svf-tools 1.0.837 → 1.0.839

package/svf/include/CFL/CFLSVFGBuilder.h

@@ -0,0 +1,58 @@
+//===- CFLSVFGBuilder.h -- Building SVFG for CFL--------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013->  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+//
+// Created by Xiao on 30/12/23.
+//
+
+#ifndef SVF_CFLSVFGBUILDER_H
+#define SVF_CFLSVFGBUILDER_H
+
+#include "SABER/SaberSVFGBuilder.h"
+
+namespace SVF
+{
+
+class CFLSVFGBuilder: public SaberSVFGBuilder
+{
+public:
+    typedef Set<const SVFGNode*> SVFGNodeSet;
+    typedef Map<NodeID, PointsTo> NodeToPTSSMap;
+    typedef FIFOWorkList<NodeID> WorkList;
+
+    /// Constructor
+    CFLSVFGBuilder() = default;
+
+    /// Destructor
+    virtual ~CFLSVFGBuilder() = default;
+
+protected:
+    /// Re-write create SVFG method
+    virtual void buildSVFG();
+
+    /// Remove Incoming Edge for strong-update (SU) store instruction
+    /// Because the SU node does not receive indirect value
+    virtual void rmIncomingEdgeForSUStore(BVDataPTAImpl* pta);
+};
+
+}
+#endif //SVF_CFLSVFGBUILDER_H

package/svf/include/CFL/CFLVF.h

@@ -33,7 +33,7 @@
 
 #include "CFL/CFLBase.h"
 #include "CFL/CFLStat.h"
-#include "SABER/SaberSVFGBuilder.h"
+#include "CFL/CFLSVFGBuilder.h"
 #include "WPA/Andersen.h"
 
 namespace SVF
@@ -59,7 +59,7 @@ public:
     void buildCFLGraph();
 
 private:
-    SaberSVFGBuilder memSSA;
+    CFLSVFGBuilder memSSA;
     SVFG* svfg;
 };
 

package/svf/include/Graphs/SVFG.h

@@ -66,6 +66,7 @@ class SVFG : public VFG
 {
     friend class SVFGBuilder;
     friend class SaberSVFGBuilder;
+    friend class CFLSVFGBuilder;
     friend class TaintSVFGBuilder;
     friend class DDASVFGBuilder;
     friend class MTASVFGBuilder;

package/svf/include/SABER/ProgSlice.h

@@ -58,6 +58,9 @@ public:
     typedef FIFOWorkList<const SVFGNode*> VFWorkList;		    ///< worklist for value-flow guard computation
     typedef FIFOWorkList<const SVFBasicBlock*> CFWorkList;	///< worklist for control-flow guard computation
 
+    typedef SaberCondAllocator::SVFGNodeToSVFGNodeSetMap SVFGNodeToSVFGNodeSetMap;
+
+
     /// Constructor
     ProgSlice(const SVFGNode* src, SaberCondAllocator* pa, const SVFG* graph):
         root(src), partialReachable(false), fullReachable(false), reachGlob(false),
@@ -296,6 +299,14 @@ protected:
         finalCond = cond;
     }
 
+    /// Compute invalid branch condition stemming from removed strong update value-flow edges
+    Condition computeInvalidCondFromRemovedSUVFEdge(const SVFGNode * cur);
+
+    const SVFGNodeToSVFGNodeSetMap& getRemovedSUVFEdges() const
+    {
+        return pathAllocator->getRemovedSUVFEdges();
+    }
+
 private:
     SVFGNodeSet forwardslice;				///<  the forward slice
     SVFGNodeSet backwardslice;				///<  the backward slice

package/svf/include/SABER/SaberCondAllocator.h

@@ -56,6 +56,7 @@ public:
     typedef Map<const SVFFunction*,  BasicBlockSet> FunToExitBBsMap;  ///< map a function to all its basic blocks calling program exit
     typedef Map<const SVFBasicBlock*, Condition> BBToCondMap;	///< map a basic block to its condition during control-flow guard computation
     typedef FIFOWorkList<const SVFBasicBlock*> CFWorkList;	///< worklist for control-flow guard computation
+    typedef Map<const SVFGNode*, Set<const SVFGNode*>> SVFGNodeToSVFGNodeSetMap;
 
