svf-tools 1.0.838 → 1.0.839

package/svf/include/SABER/SaberCondAllocator.h

@@ -56,6 +56,7 @@ public:
     typedef Map<const SVFFunction*,  BasicBlockSet> FunToExitBBsMap;  ///< map a function to all its basic blocks calling program exit
     typedef Map<const SVFBasicBlock*, Condition> BBToCondMap;	///< map a basic block to its condition during control-flow guard computation
     typedef FIFOWorkList<const SVFBasicBlock*> CFWorkList;	///< worklist for control-flow guard computation
+    typedef Map<const SVFGNode*, Set<const SVFGNode*>> SVFGNodeToSVFGNodeSetMap;
 
 
     /// Constructor
@@ -239,6 +240,12 @@ public:
         setCondInst(condition, inst);
         negConds.set(condition.id());
     }
+
+    SVFGNodeToSVFGNodeSetMap & getRemovedSUVFEdges()
+    {
+        return removedSUVFEdges;
+    }
+
 private:
 
     /// Allocate path condition for every basic block
@@ -299,6 +306,7 @@ private:
     NodeBS negConds;                        ///bit vector for distinguish neg
     std::vector<Condition> conditionVec;          /// vector storing z3expression
     static u32_t totalCondNum; /// a counter for fresh condition
+    SVFGNodeToSVFGNodeSetMap removedSUVFEdges;
 
 protected:
     BBCondMap bbConds;						///< map basic block to its successors/predecessors branch conditions

package/svf/include/SABER/SaberSVFGBuilder.h

@@ -34,9 +34,12 @@
 #include "SVFIR/SVFValue.h"
 #include "Util/WorkList.h"
 
+
 namespace SVF
 {
 
+class SaberCondAllocator;
+
 class SaberSVFGBuilder : public SVFGBuilder
 {
 
@@ -62,6 +65,11 @@ public:
         svfg->addActualParmVFGNode(pagNode, cs);
     }
 
+    void setSaberCondAllocator(SaberCondAllocator* allocator)
+    {
+        saberCondAllocator = allocator;
+    }
+
 protected:
     /// Re-write create SVFG method
     virtual void buildSVFG();
@@ -69,7 +77,7 @@ protected:
     /// Return TRUE if this is a strong update STORE statement.
     bool isStrongUpdate(const SVFGNode* node, NodeID& singleton, BVDataPTAImpl* pta);
 
-private:
+protected:
     /// Remove direct value-flow edge to a dereference point for Saber source-sink memory error detection
     /// for example, given two statements: p = alloc; q = *p, the direct SVFG edge between them is deleted
     /// Because those edges only stand for values used at the dereference points but they can not pass the value to other definitions
@@ -77,7 +85,7 @@ private:
 
     /// Remove Incoming Edge for strong-update (SU) store instruction
     /// Because the SU node does not receive indirect value
-    void rmIncomingEdgeForSUStore(BVDataPTAImpl* pta);
+    virtual void rmIncomingEdgeForSUStore(BVDataPTAImpl* pta);
 
     /// Add actual parameter SVFGNode for 1st argument of a deallocation like external function
     /// In order to path sensitive leak detection
@@ -97,6 +105,8 @@ private:
     PointsTo globs;
     /// Store all global SVFG nodes
     SVFGNodeSet globSVFGNodes;
+
+    SaberCondAllocator* saberCondAllocator;
 };
 
