svf-lib 1.0.2499 → 1.0.2500
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/SVF-osx/bin/ae
CHANGED
|
Binary file
|
|
@@ -195,8 +195,7 @@ public:
|
|
|
195
195
|
|
|
196
196
|
protected:
|
|
197
197
|
VarToAbsValMap _varToAbsVal; ///< Map a variable (symbol) to its abstract value
|
|
198
|
-
AddrToAbsValMap
|
|
199
|
-
_addrToAbsVal; ///< Map a memory address to its stored abstract value
|
|
198
|
+
AddrToAbsValMap _addrToAbsVal; ///< Map a memory address to its stored abstract value
|
|
200
199
|
|
|
201
200
|
public:
|
|
202
201
|
|
|
@@ -106,7 +106,7 @@ public:
|
|
|
106
106
|
* @return Reference to the abstract state.
|
|
107
107
|
* @throws Assertion if no trace exists for the node.
|
|
108
108
|
*/
|
|
109
|
-
AbstractState&
|
|
109
|
+
AbstractState& getAbstractState(const ICFGNode* node);
|
|
110
110
|
|
|
111
111
|
void collectCheckPoint();
|
|
112
112
|
void checkPointAllSet();
|
|
@@ -109,128 +109,74 @@ public:
|
|
|
109
109
|
detectors.push_back(std::move(detector));
|
|
110
110
|
}
|
|
111
111
|
|
|
112
|
+
/// Retrieve the abstract state from the trace for a given ICFG node; asserts if no trace exists
|
|
113
|
+
AbstractState& getAbstractState(const ICFGNode* node);
|
|
112
114
|
|
|
115
|
+
/// Check if an abstract state exists in the trace for a given ICFG node
|
|
116
|
+
bool hasAbsStateFromTrace(const ICFGNode* node);
|
|
117
|
+
|
|
118
|
+
/// Retrieve abstract value for a top-level variable at a given ICFG node
|
|
119
|
+
AbstractValue& getAbstractValue(const ICFGNode* node, const ValVar* var);
|
|
120
|
+
|
|
121
|
+
/// Retrieve abstract value for an address-taken variable at a given ICFG node
|
|
122
|
+
AbstractValue& getAbstractValue(const ICFGNode* node, const ObjVar* var);
|
|
123
|
+
|
|
124
|
+
/// Retrieve abstract value for any SVF variable at a given ICFG node
|
|
125
|
+
AbstractValue& getAbstractValue(const ICFGNode* node, const SVFVar* var);
|
|
126
|
+
|
|
127
|
+
/// Retrieve abstract state filtered to specific top-level variables
|
|
128
|
+
void getAbstractState(const ICFGNode* node, const Set<const ValVar*>& vars, AbstractState& result);
|
|
129
|
+
|
|
130
|
+
/// Retrieve abstract state filtered to specific address-taken variables
|
|
131
|
+
void getAbstractState(const ICFGNode* node, const Set<const ObjVar*>& vars, AbstractState& result);
|
|
132
|
+
|
|
133
|
+
/// Retrieve abstract state filtered to specific SVF variables
|
|
134
|
+
void getAbstractState(const ICFGNode* node, const Set<const SVFVar*>& vars, AbstractState& result);
|
|
113
135
|
|
|
114
|
-
/**
|
|
115
|
-
* @brief Retrieves the abstract state from the trace for a given ICFG node.
|
|
116
|
-
* @param node Pointer to the ICFG node.
|
|
117
|
-
* @return Reference to the abstract state.
|
|
118
|
-
* @throws Assertion if no trace exists for the node.
