svf-tools 1.0.913 → 1.0.914

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (264) hide show
  1. package/SVF-doxygen/html/AbstractInterpretation_8cpp.html +6 -4
  2. package/SVF-doxygen/html/AbstractInterpretation_8cpp_source.html +1592 -1609
  3. package/SVF-doxygen/html/AbstractInterpretation_8h_source.html +157 -144
  4. package/SVF-doxygen/html/BufOverflowChecker_8cpp_source.html +797 -786
  5. package/SVF-doxygen/html/BufOverflowChecker_8h_source.html +7 -7
  6. package/SVF-doxygen/html/SVFIR2AbsState_8cpp_source.html +815 -826
  7. package/SVF-doxygen/html/SVFIR2AbsState_8h_source.html +153 -196
  8. package/SVF-doxygen/html/classSVF_1_1AEStat.html +116 -120
  9. package/SVF-doxygen/html/classSVF_1_1AbstractInterpretation-members.html +32 -32
  10. package/SVF-doxygen/html/classSVF_1_1AbstractInterpretation.html +1736 -1681
  11. package/SVF-doxygen/html/classSVF_1_1BufOverflowChecker-members.html +32 -32
  12. package/SVF-doxygen/html/classSVF_1_1BufOverflowChecker.html +471 -462
  13. package/SVF-doxygen/html/classSVF_1_1SVFIR2AbsState-members.html +35 -47
  14. package/SVF-doxygen/html/classSVF_1_1SVFIR2AbsState.html +1261 -1546
  15. package/SVF-doxygen/html/dir_9a8e7a56f4029a0d9f62b1c6d1f6e85b.html +0 -2
  16. package/SVF-doxygen/html/files.html +0 -1
  17. package/SVF-doxygen/html/functions.html +4 -7
  18. package/SVF-doxygen/html/functions_a.html +2 -2
  19. package/SVF-doxygen/html/functions_f.html +3 -3
  20. package/SVF-doxygen/html/functions_func.html +2 -2
  21. package/SVF-doxygen/html/functions_func_g.html +40 -40
  22. package/SVF-doxygen/html/functions_func_h.html +21 -57
  23. package/SVF-doxygen/html/functions_func_i.html +23 -14
  24. package/SVF-doxygen/html/functions_func_n.html +1 -1
  25. package/SVF-doxygen/html/functions_func_s.html +13 -19
  26. package/SVF-doxygen/html/functions_func_t.html +1 -1
  27. package/SVF-doxygen/html/functions_func_w.html +1 -1
  28. package/SVF-doxygen/html/functions_g.html +35 -35
  29. package/SVF-doxygen/html/functions_h.html +18 -54
  30. package/SVF-doxygen/html/functions_i.html +32 -23
  31. package/SVF-doxygen/html/functions_l.html +3 -3
  32. package/SVF-doxygen/html/functions_n.html +1 -1
  33. package/SVF-doxygen/html/functions_o.html +4 -4
  34. package/SVF-doxygen/html/functions_p.html +16 -14
  35. package/SVF-doxygen/html/functions_r.html +6 -6
  36. package/SVF-doxygen/html/functions_s.html +22 -26
  37. package/SVF-doxygen/html/functions_t.html +13 -13
  38. package/SVF-doxygen/html/functions_v.html +3 -3
  39. package/SVF-doxygen/html/functions_vars.html +4 -7
  40. package/SVF-doxygen/html/functions_w.html +1 -1
  41. package/SVF-doxygen/html/search/all_0.js +131 -132
  42. package/SVF-doxygen/html/search/all_1.js +504 -504
  43. package/SVF-doxygen/html/search/all_10.js +326 -326
  44. package/SVF-doxygen/html/search/all_11.js +227 -227
  45. package/SVF-doxygen/html/search/all_12.js +559 -562
  46. package/SVF-doxygen/html/search/all_13.js +186 -186
  47. package/SVF-doxygen/html/search/all_14.js +74 -74
  48. package/SVF-doxygen/html/search/all_15.js +175 -175
  49. package/SVF-doxygen/html/search/all_16.js +77 -77
  50. package/SVF-doxygen/html/search/all_17.js +1 -1
  51. package/SVF-doxygen/html/search/all_18.js +1 -1
  52. package/SVF-doxygen/html/search/all_19.js +27 -27
  53. package/SVF-doxygen/html/search/all_1a.js +174 -174