 } // End namespace SVF

package/svf/lib/CFL/CFLSVFGBuilder.cpp

@@ -0,0 +1,100 @@
+//===- CFLSVFGBuilder.cpp -- Building SVFG for CFL--------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013->  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+//
+// Created by Xiao on 30/12/23.
+//
+#include "MemoryModel/PointerAnalysisImpl.h"
+#include "Graphs/SVFG.h"
+#include "Util/Options.h"
+#include "CFL/CFLSVFGBuilder.h"
+
+
+using namespace SVF;
+using namespace SVFUtil;
+
+void CFLSVFGBuilder::buildSVFG()
+{
+
+    MemSSA* mssa = svfg->getMSSA();
+    svfg->buildSVFG();
+    BVDataPTAImpl* pta = mssa->getPTA();
+    DBOUT(DGENERAL, outs() << pasMsg("\tCollect Global Variables\n"));
+
+    collectGlobals(pta);
+
+    DBOUT(DGENERAL, outs() << pasMsg("\tRemove Dereference Direct SVFG Edge\n"));
+
+    rmDerefDirSVFGEdges(pta);
+
+    rmIncomingEdgeForSUStore(pta);
+
+    DBOUT(DGENERAL, outs() << pasMsg("\tAdd Sink SVFG Nodes\n"));
+
+    AddExtActualParmSVFGNodes(pta->getPTACallGraph());
+
+    if(pta->printStat())
+        svfg->performStat();
+}
+
+
+/*!
+ * Remove Incoming Edge for strong-update (SU) store instruction
+ * Because the SU node does not receive indirect value
+ *
+ * e.g.,
+ *      L1: *p = O; (singleton)
+ *      L2: *p = _; (SU here)
+ *      We should remove the indirect value flow L1 -> L2
+ *      Because the points-to set of O from L1 does not pass to that after L2
+ */
+void CFLSVFGBuilder::rmIncomingEdgeForSUStore(BVDataPTAImpl* pta)
+{
+
+    for(SVFG::iterator it = svfg->begin(), eit = svfg->end(); it!=eit; ++it)
+    {
+        const SVFGNode* node = it->second;
+
+        if(const StoreSVFGNode* stmtNode = SVFUtil::dyn_cast<StoreSVFGNode>(node))
+        {
+            if(SVFUtil::isa<StoreStmt>(stmtNode->getPAGEdge()))
+            {
+                NodeID singleton;
+                if(isStrongUpdate(node, singleton, pta))
+                {
+                    Set<SVFGEdge*> toRemove;
+                    for (SVFGNode::const_iterator it2 = node->InEdgeBegin(), eit2 = node->InEdgeEnd(); it2 != eit2; ++it2)
+                    {
+                        if ((*it2)->isIndirectVFGEdge())
+                        {
+                            toRemove.insert(*it2);
+                        }
+                    }
+                    for (SVFGEdge* edge: toRemove)
+                    {
+                        svfg->removeSVFGEdge(edge);
+                    }
+                }
+            }
+        }
+    }
+}

package/svf/lib/SABER/ProgSlice.cpp

@@ -52,6 +52,8 @@ bool ProgSlice::AllPathReachableSolve()
     {
         const SVFGNode* node = worklist.pop();
         setCurSVFGNode(node);
+
+        Condition invalidCond = computeInvalidCondFromRemovedSUVFEdge(node);
         Condition cond = getVFCond(node);
         for(SVFGNode::const_iterator it = node->OutEdgeBegin(), eit = node->OutEdgeEnd(); it!=eit; ++it)
         {
@@ -75,7 +77,7 @@ bool ProgSlice::AllPathReachableSolve()
                 }
                 else
                     vfCond = ComputeIntraVFGGuard(nodeBB,succBB);
-
+                vfCond = condAnd(vfCond, condNeg(invalidCond));
                 Condition succPathCond = condAnd(cond, vfCond);
                 if(setVFCond(succ,  condOr(getVFCond(succ), succPathCond) ))
                     worklist.push(succ);
@@ -89,6 +91,51 @@ bool ProgSlice::AllPathReachableSolve()
     return isSatisfiableForAll();
 }
 