 
     /// Constructor
@@ -239,6 +240,12 @@ public:
         setCondInst(condition, inst);
         negConds.set(condition.id());
     }
+
+    SVFGNodeToSVFGNodeSetMap & getRemovedSUVFEdges()
+    {
+        return removedSUVFEdges;
+    }
+
 private:
 
     /// Allocate path condition for every basic block
@@ -299,6 +306,7 @@ private:
     NodeBS negConds;                        ///bit vector for distinguish neg
     std::vector<Condition> conditionVec;          /// vector storing z3expression
     static u32_t totalCondNum; /// a counter for fresh condition
+    SVFGNodeToSVFGNodeSetMap removedSUVFEdges;
 
 protected:
     BBCondMap bbConds;						///< map basic block to its successors/predecessors branch conditions

package/svf/include/SABER/SaberSVFGBuilder.h

@@ -34,9 +34,12 @@
 #include "SVFIR/SVFValue.h"
 #include "Util/WorkList.h"
 
+
 namespace SVF
 {
 
+class SaberCondAllocator;
+
 class SaberSVFGBuilder : public SVFGBuilder
 {
 
@@ -62,6 +65,11 @@ public:
         svfg->addActualParmVFGNode(pagNode, cs);
     }
 
+    void setSaberCondAllocator(SaberCondAllocator* allocator)
+    {
+        saberCondAllocator = allocator;
+    }
+
 protected:
     /// Re-write create SVFG method
     virtual void buildSVFG();
@@ -69,7 +77,7 @@ protected:
     /// Return TRUE if this is a strong update STORE statement.
     bool isStrongUpdate(const SVFGNode* node, NodeID& singleton, BVDataPTAImpl* pta);
 
-private:
+protected:
     /// Remove direct value-flow edge to a dereference point for Saber source-sink memory error detection
     /// for example, given two statements: p = alloc; q = *p, the direct SVFG edge between them is deleted
     /// Because those edges only stand for values used at the dereference points but they can not pass the value to other definitions
@@ -77,7 +85,7 @@ private:
 
     /// Remove Incoming Edge for strong-update (SU) store instruction
     /// Because the SU node does not receive indirect value
-    void rmIncomingEdgeForSUStore(BVDataPTAImpl* pta);
+    virtual void rmIncomingEdgeForSUStore(BVDataPTAImpl* pta);
 
     /// Add actual parameter SVFGNode for 1st argument of a deallocation like external function
     /// In order to path sensitive leak detection
@@ -97,6 +105,8 @@ private:
     PointsTo globs;
     /// Store all global SVFG nodes
     SVFGNodeSet globSVFGNodes;
+
+    SaberCondAllocator* saberCondAllocator;
 };
 
 } // End namespace SVF

package/svf/include/Util/Options.h

@@ -80,17 +80,6 @@ public:
     // ContextDDA.cpp
     static const Option<u32_t> CxtBudget;
 
-    // DDAClient.cpp
-    static const Option<bool> SingleLoad;
-    static const Option<bool> DumpFree;
-    static const Option<bool> DumpUninitVar;
-    static const Option<bool> DumpUninitPtr;
-    static const Option<bool> DumpSUPts;
-    static const Option<bool> DumpSUStore;
-    static const Option<bool> MallocOnly;
-    static const Option<bool> TaintUninitHeap;
-    static const Option<bool> TaintUninitStack;
-
     // DDAPass.cpp
     static const Option<u32_t> MaxPathLen;
     static const Option<u32_t> MaxContextLen;
@@ -121,14 +110,12 @@ public:
     // Sparse value-flow graph (VFG.cpp)
     static const Option<bool> DumpVFG;
 