  54. package/SVF-doxygen/html/search/all_2.js +180 -180
  55. package/SVF-doxygen/html/search/all_3.js +635 -635
  56. package/SVF-doxygen/html/search/all_4.js +237 -237
  57. package/SVF-doxygen/html/search/all_5.js +120 -120
  58. package/SVF-doxygen/html/search/all_6.js +236 -236
  59. package/SVF-doxygen/html/search/all_7.js +1039 -1039
  60. package/SVF-doxygen/html/search/all_8.js +212 -224
  61. package/SVF-doxygen/html/search/all_9.js +630 -627
  62. package/SVF-doxygen/html/search/all_a.js +46 -46
  63. package/SVF-doxygen/html/search/all_b.js +24 -24
  64. package/SVF-doxygen/html/search/all_c.js +111 -111
  65. package/SVF-doxygen/html/search/all_d.js +204 -204
  66. package/SVF-doxygen/html/search/all_e.js +207 -207
  67. package/SVF-doxygen/html/search/all_f.js +122 -122
  68. package/SVF-doxygen/html/search/classes_0.js +29 -29
  69. package/SVF-doxygen/html/search/classes_1.js +11 -11
  70. package/SVF-doxygen/html/search/classes_10.js +71 -71
  71. package/SVF-doxygen/html/search/classes_11.js +14 -14
  72. package/SVF-doxygen/html/search/classes_12.js +2 -2
  73. package/SVF-doxygen/html/search/classes_13.js +10 -10
  74. package/SVF-doxygen/html/search/classes_14.js +19 -19
  75. package/SVF-doxygen/html/search/classes_15.js +1 -1
  76. package/SVF-doxygen/html/search/classes_2.js +72 -72
  77. package/SVF-doxygen/html/search/classes_3.js +35 -35
  78. package/SVF-doxygen/html/search/classes_4.js +7 -7
  79. package/SVF-doxygen/html/search/classes_5.js +28 -28
  80. package/SVF-doxygen/html/search/classes_6.js +98 -98
  81. package/SVF-doxygen/html/search/classes_7.js +33 -33
  82. package/SVF-doxygen/html/search/classes_8.js +57 -57
  83. package/SVF-doxygen/html/search/classes_9.js +1 -1
  84. package/SVF-doxygen/html/search/classes_a.js +12 -12
  85. package/SVF-doxygen/html/search/classes_b.js +29 -29
  86. package/SVF-doxygen/html/search/classes_c.js +6 -6
  87. package/SVF-doxygen/html/search/classes_d.js +19 -19
  88. package/SVF-doxygen/html/search/classes_e.js +36 -36
  89. package/SVF-doxygen/html/search/classes_f.js +25 -25
  90. package/SVF-doxygen/html/search/defines_0.js +3 -3
  91. package/SVF-doxygen/html/search/defines_1.js +3 -3
  92. package/SVF-doxygen/html/search/defines_10.js +2 -2
  93. package/SVF-doxygen/html/search/defines_2.js +30 -30
  94. package/SVF-doxygen/html/search/defines_3.js +20 -20
  95. package/SVF-doxygen/html/search/defines_4.js +3 -3
  96. package/SVF-doxygen/html/search/defines_5.js +4 -4
  97. package/SVF-doxygen/html/search/defines_6.js +2 -2
  98. package/SVF-doxygen/html/search/defines_7.js +5 -5
  99. package/SVF-doxygen/html/search/defines_8.js +11 -11
  100. package/SVF-doxygen/html/search/defines_9.js +9 -9
  101. package/SVF-doxygen/html/search/defines_a.js +2 -2
  102. package/SVF-doxygen/html/search/defines_b.js +1 -1
  103. package/SVF-doxygen/html/search/defines_c.js +3 -3
  104. package/SVF-doxygen/html/search/defines_d.js +2 -2
  105. package/SVF-doxygen/html/search/defines_e.js +8 -8
  106. package/SVF-doxygen/html/search/defines_f.js +4 -4
  107. package/SVF-doxygen/html/search/enums_0.js +3 -3
  108. package/SVF-doxygen/html/search/enums_1.js +2 -2
  109. package/SVF-doxygen/html/search/enums_10.js +1 -1
  110. package/SVF-doxygen/html/search/enums_11.js +1 -1
  111. package/SVF-doxygen/html/search/enums_2.js +9 -9
