUb, const SVFValue* allocVal) :
|
|
41
|
-
_msg(msg), _allocLb(allocLb), _allocUb(allocUb),
|
|
42
|
-
_accessLb(accessLb), _accessUb(accessUb), _allocVar(allocVal)
|
|
43
|
-
{
|
|
44
|
-
}
|
|
45
|
-
|
|
46
|
-
u32_t getAllocLb() const
|
|
47
|
-
{
|
|
48
|
-
return _allocLb;
|
|
49
|
-
}
|
|
50
|
-
|
|
51
|
-
void setAllocLb(u32_t allocLb)
|
|
52
|
-
{
|
|
53
|
-
_allocLb = allocLb;
|
|
54
|
-
}
|
|
55
|
-
|
|
56
|
-
u32_t getAllocUb() const
|
|
57
|
-
{
|
|
58
|
-
return _allocUb;
|
|
59
|
-
}
|
|
60
|
-
|
|
61
|
-
void setAllocUb(u32_t allocUb)
|
|
62
|
-
{
|
|
63
|
-
_allocUb = allocUb;
|
|
64
|
-
}
|
|
65
|
-
|
|
66
|
-
u32_t getAccessLb() const
|
|
67
|
-
{
|
|
68
|
-
return _accessLb;
|
|
69
|
-
}
|
|
70
|
-
|
|
71
|
-
void setAccessLb(u32_t accessLb)
|
|
72
|
-
{
|
|
73
|
-
_accessLb = accessLb;
|
|
74
|
-
}
|
|
75
|
-
|
|
76
|
-
u32_t getAccessUb() const
|
|
77
|
-
{
|
|
78
|
-
return _accessUb;
|
|
79
|
-
}
|
|
80
|
-
|
|
81
|
-
void setAccessUb(u32_t accessUb)
|
|
82
|
-
{
|
|
83
|
-
_accessUb = accessUb;
|
|
84
|
-
}
|
|
85
|
-
|
|
86
|
-
const SVFValue* getAllocVar() const
|
|
87
|
-
{
|
|
88
|
-
return _allocVar;
|
|
89
|
-
}
|
|
90
|
-
|
|
91
|
-
const char* what() const noexcept override
|
|
92
|
-
{
|
|
93
|
-
return _msg.c_str();
|
|
94
|
-
}
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
protected:
|
|
98
|
-
std::string _msg;
|
|
99
|
-
u32_t _allocLb, _allocUb, _accessLb, _accessUb;
|
|
100
|
-
const SVFValue* _allocVar;
|
|
101
|
-
};
|
|
102
|
-
|
|
103
|
-
class BufOverflowChecker: public AbstractInterpretation
|
|
104
|
-
{
|
|
105
|
-
public:
|
|
106
|
-
BufOverflowChecker() : AbstractInterpretation()
|
|
107
|
-
{
|
|
108
|
-
initExtFunMap();
|
|
109
|
-
_kind = AEKind::BufOverflowChecker;
|
|
110
|
-
initExtAPIBufOverflowCheckRules();
|
|
111
|
-
}
|
|
112
|
-
|
|
113
|
-
static bool classof(const AbstractInterpretation* ae)
|
|
114
|
-
{
|
|
115
|
-
return ae->getKind() == AEKind::BufOverflowChecker;
|
|
116
|
-
}
|
|
117
|
-
|
|
118
|
-
protected:
|
|
119
|
-
/**
|
|
120
|
-
* the map of external function to its API type
|
|
121
|
-
*
|
|
122
|
-
* it initialize the ext apis about buffer overflow checking
|
|
123
|
-
*/
|
|
124
|
-
virtual void initExtFunMap() override;
|
|
125
|
-
|
|
126
|
-
/**
|
|
127
|
-
* the map of ext apis of buffer overflow checking rules
|
|
128
|
-
*
|
|
129
|
-
* it initialize the rules of extapis about buffer overflow checking
|
|
130
|
-
* e.g. memcpy(dst, src, sz) -> we check allocSize(dst)>=sz and allocSize(src)>=sz
|
|
131
|
-
*/
|
|
132
|
-
void initExtAPIBufOverflowCheckRules();
|
|
133
|
-
|
|
134
|
-
/**
|
|
135
|
-
* handle external function call regarding buffer overflow checking
|
|
136
|
-
* e.g. memcpy(dst, src, sz) -> we check allocSize(dst)>=sz and allocSize(src)>=sz
|
|
137
|
-
*
|
|
138
|
-
* @param call call node whose callee is external function
|
|
139
|
-
*/
|
|
140
|
-