-    // Location set for modeling abstract memory object (AccessPath.cpp)
-    static const Option<bool> SingleStride;
-
     // Base class of pointer analyses (PointerAnalysis.cpp)
     static const Option<bool> TypePrint;
     static const Option<bool> FuncPointerPrint;
     static const Option<bool> PTSPrint;
     static const Option<bool> PTSAllPrint;
+    static const Option<bool> PrintFieldWithBasePrefix;
     static const Option<bool> PStat;
     static const Option<u32_t> StatBudget;
     static const Option<bool> PAGDotGraph;

package/svf/lib/CFL/CFLSVFGBuilder.cpp

@@ -0,0 +1,100 @@
+//===- CFLSVFGBuilder.cpp -- Building SVFG for CFL--------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013->  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+//
+// Created by Xiao on 30/12/23.
+//
+#include "MemoryModel/PointerAnalysisImpl.h"
+#include "Graphs/SVFG.h"
+#include "Util/Options.h"
+#include "CFL/CFLSVFGBuilder.h"
+
+
+using namespace SVF;
+using namespace SVFUtil;
+
+void CFLSVFGBuilder::buildSVFG()
+{
+
+    MemSSA* mssa = svfg->getMSSA();
+    svfg->buildSVFG();
+    BVDataPTAImpl* pta = mssa->getPTA();
+    DBOUT(DGENERAL, outs() << pasMsg("\tCollect Global Variables\n"));
+
+    collectGlobals(pta);
+
+    DBOUT(DGENERAL, outs() << pasMsg("\tRemove Dereference Direct SVFG Edge\n"));
+
+    rmDerefDirSVFGEdges(pta);
+
+    rmIncomingEdgeForSUStore(pta);
+
+    DBOUT(DGENERAL, outs() << pasMsg("\tAdd Sink SVFG Nodes\n"));
+
+    AddExtActualParmSVFGNodes(pta->getPTACallGraph());
+
+    if(pta->printStat())
+        svfg->performStat();
+}
+
+
+/*!
+ * Remove Incoming Edge for strong-update (SU) store instruction
+ * Because the SU node does not receive indirect value
+ *
+ * e.g.,
+ *      L1: *p = O; (singleton)
+ *      L2: *p = _; (SU here)
+ *      We should remove the indirect value flow L1 -> L2
+ *      Because the points-to set of O from L1 does not pass to that after L2
+ */
+void CFLSVFGBuilder::rmIncomingEdgeForSUStore(BVDataPTAImpl* pta)
+{
+
+    for(SVFG::iterator it = svfg->begin(), eit = svfg->end(); it!=eit; ++it)
+    {
+        const SVFGNode* node = it->second;
+
+        if(const StoreSVFGNode* stmtNode = SVFUtil::dyn_cast<StoreSVFGNode>(node))
+        {
+            if(SVFUtil::isa<StoreStmt>(stmtNode->getPAGEdge()))
+            {
+                NodeID singleton;
+                if(isStrongUpdate(node, singleton, pta))
+                {
+                    Set<SVFGEdge*> toRemove;
+                    for (SVFGNode::const_iterator it2 = node->InEdgeBegin(), eit2 = node->InEdgeEnd(); it2 != eit2; ++it2)
+                    {
+                        if ((*it2)->isIndirectVFGEdge())
+                        {
+                            toRemove.insert(*it2);
+                        }
+                    }
+                    for (SVFGEdge* edge: toRemove)
+                    {
+                        svfg->removeSVFGEdge(edge);
+                    }
+                }
+            }
+        }
+    }
+}

package/svf/lib/SABER/ProgSlice.cpp

@@ -52,6 +52,8 @@ bool ProgSlice::AllPathReachableSolve()
     {
         const SVFGNode* node = worklist.pop();
         setCurSVFGNode(node);
+
+        Condition invalidCond = computeInvalidCondFromRemovedSUVFEdge(node);
         Condition cond = getVFCond(node);
         for(SVFGNode::const_iterator it = node->OutEdgeBegin(), eit = node->OutEdgeEnd(); it!=eit; ++it)
         {
@@ -75,7 +77,7 @@ bool ProgSlice::AllPathReachableSolve()
                 }
                 else
                     vfCond = ComputeIntraVFGGuard(nodeBB,succBB);
-
+                vfCond = condAnd(vfCond, condNeg(invalidCond));
                 Condition succPathCond = condAnd(cond, vfCond);
                 if(setVFCond(succ,  condOr(getVFCond(succ), succPathCond) ))
                     worklist.push(succ);
@@ -89,6 +91,51 @@ bool ProgSlice::AllPathReachableSolve()
     return isSatisfiableForAll();
 }
 
