svf-tools 1.0.658 → 1.0.660

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svf-tools",
-  "version": "1.0.658",
+  "version": "1.0.660",
   "description": "* <b>[TypeClone](https://github.com/SVF-tools/SVF/wiki/TypeClone) published in our [ECOOP paper](https://yuleisui.github.io/publications/ecoop20.pdf) is now available in SVF </b> * <b>SVF now uses a single script for its build. Just type [`source ./build.sh`](https://github.com/SVF-tools/SVF/blob/master/build.sh) in your terminal, that's it!</b> * <b>SVF now supports LLVM-10.0.0! </b> * <b>We thank [bsauce](https://github.com/bsauce) for writing a user manual of SVF ([link1](https://www.jianshu.com/p/068a08ec749c) and [link2](https://www.jianshu.com/p/777c30d4240e)) in Chinese </b> * <b>SVF now supports LLVM-9.0.0 (Thank [Byoungyoung Lee](https://github.com/SVF-tools/SVF/issues/142) for his help!). </b> * <b>SVF now supports a set of [field-sensitive pointer analyses](https://yuleisui.github.io/publications/sas2019a.pdf). </b> * <b>[Use SVF as an external lib](https://github.com/SVF-tools/SVF/wiki/Using-SVF-as-a-lib-in-your-own-tool) for your own project (Contributed by [Hongxu Chen](https://github.com/HongxuChen)). </b> * <b>SVF now supports LLVM-7.0.0. </b> * <b>SVF now supports Docker. [Try SVF in Docker](https://github.com/SVF-tools/SVF/wiki/Try-SVF-in-Docker)! </b> * <b>SVF now supports [LLVM-6.0.0](https://github.com/svf-tools/SVF/pull/38) (Contributed by [Jack Anthony](https://github.com/jackanth)). </b> * <b>SVF now supports [LLVM-4.0.0](https://github.com/svf-tools/SVF/pull/23) (Contributed by Jared Carlson. Thank [Jared](https://github.com/jcarlson23) and [Will](https://github.com/dtzWill) for their in-depth [discussions](https://github.com/svf-tools/SVF/pull/18) about updating SVF!) </b> * <b>SVF now supports analysis for C++ programs.</b> <br />",
   "main": "index.js",
   "scripts": {

package/svf/include/SVFIR/SVFType.h

@@ -243,7 +243,7 @@ public:
     {
         SVFTy,
         SVFPointerTy,
-        SVFIntergerTy,
+        SVFIntegerTy,
         SVFFunctionTy,
         SVFStructTy,
         SVFArrayTy,
@@ -337,13 +337,13 @@ public:
     }
 };
 
-class SVFIntergerType : public SVFType
+class SVFIntegerType : public SVFType
 {
 public:
-    SVFIntergerType() : SVFType(true, SVFIntergerTy) {}
+    SVFIntegerType() : SVFType(true, SVFIntegerTy) {}
     static inline bool classof(const SVFType* node)
     {
-        return node->getKind() == SVFIntergerTy;
+        return node->getKind() == SVFIntegerTy;
     }
 };
 

package/svf/include/SVFIR/SVFValue.h

@@ -266,7 +266,7 @@ public:
 
 private:
     bool isDecl;   /// return true if this function does not have a body
-    bool intricsic; /// return true if this function is an intricsic function (e.g., llvm.dbg), which does not reside in the application code
+    bool intrinsic; /// return true if this function is an intrinsic function (e.g., llvm.dbg), which does not reside in the application code
     bool addrTaken; /// return true if this function is address-taken (for indirect call purposes)
     bool isUncalled;    /// return true if this function is never called
     bool isNotRet;   /// return true if this function never returns
@@ -307,7 +307,7 @@ protected:
     /// @}
 
 public:
-    SVFFunction(const std::string& f, const SVFType* ty,const SVFFunctionType* ft, bool declare, bool intricsic, bool addrTaken, bool varg, SVFLoopAndDomInfo* ld);
+    SVFFunction(const std::string& f, const SVFType* ty,const SVFFunctionType* ft, bool declare, bool intrinsic, bool addrTaken, bool varg, SVFLoopAndDomInfo* ld);
     SVFFunction(const std::string& f) = delete;
     SVFFunction(void) = delete;
     virtual ~SVFFunction();
@@ -328,7 +328,7 @@ public:
 
     inline bool isIntrinsic() const
     {
-        return intricsic;
+        return intrinsic;
     }
 
     inline bool hasAddressTaken() const

package/svf/include/Util/Options.h

@@ -223,6 +223,9 @@ public:
     // SaberCondAllocator.cpp
     static const Option<bool> PrintPathCond;
 
+    // SaberSVFGBuilder.cpp
+    static const Option<bool> CollectExtRetGlobals;
+
     // SVFUtil.cpp
     static const Option<bool> DisableWarn;
 

package/svf/lib/AbstractExecution/SVFIR2ItvExeState.cpp

@@ -176,9 +176,12 @@ void SVFIR2ItvExeState::initValVar(const ValVar *valVar, u32_t varId)
 
     if (const SVFType *type = valVar->getType())
     {
-        //TODO:miss floatpointerty, voidty, labelty, matadataty
-        if (type->getKind() == SVFType::SVFIntergerTy || type->getKind() == SVFType::SVFPointerTy || type->getKind() == SVFType::SVFFunctionTy
-                || type->getKind()== SVFType::SVFStructTy || type->getKind()==SVFType::SVFArrayTy)
+        // TODO:miss floatpointerty, voidty, labelty, matadataty
+        if (type->getKind() == SVFType::SVFIntegerTy ||
+                type->getKind() == SVFType::SVFPointerTy ||
+                type->getKind() == SVFType::SVFFunctionTy ||
+                type->getKind() == SVFType::SVFStructTy ||
+                type->getKind() == SVFType::SVFArrayTy)
             // continue with null expression
             _es[varId] = IntervalValue::top();
         else