void handleExtAPI(const CallICFGNode *call) override;
|
|
141
|
-
/**
|
|
142
|
-
* detect buffer overflow from strcpy like apis
|
|
143
|
-
* e.g. strcpy(dst, src), if dst is shorter than src, we will throw buffer overflow
|
|
144
|
-
*
|
|
145
|
-
* @param call call node whose callee is strcpy-like external function
|
|
146
|
-
* @return true if the buffer overflow is detected
|
|
147
|
-
*/
|
|
148
|
-
bool detectStrcpy(const CallICFGNode *call);
|
|
149
|
-
/**
|
|
150
|
-
* detect buffer overflow from strcat like apis
|
|
151
|
-
* e.g. strcat(dst, src), if dst is shorter than src, we will throw buffer overflow
|
|
152
|
-
*
|
|
153
|
-
* @param call call node whose callee is strcpy-like external function
|
|
154
|
-
* @return true if the buffer overflow is detected
|
|
155
|
-
*/
|
|
156
|
-
bool detectStrcat(const CallICFGNode *call);
|
|
157
|
-
|
|
158
|
-
/**
|
|
159
|
-
* detect buffer overflow by giving a var and a length
|
|
160
|
-
* e.g. int x[10]; x[10] = 1;
|
|
161
|
-
* we call canSafelyAccessMemory(x, 11 * sizeof(int));
|
|
162
|
-
*
|
|
163
|
-
* @param value the value of the buffer overflow checkpoint
|
|
164
|
-
* @param len the length of the buffer overflow checkpoint
|
|
165
|
-
* @return true if the buffer overflow is detected
|
|
166
|
-
*/
|
|
167
|
-
bool canSafelyAccessMemory(const SVFValue *value, const IntervalValue &len, const ICFGNode *curNode);
|
|
168
|
-
|
|
169
|
-
private:
|
|
170
|
-
/**
|
|
171
|
-
* handle SVF statement regarding buffer overflow checking
|
|
172
|
-
*
|
|
173
|
-
* @param stmt SVF statement
|
|
174
|
-
*/
|
|
175
|
-
virtual void handleSVFStatement(const SVFStmt *stmt) override;
|
|
176
|
-
|
|
177
|
-
// TODO: will delete later
|
|
178
|
-
virtual void handleSingletonWTO(const ICFGSingletonWTO *icfgSingletonWto) override
|
|
179
|
-
{
|
|
180
|
-
AbstractInterpretation::handleSingletonWTO(icfgSingletonWto);
|
|
181
|
-
const ICFGNode* repNode = _icfg->getRepNode(icfgSingletonWto->getICFGNode());
|
|
182
|
-
if (_abstractTrace.count(repNode) == 0)
|
|
183
|
-
{
|
|
184
|
-
return;
|
|
185
|
-
}
|
|
186
|
-
const std::vector<const ICFGNode*>& worklist_vec = _icfg->getSubNodes(icfgSingletonWto->getICFGNode());
|
|
187
|
-
|
|
188
|
-
for (auto it = worklist_vec.begin(); it != worklist_vec.end(); ++it)
|
|
189
|
-
{
|
|
190
|
-
const ICFGNode* curNode = *it;
|
|
191
|
-
detectBufOverflow(curNode);
|
|
192
|
-
}
|
|
193
|
-
}
|
|
194
|
-
|
|
195
|
-
/**
|
|
196
|
-
* check buffer overflow at ICFGNode which is a checkpoint
|
|
197
|
-
*
|
|
198
|
-
* @param node ICFGNode
|
|
199
|
-
* @return true if the buffer overflow is detected
|
|
200
|
-
*/
|
|
201
|
-
bool detectBufOverflow(const ICFGNode *node);
|
|
202
|
-
|
|
203
|
-
/**
|
|
204
|
-
* add buffer overflow bug to recoder
|
|
205
|
-
*
|
|
206
|
-
* @param e the exception that is thrown by BufOverflowChecker
|
|
207
|
-
* @param node ICFGNode that causes the exception
|
|
208
|
-