+/*!
+ * Compute invalid branch condition stemming from removed strong update value-flow edges
+ *
+ * Fix issue: https://github.com/SVF-tools/SVF/issues/1306
+ * Line 11->13 is removed due to a strong update at Line 13, which means Line 11 is unreachable to Line 13 on the value flow graph.
+ * However on the control flow graph they are still considered as reachable,
+ * making the vf guard on Line 11 -> Line 15 a true condition (should consider the infeasible branch Line 11 -> Line 13)
+ * Therefore, we collect this infeasible branch condition (condition on Line 11 -> Line 13, `a == b`) as an invalid condition (invalidCond),
+ * and add the negation of invalidCond when computing value flow guard starting from the source of the SU.
+ * In this example, we add `a != b` on Line 11 -> Line 15.
+ *
+ * @param cur current SVFG node
+ * @return invalid branch condition
+ */
+ProgSlice::Condition ProgSlice::computeInvalidCondFromRemovedSUVFEdge(const SVFGNode * cur)
+{
+    Set<const SVFBasicBlock*> validOutBBs; // the BBs of valid successors
+    for(SVFGNode::const_iterator it = cur->OutEdgeBegin(), eit = cur->OutEdgeEnd(); it!=eit; ++it)
+    {
+        const SVFGEdge* edge = (*it);
+        const SVFGNode* succ = edge->getDstNode();
+        if(inBackwardSlice(succ))
+        {
+            validOutBBs.insert(getSVFGNodeBB(succ));
+        }
+    }
+    Condition invalidCond = getFalseCond();
+    auto suVFEdgesIt = getRemovedSUVFEdges().find(cur);
+    if (suVFEdgesIt != getRemovedSUVFEdges().end())
+    {
+        for (const auto &succ: suVFEdgesIt->second)
+        {
+            if (!validOutBBs.count(getSVFGNodeBB(succ)))
+            {
+                // removed vfg node does not reside in the BBs of valid successors
+                const SVFBasicBlock *nodeBB = getSVFGNodeBB(cur);
+                const SVFBasicBlock *succBB = getSVFGNodeBB(succ);
+                clearCFCond();
+                invalidCond = condOr(invalidCond, ComputeIntraVFGGuard(nodeBB, succBB));
+            }
+        }
+    }
+    return invalidCond;
+}
+
 /*!
  * Solve by computing disjunction of conditions from all sinks (e.g., memory leak)
  */

package/svf/lib/SABER/SaberSVFGBuilder.cpp

@@ -32,6 +32,8 @@
 #include "MemoryModel/PointerAnalysisImpl.h"
 #include "Graphs/SVFG.h"
 #include "Util/Options.h"
+#include "SABER/SaberCondAllocator.h"
+
 
 using namespace SVF;
 using namespace SVFUtil;
@@ -50,6 +52,7 @@ void SaberSVFGBuilder::buildSVFG()
 
     rmDerefDirSVFGEdges(pta);
 
+    assert(saberCondAllocator && "saber condition allocator not set yet!");
     rmIncomingEdgeForSUStore(pta);
 