  112. package/SVF-doxygen/html/search/enums_3.js +2 -2
  113. package/SVF-doxygen/html/search/enums_4.js +3 -3
  114. package/SVF-doxygen/html/search/enums_5.js +1 -1
  115. package/SVF-doxygen/html/search/enums_6.js +2 -2
  116. package/SVF-doxygen/html/search/enums_7.js +2 -2
  117. package/SVF-doxygen/html/search/enums_8.js +4 -4
  118. package/SVF-doxygen/html/search/enums_9.js +1 -1
  119. package/SVF-doxygen/html/search/enums_a.js +1 -1
  120. package/SVF-doxygen/html/search/enums_b.js +7 -7
  121. package/SVF-doxygen/html/search/enums_c.js +1 -1
  122. package/SVF-doxygen/html/search/enums_d.js +4 -4
  123. package/SVF-doxygen/html/search/enums_e.js +2 -2
  124. package/SVF-doxygen/html/search/enums_f.js +4 -4
  125. package/SVF-doxygen/html/search/enumvalues_0.js +15 -15
  126. package/SVF-doxygen/html/search/enumvalues_1.js +16 -16
  127. package/SVF-doxygen/html/search/enumvalues_10.js +36 -36
  128. package/SVF-doxygen/html/search/enumvalues_11.js +6 -6
  129. package/SVF-doxygen/html/search/enumvalues_12.js +10 -10
  130. package/SVF-doxygen/html/search/enumvalues_13.js +1 -1
  131. package/SVF-doxygen/html/search/enumvalues_14.js +1 -1
  132. package/SVF-doxygen/html/search/enumvalues_15.js +4 -4
  133. package/SVF-doxygen/html/search/enumvalues_2.js +36 -36
  134. package/SVF-doxygen/html/search/enumvalues_3.js +13 -13
  135. package/SVF-doxygen/html/search/enumvalues_4.js +2 -2
  136. package/SVF-doxygen/html/search/enumvalues_5.js +50 -50
  137. package/SVF-doxygen/html/search/enumvalues_6.js +6 -6
  138. package/SVF-doxygen/html/search/enumvalues_7.js +8 -8
  139. package/SVF-doxygen/html/search/enumvalues_8.js +24 -24
  140. package/SVF-doxygen/html/search/enumvalues_9.js +6 -6
  141. package/SVF-doxygen/html/search/enumvalues_a.js +17 -17
  142. package/SVF-doxygen/html/search/enumvalues_b.js +11 -11
  143. package/SVF-doxygen/html/search/enumvalues_c.js +5 -5
  144. package/SVF-doxygen/html/search/enumvalues_d.js +19 -19
  145. package/SVF-doxygen/html/search/enumvalues_e.js +9 -9
  146. package/SVF-doxygen/html/search/enumvalues_f.js +48 -48
  147. package/SVF-doxygen/html/search/files_0.js +18 -18
  148. package/SVF-doxygen/html/search/files_1.js +9 -9
  149. package/SVF-doxygen/html/search/files_10.js +8 -8
  150. package/SVF-doxygen/html/search/files_11.js +8 -8
  151. package/SVF-doxygen/html/search/files_12.js +2 -2
  152. package/SVF-doxygen/html/search/files_2.js +51 -51
  153. package/SVF-doxygen/html/search/files_3.js +14 -14
  154. package/SVF-doxygen/html/search/files_4.js +3 -3
  155. package/SVF-doxygen/html/search/files_5.js +13 -13
  156. package/SVF-doxygen/html/search/files_6.js +10 -10
  157. package/SVF-doxygen/html/search/files_7.js +15 -15
  158. package/SVF-doxygen/html/search/files_8.js +13 -13
  159. package/SVF-doxygen/html/search/files_9.js +18 -18
  160. package/SVF-doxygen/html/search/files_a.js +3 -3
  161. package/SVF-doxygen/html/search/files_b.js +4 -4
  162. package/SVF-doxygen/html/search/files_c.js +20 -20
  163. package/SVF-doxygen/html/search/files_d.js +4 -4
  164. package/SVF-doxygen/html/search/files_e.js +56 -57
  165. package/SVF-doxygen/html/search/files_f.js +8 -8
  166. package/SVF-doxygen/html/search/functions_0.js +13 -13
  167. package/SVF-doxygen/html/search/functions_1.js +366 -366
  168. package/SVF-doxygen/html/search/functions_10.js +140 -140