package/svf/lib/SABER/SaberSVFGBuilder.cpp

@@ -31,6 +31,7 @@
 #include "SABER/SaberCheckerAPI.h"
 #include "MemoryModel/PointerAnalysisImpl.h"
 #include "Graphs/SVFG.h"
+#include "Util/Options.h"
 
 using namespace SVF;
 using namespace SVFUtil;
@@ -99,17 +100,48 @@ void SaberSVFGBuilder::collectGlobals(BVDataPTAImpl* pta)
     }
 }
 
-PointsTo& SaberSVFGBuilder::CollectPtsChain(BVDataPTAImpl* pta,NodeID id, NodeToPTSSMap& cachedPtsMap)
+
+/*
+ * https://github.com/SVF-tools/SVF/issues/991
+ *
+ * Originally, this function will collect all base pointers with all their fields
+ * inside the points-to set of global variables. But if a global variable points
+ * to the pointer returned by malloc() at some program points, then all pointers
+ * returned by malloc() will be included in the global set because of the
+ * context-insensitive pointer analysis results. This will make saber abandon
+ * too many slicing thus miss potential bugs.
+ *
+ * We add an option "saber-collect-extret-globals" to control whether this function
+ * will collect external functions' returned pointers. This option is true by default,
+ * making it to be false will let saber analyze more slicing but cause performance downgrade.
+ *
+ */
+PointsTo& SaberSVFGBuilder::CollectPtsChain(BVDataPTAImpl* pta, NodeID id, NodeToPTSSMap& cachedPtsMap)
 {
     SVFIR* pag = svfg->getPAG();
 
     NodeID baseId = pag->getBaseObjVar(id);
     NodeToPTSSMap::iterator it = cachedPtsMap.find(baseId);
     if(it!=cachedPtsMap.end())
+    {
         return it->second;
+    }
     else
     {
         PointsTo& pts = cachedPtsMap[baseId];
+        // base object
+        if (!Options::CollectExtRetGlobals())
+        {
+            if(pta->isFIObjNode(baseId) && pag->getGNode(baseId)->hasValue())
+            {
+                const SVFCallInst* inst = SVFUtil::dyn_cast<SVFCallInst>(pag->getGNode(baseId)->getValue());
+                if(inst && SVFUtil::isExtCall(inst))
+                {
+                    return pts;
+                }
+            }
+        }
+
         pts |= pag->getFieldsAfterCollapse(baseId);
 
         WorkList worklist;
@@ -127,7 +159,6 @@ PointsTo& SaberSVFGBuilder::CollectPtsChain(BVDataPTAImpl* pta,NodeID id, NodeTo
         }
         return pts;
     }
-
 }
 
 /*!

package/svf/lib/SVFIR/SVFValue.cpp

@@ -122,8 +122,12 @@ bool SVFLoopAndDomInfo::isLoopHeader(const SVFBasicBlock* bb) const
     return false;
 }
 
-SVFFunction::SVFFunction(const std::string& f, const SVFType* ty, const SVFFunctionType* ft, bool declare, bool intric, bool adt, bool varg, SVFLoopAndDomInfo* ld):
-    SVFValue(f,ty,SVFValue::SVFFunc),isDecl(declare), intricsic(intric), addrTaken(adt), isUncalled(false), isNotRet(false), varArg(varg), funcType(ft), loopAndDom(ld), realDefFun(nullptr)
+SVFFunction::SVFFunction(const std::string& f, const SVFType* ty,
+                         const SVFFunctionType* ft, bool declare, bool intrinsic,
+                         bool adt, bool varg, SVFLoopAndDomInfo* ld)
+    : SVFValue(f, ty, SVFValue::SVFFunc), isDecl(declare), intrinsic(intrinsic),
+      addrTaken(adt), isUncalled(false), isNotRet(false), varArg(varg),
+      funcType(ft), loopAndDom(ld), realDefFun(nullptr)
 {
 }
 

package/svf/lib/Util/Options.cpp

@@ -679,6 +679,14 @@ const Option<bool> Options::PrintPathCond(
 );
 
 
+// SaberSVFGBuilder.cpp
+const Option<bool> Options::CollectExtRetGlobals(
+    "saber-collect-extret-globals",
+    "Don't include pointers returned by external function during collecting globals",
+    true
+);
+
+
 // SVFUtil.cpp
 const Option<bool> Options::DisableWarn(
     "dwarn",

package/svf-llvm/lib/LLVMModule.cpp

@@ -1045,7 +1045,7 @@ SVFType* LLVMModuleSet::addSVFTypeInfo(const Type* T)
     if (const PointerType* pt = SVFUtil::dyn_cast<PointerType>(T))
         svftype = new SVFPointerType(getSVFType(LLVMUtil::getPtrElementType(pt)));
     else if (SVFUtil::isa<IntegerType>(T))
-        svftype = new SVFIntergerType();
+        svftype = new SVFIntegerType();
     else if (const FunctionType* ft = SVFUtil::dyn_cast<FunctionType>(T))
         svftype = new SVFFunctionType(getSVFType(ft->getReturnType()));
     else if (SVFUtil::isa<StructType>(T))