|
|
119
|
-
*/
|
|
120
|
-
AbstractState& getAbsStateFromTrace(const ICFGNode* node)
|
|
121
|
-
{
|
|
122
|
-
if (abstractTrace.count(node) == 0)
|
|
123
|
-
{
|
|
124
|
-
assert(false && "No preAbsTrace for this node");
|
|
125
|
-
abort();
|
|
126
|
-
}
|
|
127
|
-
else
|
|
128
|
-
{
|
|
129
|
-
return abstractTrace[node];
|
|
130
|
-
}
|
|
131
|
-
}
|
|
132
136
|
|
|
133
137
|
private:
|
|
134
|
-
///
|
|
138
|
+
/// Initialize abstract state for the global ICFG node and process global statements
|
|
135
139
|
virtual void handleGlobalNode();
|
|
136
140
|
|
|
137
|
-
|
|
138
|
-
* Check if execution state exist by merging states of predecessor nodes
|
|
139
|
-
*
|
|
140
|
-
* @param icfgNode The icfg node to analyse
|
|
141
|
-
* @return if this node has preceding execution state
|
|
142
|
-
*/
|
|
141
|
+
/// Merge abstract states from predecessor nodes; return true if icfgNode has feasible incoming state
|
|
143
142
|
bool mergeStatesFromPredecessors(const ICFGNode * icfgNode);
|
|
144
143
|
|
|
145
|
-
|
|
146
|
-
* Check if execution state exist at the branch edge
|
|
147
|
-
*
|
|
148
|
-
* @param intraEdge the edge from CmpStmt to the next node
|
|
149
|
-
* @return if this edge is feasible
|
|
150
|
-
*/
|
|
144
|
+
/// Check if the branch on intraEdge is feasible under abstract state as
|
|
151
145
|
bool isBranchFeasible(const IntraCFGEdge* intraEdge, AbstractState& as);
|
|
152
146
|
|
|
153
|
-
|
|
154
|
-
* handle instructions in ICFGSingletonWTO
|
|
155
|
-
*
|
|
156
|
-
* @param block basic block that has one instruction or a series of instructions
|
|
157
|
-
*/
|
|
147
|
+
/// Process all SVF statements in a singleton WTO component (single basic block)
|
|
158
148
|
virtual void handleSingletonWTO(const ICFGSingletonWTO *icfgSingletonWto);
|
|
159
149
|
|
|
160
|
-
|
|
161
|
-
* handle call node in ICFGNode
|
|
162
|
-
*
|
|
163
|
-
* @param node ICFGNode which has a single CallICFGNode
|
|
164
|
-
*/
|
|
150
|
+
/// Handle a call site node: dispatch to ext-call, direct-call, or indirect-call handling
|
|
165
151
|
virtual void handleCallSite(const ICFGNode* node);
|
|
166
152
|
|
|
167
|
-
|
|
168
|
-
* handle wto cycle (loop)
|
|
169
|
-
*
|
|
170
|
-
* @param cycle WTOCycle which has weak topo order of basic blocks and nested cycles
|
|
171
|
-
*/
|
|
153
|
+
/// Handle a WTO cycle (loop or recursive function) using widening/narrowing iteration
|
|
172
154
|
virtual void handleLoopOrRecursion(const ICFGCycleWTO* cycle, const CallICFGNode* caller = nullptr);
|
|
173
155
|
|
|
174
|
-
|
|
175
|
-
* Handle a function using worklist algorithm
|
|
176
|
-
*
|
|
177
|
-
* @param funEntry The entry node of the function to handle
|
|
178
|
-
*/
|
|
156
|
+
/// Handle a function body via worklist-driven WTO traversal starting from funEntry
|
|
179
157
|
void handleFunction(const ICFGNode* funEntry, const CallICFGNode* caller = nullptr);
|
|
180
158
|
|
|
181
|
-
|
|
182
|
-
* Handle an ICFG node by merging states and processing statements
|
|
183
|
-
*
|
|
184
|
-
* @param node The ICFG node to handle
|
|
185
|
-
* @return true if state changed, false if fixpoint reached or infeasible
|
|
186
|
-
*/
|
|
159
|
+
/// Merge predecessor states, process statements and callsites; return true if state changed
|
|
187
160
|
bool handleICFGNode(const ICFGNode* node);
|
|
188
161
|
|
|
189
|
-
|
|
190
|
-
* Get the next nodes of a node within the same function
|
|
191
|
-
*
|
|
192
|
-
* @param node The node to get successors for
|
|
193
|
-
* @return Vector of successor nodes
|
|
194
|
-
*/
|
|
162
|
+
/// Get intra-procedural successor nodes (including call-to-ret shortcut) within the same function
|
|
195
163
|
std::vector<const ICFGNode*> getNextNodes(const ICFGNode* node) const;
|
|
196
164
|
|
|
197
|
-
|
|
198
|
-
* Get the next nodes outside a cycle
|
|
199
|
-
*
|
|
200
|
-
* @param cycle The cycle to get exit successors for
|
|
201
|
-
* @return Vector of successor nodes outside the cycle
|
|
202
|
-
*/
|
|
165
|
+
/// Get successor nodes that exit the given WTO cycle (skipping inner sub-cycles)
|
|
203
166
|
std::vector<const ICFGNode*> getNextNodesOfCycle(const ICFGCycleWTO* cycle) const;
|
|
204
167
|
|
|
205
|
-
|
|
206
|
-
* handle SVF Statement like CmpStmt, CallStmt, GepStmt, LoadStmt, StoreStmt, etc.