+/*!
+ * Compute invalid branch condition stemming from removed strong update value-flow edges
+ *
+ * Fix issue: https://github.com/SVF-tools/SVF/issues/1306
+ * Line 11->13 is removed due to a strong update at Line 13, which means Line 11 is unreachable to Line 13 on the value flow graph.
+ * However on the control flow graph they are still considered as reachable,
+ * making the vf guard on Line 11 -> Line 15 a true condition (should consider the infeasible branch Line 11 -> Line 13)
+ * Therefore, we collect this infeasible branch condition (condition on Line 11 -> Line 13, `a == b`) as an invalid condition (invalidCond),
+ * and add the negation of invalidCond when computing value flow guard starting from the source of the SU.
+ * In this example, we add `a != b` on Line 11 -> Line 15.
+ *
+ * @param cur current SVFG node
+ * @return invalid branch condition
+ */
+ProgSlice::Condition ProgSlice::computeInvalidCondFromRemovedSUVFEdge(const SVFGNode * cur)
+{
+    Set<const SVFBasicBlock*> validOutBBs; // the BBs of valid successors
+    for(SVFGNode::const_iterator it = cur->OutEdgeBegin(), eit = cur->OutEdgeEnd(); it!=eit; ++it)
+    {
+        const SVFGEdge* edge = (*it);
+        const SVFGNode* succ = edge->getDstNode();
+        if(inBackwardSlice(succ))
+        {
+            validOutBBs.insert(getSVFGNodeBB(succ));
+        }
+    }
+    Condition invalidCond = getFalseCond();
+    auto suVFEdgesIt = getRemovedSUVFEdges().find(cur);
+    if (suVFEdgesIt != getRemovedSUVFEdges().end())
+    {
+        for (const auto &succ: suVFEdgesIt->second)
+        {
+            if (!validOutBBs.count(getSVFGNodeBB(succ)))
+            {
+                // removed vfg node does not reside in the BBs of valid successors
+                const SVFBasicBlock *nodeBB = getSVFGNodeBB(cur);
+                const SVFBasicBlock *succBB = getSVFGNodeBB(succ);
+                clearCFCond();
+                invalidCond = condOr(invalidCond, ComputeIntraVFGGuard(nodeBB, succBB));
+            }
+        }
+    }
+    return invalidCond;
+}
+
 /*!
  * Solve by computing disjunction of conditions from all sinks (e.g., memory leak)
  */

package/svf/lib/SABER/SaberSVFGBuilder.cpp

@@ -32,6 +32,8 @@
 #include "MemoryModel/PointerAnalysisImpl.h"
 #include "Graphs/SVFG.h"
 #include "Util/Options.h"
+#include "SABER/SaberCondAllocator.h"
+
 
 using namespace SVF;
 using namespace SVFUtil;
@@ -50,6 +52,7 @@ void SaberSVFGBuilder::buildSVFG()
 
     rmDerefDirSVFGEdges(pta);
 
+    assert(saberCondAllocator && "saber condition allocator not set yet!");
     rmIncomingEdgeForSUStore(pta);
 
     DBOUT(DGENERAL, outs() << pasMsg("\tAdd Sink SVFG Nodes\n"));
@@ -276,6 +279,8 @@ void SaberSVFGBuilder::rmIncomingEdgeForSUStore(BVDataPTAImpl* pta)
                     }
                     for (SVFGEdge* edge: toRemove)
                     {
+                        if (isa<StoreSVFGNode>(edge->getSrcNode()))
+                            saberCondAllocator->getRemovedSUVFEdges()[edge->getSrcNode()].insert(edge->getDstNode());
                         svfg->removeSVFGEdge(edge);
                     }
                 }

package/svf/lib/SABER/SrcSnkDDA.cpp

@@ -43,6 +43,7 @@ void SrcSnkDDA::initialize(SVFModule* module)
     SVFIR* pag = PAG::getPAG();
 
     AndersenWaveDiff* ander = AndersenWaveDiff::createAndersenWaveDiff(pag);
+    memSSA.setSaberCondAllocator(getSaberCondAllocator());
     if(Options::SABERFULLSVFG())
         svfg =  memSSA.buildFullSVFG(ander);
     else