svf-tools 1.0.658 → 1.0.659

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svf-tools",
-  "version": "1.0.658",
+  "version": "1.0.659",
   "description": "* <b>[TypeClone](https://github.com/SVF-tools/SVF/wiki/TypeClone) published in our [ECOOP paper](https://yuleisui.github.io/publications/ecoop20.pdf) is now available in SVF </b> * <b>SVF now uses a single script for its build. Just type [`source ./build.sh`](https://github.com/SVF-tools/SVF/blob/master/build.sh) in your terminal, that's it!</b> * <b>SVF now supports LLVM-10.0.0! </b> * <b>We thank [bsauce](https://github.com/bsauce) for writing a user manual of SVF ([link1](https://www.jianshu.com/p/068a08ec749c) and [link2](https://www.jianshu.com/p/777c30d4240e)) in Chinese </b> * <b>SVF now supports LLVM-9.0.0 (Thank [Byoungyoung Lee](https://github.com/SVF-tools/SVF/issues/142) for his help!). </b> * <b>SVF now supports a set of [field-sensitive pointer analyses](https://yuleisui.github.io/publications/sas2019a.pdf). </b> * <b>[Use SVF as an external lib](https://github.com/SVF-tools/SVF/wiki/Using-SVF-as-a-lib-in-your-own-tool) for your own project (Contributed by [Hongxu Chen](https://github.com/HongxuChen)). </b> * <b>SVF now supports LLVM-7.0.0. </b> * <b>SVF now supports Docker. [Try SVF in Docker](https://github.com/SVF-tools/SVF/wiki/Try-SVF-in-Docker)! </b> * <b>SVF now supports [LLVM-6.0.0](https://github.com/svf-tools/SVF/pull/38) (Contributed by [Jack Anthony](https://github.com/jackanth)). </b> * <b>SVF now supports [LLVM-4.0.0](https://github.com/svf-tools/SVF/pull/23) (Contributed by Jared Carlson. Thank [Jared](https://github.com/jcarlson23) and [Will](https://github.com/dtzWill) for their in-depth [discussions](https://github.com/svf-tools/SVF/pull/18) about updating SVF!) </b> * <b>SVF now supports analysis for C++ programs.</b> <br />",
   "main": "index.js",
   "scripts": {

package/svf/include/Util/Options.h

@@ -223,6 +223,9 @@ public:
     // SaberCondAllocator.cpp
     static const Option<bool> PrintPathCond;
 
+    // SaberSVFGBuilder.cpp
+    static const Option<bool> CollectExtRetGlobals;
+
     // SVFUtil.cpp
     static const Option<bool> DisableWarn;
 

package/svf/lib/SABER/SaberSVFGBuilder.cpp

@@ -31,6 +31,7 @@
 #include "SABER/SaberCheckerAPI.h"
 #include "MemoryModel/PointerAnalysisImpl.h"
 #include "Graphs/SVFG.h"
+#include "Util/Options.h"
 
 using namespace SVF;
 using namespace SVFUtil;
@@ -99,17 +100,48 @@ void SaberSVFGBuilder::collectGlobals(BVDataPTAImpl* pta)
     }
 }
 
-PointsTo& SaberSVFGBuilder::CollectPtsChain(BVDataPTAImpl* pta,NodeID id, NodeToPTSSMap& cachedPtsMap)
+
+/*
+ * https://github.com/SVF-tools/SVF/issues/991
+ *
+ * Originally, this function will collect all base pointers with all their fields
+ * inside the points-to set of global variables. But if a global variable points
+ * to the pointer returned by malloc() at some program points, then all pointers
+ * returned by malloc() will be included in the global set because of the
+ * context-insensitive pointer analysis results. This will make saber abandon
+ * too many slicing thus miss potential bugs.
+ *
+ * We add an option "saber-collect-extret-globals" to control whether this function
+ * will collect external functions' returned pointers. This option is true by default,
+ * making it to be false will let saber analyze more slicing but cause performance downgrade.
+ *
+ */
+PointsTo& SaberSVFGBuilder::CollectPtsChain(BVDataPTAImpl* pta, NodeID id, NodeToPTSSMap& cachedPtsMap)
 {
     SVFIR* pag = svfg->getPAG();
 
     NodeID baseId = pag->getBaseObjVar(id);
     NodeToPTSSMap::iterator it = cachedPtsMap.find(baseId);
     if(it!=cachedPtsMap.end())
+    {
         return it->second;
+    }
     else
     {
         PointsTo& pts = cachedPtsMap[baseId];
+        // base object
+        if (!Options::CollectExtRetGlobals())
+        {
+            if(pta->isFIObjNode(baseId) && pag->getGNode(baseId)->hasValue())
+            {
+                const SVFCallInst* inst = SVFUtil::dyn_cast<SVFCallInst>(pag->getGNode(baseId)->getValue());
+                if(inst && SVFUtil::isExtCall(inst))
+                {
+                    return pts;
+                }
+            }
+        }
+
         pts |= pag->getFieldsAfterCollapse(baseId);
 
         WorkList worklist;
@@ -127,7 +159,6 @@ PointsTo& SaberSVFGBuilder::CollectPtsChain(BVDataPTAImpl* pta,NodeID id, NodeTo
         }
         return pts;
     }
-
 }
 
 /*!

package/svf/lib/Util/Options.cpp

@@ -679,6 +679,14 @@ const Option<bool> Options::PrintPathCond(
 );
 
 
+// SaberSVFGBuilder.cpp
+const Option<bool> Options::CollectExtRetGlobals(
+    "saber-collect-extret-globals",
+    "Don't include pointers returned by external function during collecting globals",
+    true
+);
+
+
 // SVFUtil.cpp
 const Option<bool> Options::DisableWarn(
     "dwarn",