*/
|
|
209
|
-
void addBugToRecoder(const BufOverflowException& e, const ICFGNode* node);
|
|
210
|
-
|
|
211
|
-
private:
|
|
212
|
-
Map<NodeID, const GepStmt*> _addrToGep;
|
|
213
|
-
Map<std::string, std::vector<std::pair<u32_t, u32_t>>> _extAPIBufOverflowCheckRules;
|
|
214
|
-
|
|
215
|
-
};
|
|
216
|
-
}
|
|
@@ -1,44 +0,0 @@
|
|
|
1
|
-
//===- ICFGSimplification.h -- Simplify ICFG----------------------------------//
|
|
2
|
-
//
|
|
3
|
-
// SVF: Static Value-Flow Analysis
|
|
4
|
-
//
|
|
5
|
-
// Copyright (C) <2013-> <Yulei Sui>
|
|
6
|
-
//
|
|
7
|
-
|
|
8
|
-
// This program is free software: you can redistribute it and/or modify
|
|
9
|
-
// it under the terms of the GNU Affero General Public License as published by
|
|
10
|
-
// the Free Software Foundation, either version 3 of the License, or
|
|
11
|
-
// (at your option) any later version.
|
|
12
|
-
|
|
13
|
-
// This program is distributed in the hope that it will be useful,
|
|
14
|
-
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
15
|
-
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
16
|
-
// GNU Affero General Public License for more details.
|
|
17
|
-
|
|
18
|
-
// You should have received a copy of the GNU Affero General Public License
|
|
19
|
-
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
20
|
-
//
|
|
21
|
-
//===----------------------------------------------------------------------===//
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
//
|
|
25
|
-
// Created by Jiawei Wang on 2024/2/25.
|
|
26
|
-
//
|
|
27
|
-
// The implementation is based on
|
|
28
|
-
// Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
|
|
29
|
-
// 46th International Conference on Software Engineering. (ICSE24)
|
|
30
|
-
#include "Graphs/ICFG.h"
|
|
31
|
-
|
|
32
|
-
namespace SVF
|
|
33
|
-
{
|
|
34
|
-
|
|
35
|
-
class ICFGSimplification
|
|
36
|
-
{
|
|
37
|
-
public:
|
|
38
|
-
ICFGSimplification() = default;
|
|
39
|
-
|
|
40
|
-
virtual ~ICFGSimplification() = default;
|
|
41
|
-
|
|
42
|
-
static void mergeAdjacentNodes(ICFG* icfg);
|
|
43
|
-
};
|
|
44
|
-
}
|
|
@@ -1,216 +0,0 @@
|
|
|
1
|
-
//===- BufOverflowChecker.cpp -- BufOVerflowChecker Client for Abstract Execution---//
|
|
2
|
-
//
|
|
3
|
-
// SVF: Static Value-Flow Analysis
|
|
4
|
-
//
|
|
5
|
-
// Copyright (C) <2013-> <Yulei Sui>
|
|
6
|
-
//
|
|
7
|
-
|
|
8
|
-
// This program is free software: you can redistribute it and/or modify
|
|
9
|
-
// it under the terms of the GNU Affero General Public License as published by
|
|
10
|
-
// the Free Software Foundation, either version 3 of the License, or
|
|
11
|
-
// (at your option) any later version.
|
|
12
|
-
|
|
13
|
-
// This program is distributed in the hope that it will be useful,
|
|
14
|
-
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
15
|
-
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
16
|
-
// GNU Affero General Public License for more details.