     DBOUT(DGENERAL, outs() << pasMsg("\tAdd Sink SVFG Nodes\n"));
@@ -276,6 +279,8 @@ void SaberSVFGBuilder::rmIncomingEdgeForSUStore(BVDataPTAImpl* pta)
                     }
                     for (SVFGEdge* edge: toRemove)
                     {
+                        if (isa<StoreSVFGNode>(edge->getSrcNode()))
+                            saberCondAllocator->getRemovedSUVFEdges()[edge->getSrcNode()].insert(edge->getDstNode());
                         svfg->removeSVFGEdge(edge);
                     }
                 }

package/svf/lib/SABER/SrcSnkDDA.cpp

@@ -43,6 +43,7 @@ void SrcSnkDDA::initialize(SVFModule* module)
     SVFIR* pag = PAG::getPAG();
 
     AndersenWaveDiff* ander = AndersenWaveDiff::createAndersenWaveDiff(pag);
+    memSSA.setSaberCondAllocator(getSaberCondAllocator());
     if(Options::SABERFULLSVFG())
         svfg =  memSSA.buildFullSVFG(ander);
     else

package/svf/lib/Util/Options.cpp

@@ -75,62 +75,6 @@ const Option<u32_t> Options::CxtBudget(
     10000
 );
 
-
-// DDAClient.cpp
-const Option<bool> Options::SingleLoad(
-    "single-load",
-    "Count load pointer with same source operand as one query",
-    true
-);
-
-const Option<bool> Options::DumpFree(
-    "dump-free",
-    "Dump use after free locations",
-    false
-);
-
-const Option<bool> Options::DumpUninitVar(
-    "dump-uninit-var",
-    "Dump uninitialised variables",
-    false
-);
-
-const Option<bool> Options::DumpUninitPtr(
-    "dump-uninit-ptr",
-    "Dump uninitialised pointers",
-    false
-);
-
-const Option<bool> Options::DumpSUPts(
-    "dump-su-pts",
-    "Dump strong updates store",
-    false
-);
-
-const Option<bool> Options::DumpSUStore(
-    "dump-su-store",
-    "Dump strong updates store",
-    false
-);
-
-const Option<bool> Options::MallocOnly(
-    "malloc-only",
-    "Only add tainted objects for malloc",
-    true
-);
-
-const Option<bool> Options::TaintUninitHeap(
-    "uninit-heap",
-    "detect uninitialized heap variables",
-    true
-);
-
-const Option<bool> Options::TaintUninitStack(
-    "uninit-stack",
-    "detect uninitialized stack variables",
-    true
-);
-
 // DDAPass.cpp
 const Option<u32_t> Options::MaxPathLen(
     "max-path",
@@ -254,14 +198,6 @@ const Option<bool> Options::DumpVFG(
 );
 
 
-// Location set for modeling abstract memory object (AccessPath.cpp)
-const Option<bool> Options::SingleStride(
-    "stride-only",
-    "Only use single stride in LocMemoryModel",
-    false
-);
-
-
 // Base class of pointer analyses (PointerAnalysis.cpp)
 const Option<bool> Options::TypePrint(
     "print-type",
@@ -281,6 +217,12 @@ const Option<bool> Options::PTSPrint(
     false
 );
 
+const Option<bool> Options::PrintFieldWithBasePrefix(
+    "print-field",
+    "Print field object with base object id as the prefix",
+    false
+);
+
 const Option<bool> Options::PTSAllPrint(
     "print-all-pts",
     "Print all points-to set of both top-level and address-taken variables",

package/svf/lib/WPA/Andersen.cpp

@@ -911,8 +911,11 @@ void Andersen::dumpTopLevelPtsTo()
                 }
                 for (multiset<u32_t>::const_iterator it = line.begin(); it != line.end(); ++it)
                 {
-                    if (auto gepNode = SVFUtil::dyn_cast<GepObjVar>(pag->getGNode(*it)))
-                        outs() << gepNode->getBaseNode() << "_" << gepNode->getConstantFieldIdx() << " ";
+                    if(Options::PrintFieldWithBasePrefix())
+                        if (auto gepNode = SVFUtil::dyn_cast<GepObjVar>(pag->getGNode(*it)))
+                            outs() << gepNode->getBaseNode() << "_" << gepNode->getConstantFieldIdx() << " ";
+                        else
+                            outs() << *it << " ";
                     else
                         outs() << *it << " ";
                 }