|
|
207
|
-
*
|
|
208
|
-
* @param stmt SVFStatement which is a value flow of instruction
|
|
209
|
-
*/
|
|
168
|
+
/// Dispatch an SVF statement (Addr/Binary/Cmp/Load/Store/Copy/Gep/Select/Phi/Call/Ret) to its handler
|
|
210
169
|
virtual void handleSVFStatement(const SVFStmt* stmt);
|
|
211
170
|
|
|
171
|
+
/// Set all store targets and return value to TOP for a recursive call node
|
|
212
172
|
virtual void setTopToObjInRecursion(const CallICFGNode* callnode);
|
|
213
173
|
|
|
214
|
-
|
|
215
|
-
/**
|
|
216
|
-
* Check if this cmpStmt and succ are satisfiable to the execution state.
|
|
217
|
-
*
|
|
218
|
-
* @param cmpStmt CmpStmt is a conditional branch statement
|
|
219
|
-
* @param succ the value of cmpStmt (True or False)
|
|
220
|
-
* @return if this ICFGNode has preceding execution state
|
|
221
|
-
*/
|
|
174
|
+
/// Check if cmpStmt with successor value succ is feasible; refine intervals in as accordingly
|
|
222
175
|
bool isCmpBranchFeasible(const CmpStmt* cmpStmt, s64_t succ,
|
|
223
176
|
AbstractState& as);
|
|
224
177
|
|
|
225
|
-
|
|
226
|
-
|
|
227
|
-
*
|
|
228
|
-
* @param var var in switch inst
|
|
229
|
-
* @param succ the case value of switch inst
|
|
230
|
-
* @return if this ICFGNode has preceding execution state
|
|
231
|
-
*/
|
|
232
|
-
bool isSwitchBranchFeasible(const SVFVar* var, s64_t succ,
|
|
233
|
-
AbstractState& as);
|
|
178
|
+
/// Check if switch branch with case value succ is feasible; refine intervals in as accordingly
|
|
179
|
+
bool isSwitchBranchFeasible(const SVFVar* var, s64_t succ, AbstractState& as);
|
|
234
180
|
|
|
235
181
|
void updateStateOnAddr(const AddrStmt *addr);
|
|
236
182
|
|
|
@@ -266,12 +212,6 @@ private:
|
|
|
266
212
|
|
|
267
213
|
PreAnalysis* preAnalysis{nullptr};
|
|
268
214
|
|
|
269
|
-
|
|
270
|
-
bool hasAbsStateFromTrace(const ICFGNode* node)
|
|
271
|
-
{
|
|
272
|
-
return abstractTrace.count(node) != 0;
|
|
273
|
-
}
|
|
274
|
-
|
|
275
215
|
AbsExtAPI* getUtils()
|
|
276
216
|
{
|
|
277
217
|
return utils;
|
|
Binary file
|