|
|
17
|
-
|
|
18
|
-
// You should have received a copy of the GNU Affero General Public License
|
|
19
|
-
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
20
|
-
//
|
|
21
|
-
//===----------------------------------------------------------------------===//
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
//
|
|
25
|
-
// Created by Jiawei Wang on 2024/1/12.
|
|
26
|
-
// The implementation is based on
|
|
27
|
-
// Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
|
|
28
|
-
// 46th International Conference on Software Engineering. (ICSE24)
|
|
29
|
-
//
|
|
30
|
-
|
|
31
|
-
#include "AE/Svfexe/AbstractInterpretation.h"
|
|
32
|
-
|
|
33
|
-
namespace SVF
|
|
34
|
-
{
|
|
35
|
-
|
|
36
|
-
struct BufOverflowException: public std::exception
|
|
37
|
-
{
|
|
38
|
-
public:
|
|
39
|
-
BufOverflowException(std::string msg, u32_t allocLb,
|
|
40
|
-
u32_t allocUb, u32_t accessLb, u32_t accessUb, const SVFValue* allocVal) :
|
|
41
|
-
_msg(msg), _allocLb(allocLb), _allocUb(allocUb),
|
|
42
|
-
_accessLb(accessLb), _accessUb(accessUb), _allocVar(allocVal)
|
|
43
|
-
{
|
|
44
|
-
}
|
|
45
|
-
|
|
46
|
-
u32_t getAllocLb() const
|
|
47
|
-
{
|
|
48
|
-
return _allocLb;
|
|
49
|
-
}
|
|
50
|
-
|
|
51
|
-
void setAllocLb(u32_t allocLb)
|
|
52
|
-
{
|
|
53
|
-
_allocLb = allocLb;
|
|
54
|
-
}
|
|
55
|
-
|
|
56
|
-
u32_t getAllocUb() const
|
|
57
|
-
{
|
|
58
|
-
return _allocUb;
|
|
59
|
-
}
|
|
60
|
-
|
|
61
|
-
void setAllocUb(u32_t allocUb)
|
|
62
|
-
{
|
|
63
|
-
_allocUb = allocUb;
|
|
64
|
-
}
|
|
65
|
-
|
|
66
|
-
u32_t getAccessLb() const
|
|
67
|
-
{
|
|
68
|
-
return _accessLb;
|
|
69
|
-
}
|
|
70
|
-
|
|
71
|
-
void setAccessLb(u32_t accessLb)
|
|
72
|
-
{
|
|
73
|
-
_accessLb = accessLb;
|
|
74
|
-
}
|
|
75
|
-
|
|
76
|
-
u32_t getAccessUb() const
|
|
77
|
-
{
|
|
78
|
-
return _accessUb;
|
|
79
|
-
}
|
|
80
|
-
|
|
81
|
-
void setAccessUb(u32_t accessUb)
|
|
82
|
-
{
|
|
83
|
-
_accessUb = accessUb;
|
|
84
|
-
}
|
|
85
|
-
|
|
86
|
-
const SVFValue* getAllocVar() const
|
|
87
|
-
{
|
|
88
|
-
return _allocVar;
|
|
89
|
-
}
|
|
90
|
-
|
|
91
|
-
const char* what() const noexcept override
|
|
92
|
-
{
|
|
93
|
-
return _msg.c_str();
|
|
94
|
-
}
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
protected:
|
|
98
|
-
std::string _msg;
|
|
99
|
-
u32_t _allocLb, _allocUb, _accessLb, _accessUb;
|
|
100
|
-
const SVFValue* _allocVar;
|
|
101
|
-
};
|
|
102
|
-
|
|
103
|
-
class BufOverflowChecker: public AbstractInterpretation
|
|
104
|
-
{
|
|
105
|
-
public:
|
|
106
|
-
BufOverflowChecker() : AbstractInterpretation()
|
|
107
|
-
{
|
|
108
|
-
initExtFunMap();
|
|
109
|
-
_kind = AEKind::BufOverflowChecker;
|
|
110
|
-
initExtAPIBufOverflowCheckRules();
|
|
111
|
-
}
|
|
112
|
-
|
|
113
|
-
static bool classof(const AbstractInterpretation* ae)
|
|
114
|
-
{
|
|
115
|
-
return ae->getKind() == AEKind::BufOverflowChecker;
|
|
116
|
-
}
|
|
117
|
-
|
|
118
|
-
protected:
|
|
119
|
-
/**
|
|
120
|
-
* the map of external function to its API type
|
|
121
|
-
*
|
|
122
|
-
* it initialize the ext apis about buffer overflow checking
|
|
123
|
-
*/
|
|
124
|
-
virtual void initExtFunMap() override;
|
|
125
|
-
|
|
126
|
-
/**
|
|
127
|
-
* the map of ext apis of buffer overflow checking rules
|
|
128
|
-
*
|
|
129
|
-
* it initialize the rules of extapis about buffer overflow checking
|
|
130
|
-
* e.g. memcpy(dst, src, sz) -> we check allocSize(dst)>=sz and allocSize(src)>=sz
|
|
131
|
-
*/
|
|
132
|
-
void initExtAPIBufOverflowCheckRules();
|
|
133
|
-
|
|
134
|
-
/**
|
|
135
|
-
* handle external function call regarding buffer overflow checking
|
|
136
|
-
* e.g. memcpy(dst, src, sz) -> we check allocSize(dst)>=sz and allocSize(src)>=sz
|
|
137
|
-
*
|
|
138
|
-
* @param call call node whose callee is external function
|
|
139
|
-
*/
|
|
140
|
-
void handleExtAPI(const CallICFGNode *call) override;
|
|
141
|
-
/**
|
|
142
|
-
* detect buffer overflow from strcpy like apis
|
|
143
|
-
* e.g. strcpy(dst, src), if dst is shorter than src, we will throw buffer overflow
|
|
144
|
-
*
|
|
145
|
-
* @param call call node whose callee is strcpy-like external function
|
|
146
|
-
* @return true if the buffer overflow is detected
|
|
147
|
-
*/
|
|
148
|
-
bool detectStrcpy(const CallICFGNode *call);
|
|
149
|
-
/**
|
|
150
|
-
* detect buffer overflow from strcat like apis
|
|
151
|
-
* e.g. strcat(dst, src), if dst is shorter than src, we will throw buffer overflow
|
|
152
|
-
*
|
|
153
|
-
* @param call call node whose callee is strcpy-like external function
|
|
154
|
-
* @return true if the buffer overflow is detected
|
|
155
|
-
*/
|
|
156
|
-
bool detectStrcat(const CallICFGNode *call);
|
|
157
|
-
|
|
158
|
-
/**
|
|
159
|
-
* detect buffer overflow by giving a var and a length
|
|
160
|
-
* e.g. int x[10]; x[10] = 1;
|
|
161
|
-
* we call canSafelyAccessMemory(x, 11 * sizeof(int));
|
|
162
|
-
*
|
|
163
|
-
* @param value the value of the buffer overflow checkpoint
|
|
164
|
-
* @param len the length of the buffer overflow checkpoint
|
|
165
|
-
* @return true if the buffer overflow is detected
|
|
166
|
-
*/
|
|
167
|
-
bool canSafelyAccessMemory(const SVFValue *value, const IntervalValue &len, const ICFGNode *curNode);
|
|
168
|
-
|
|
169
|
-
private:
|
|
170
|
-
/**
|
|
171
|
-
* handle SVF statement regarding buffer overflow checking
|
|
172
|
-
*
|
|
173
|
-
* @param stmt SVF statement
|
|
174
|
-
*/
|
|
175
|
-
virtual void handleSVFStatement(const SVFStmt *stmt) override;
|
|
176
|
-
|
|
177
|
-
// TODO: will delete later
|
|
178
|
-
virtual void handleSingletonWTO(const ICFGSingletonWTO *icfgSingletonWto) override
|
|
179
|
-
{
|
|
180
|
-
AbstractInterpretation::handleSingletonWTO(icfgSingletonWto);
|
|
181
|
-
const ICFGNode* repNode = _icfg->getRepNode(icfgSingletonWto->getICFGNode());
|
|
182
|
-
if (_abstractTrace.count(repNode) == 0)
|
|
183
|
-
{
|
|
184
|
-
return;
|
|
185
|
-
}
|
|
186
|
-
const std::vector<const ICFGNode*>& worklist_vec = _icfg->getSubNodes(icfgSingletonWto->getICFGNode());
|
|
187
|
-
|
|
188
|
-
for (auto it = worklist_vec.begin(); it != worklist_vec.end(); ++it)
|
|
189
|
-
{
|
|
190
|
-
const ICFGNode* curNode = *it;
|
|
191
|
-
detectBufOverflow(curNode);
|
|
192
|
-
}
|
|
193
|
-
}
|
|
194
|
-
|
|
195
|
-
/**
|
|
196
|
-
* check buffer overflow at ICFGNode which is a checkpoint
|
|
197
|
-
*
|
|
198
|
-
* @param node ICFGNode
|
|
199
|
-
* @return true if the buffer overflow is detected
|
|
200
|
-
*/
|
|
201
|
-
bool detectBufOverflow(const ICFGNode *node);
|
|
202
|
-
|
|
203
|
-
/**
|
|
204
|
-
* add buffer overflow bug to recoder
|
|
205
|
-
*
|
|
206
|
-
* @param e the exception that is thrown by BufOverflowChecker
|
|
207
|
-
* @param node ICFGNode that causes the exception
|
|
208
|
-
*/
|
|
209
|
-
void addBugToRecoder(const BufOverflowException& e, const ICFGNode* node);
|
|
210
|
-
|
|
211
|
-
private:
|
|
212
|
-
Map<NodeID, const GepStmt*> _addrToGep;
|
|
213
|
-
Map<std::string, std::vector<std::pair<u32_t, u32_t>>> _extAPIBufOverflowCheckRules;
|
|
214
|
-
|
|
215
|
-
};
|
|
216
|
-
}
|
|
@@ -1,44 +0,0 @@
|
|
|
1
|
-
//===- ICFGSimplification.h -- Simplify ICFG----------------------------------//
|
|
2
|
-
//
|
|
3
|
-
// SVF: Static Value-Flow Analysis
|
|
4
|
-
//
|
|
5
|
-
// Copyright (C) <2013-> <Yulei Sui>
|
|
6
|
-
//
|
|
7
|
-
|
|
8
|
-
// This program is free software: you can redistribute it and/or modify
|
|
9
|
-
// it under the terms of the GNU Affero General Public License as published by
|
|
10
|
-
// the Free Software Foundation, either version 3 of the License, or
|
|
11
|
-
// (at your option) any later version.
|
|
12
|
-
|
|
13
|
-
// This program is distributed in the hope that it will be useful,
|
|
14
|
-
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
15
|
-
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
16
|
-
// GNU Affero General Public License for more details.
|
|
17
|
-
|
|
18
|
-
// You should have received a copy of the GNU Affero General Public License
|
|
19
|
-
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
20
|
-
//
|
|
21
|
-
//===----------------------------------------------------------------------===//
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
//
|
|
25
|
-
// Created by Jiawei Wang on 2024/2/25.
|
|
26
|
-
//
|
|
27
|
-
// The implementation is based on
|
|
28
|
-
// Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
|
|
29
|
-
// 46th International Conference on Software Engineering. (ICSE24)
|
|
30
|
-
#include "Graphs/ICFG.h"
|
|
31
|
-
|
|
32
|
-
namespace SVF
|
|
33
|
-
{
|
|
34
|
-
|
|
35
|
-
class ICFGSimplification
|
|
36
|
-
{
|
|
37
|
-
public:
|
|
38
|
-
ICFGSimplification() = default;
|
|
39
|
-
|
|
40
|
-
virtual ~ICFGSimplification() = default;
|
|
41
|
-
|
|
42
|
-
static void mergeAdjacentNodes(ICFG* icfg);
|
|
43
|
-
};
|
|
44
|
-
}
|