  169. package/SVF-doxygen/html/search/functions_11.js +140 -140
  170. package/SVF-doxygen/html/search/functions_12.js +291 -293
  171. package/SVF-doxygen/html/search/functions_13.js +52 -52
  172. package/SVF-doxygen/html/search/functions_14.js +41 -41
  173. package/SVF-doxygen/html/search/functions_15.js +70 -70
  174. package/SVF-doxygen/html/search/functions_16.js +38 -38
  175. package/SVF-doxygen/html/search/functions_17.js +3 -3
  176. package/SVF-doxygen/html/search/functions_18.js +174 -174
  177. package/SVF-doxygen/html/search/functions_2.js +92 -92
  178. package/SVF-doxygen/html/search/functions_3.js +257 -257
  179. package/SVF-doxygen/html/search/functions_4.js +85 -85
  180. package/SVF-doxygen/html/search/functions_5.js +54 -54
  181. package/SVF-doxygen/html/search/functions_6.js +65 -65
  182. package/SVF-doxygen/html/search/functions_7.js +857 -857
  183. package/SVF-doxygen/html/search/functions_8.js +164 -176
  184. package/SVF-doxygen/html/search/functions_9.js +439 -436
  185. package/SVF-doxygen/html/search/functions_a.js +30 -30
  186. package/SVF-doxygen/html/search/functions_b.js +2 -2
  187. package/SVF-doxygen/html/search/functions_c.js +22 -22
  188. package/SVF-doxygen/html/search/functions_d.js +81 -81
  189. package/SVF-doxygen/html/search/functions_e.js +34 -34
  190. package/SVF-doxygen/html/search/functions_f.js +58 -58
  191. package/SVF-doxygen/html/search/namespaces_0.js +1 -1
  192. package/SVF-doxygen/html/search/namespaces_1.js +7 -7
  193. package/SVF-doxygen/html/search/related_0.js +4 -4
  194. package/SVF-doxygen/html/search/related_1.js +2 -2
  195. package/SVF-doxygen/html/search/related_2.js +2 -2
  196. package/SVF-doxygen/html/search/related_3.js +2 -2
  197. package/SVF-doxygen/html/search/related_4.js +2 -2
  198. package/SVF-doxygen/html/search/related_5.js +1 -1
  199. package/SVF-doxygen/html/search/related_6.js +2 -2
  200. package/SVF-doxygen/html/search/related_7.js +5 -5
  201. package/SVF-doxygen/html/search/related_8.js +2 -2
  202. package/SVF-doxygen/html/search/related_9.js +4 -4
  203. package/SVF-doxygen/html/search/related_a.js +19 -19
  204. package/SVF-doxygen/html/search/related_b.js +4 -4
  205. package/SVF-doxygen/html/search/related_c.js +2 -2
  206. package/SVF-doxygen/html/search/related_d.js +11 -11
  207. package/SVF-doxygen/html/search/related_e.js +2 -2
  208. package/SVF-doxygen/html/search/related_f.js +2 -2
  209. package/SVF-doxygen/html/search/typedefs_0.js +20 -20
  210. package/SVF-doxygen/html/search/typedefs_1.js +27 -27
  211. package/SVF-doxygen/html/search/typedefs_10.js +65 -65
  212. package/SVF-doxygen/html/search/typedefs_11.js +12 -12
  213. package/SVF-doxygen/html/search/typedefs_12.js +13 -13
  214. package/SVF-doxygen/html/search/typedefs_13.js +40 -40
  215. package/SVF-doxygen/html/search/typedefs_14.js +11 -11
  216. package/SVF-doxygen/html/search/typedefs_2.js +125 -125
  217. package/SVF-doxygen/html/search/typedefs_3.js +39 -39
  218. package/SVF-doxygen/html/search/typedefs_4.js +17 -17
  219. package/SVF-doxygen/html/search/typedefs_5.js +42 -42
  220. package/SVF-doxygen/html/search/typedefs_6.js +54 -54
  221. package/SVF-doxygen/html/search/typedefs_7.js +47 -47
  222. package/SVF-doxygen/html/search/typedefs_8.js +1 -1
  223. package/SVF-doxygen/html/search/typedefs_9.js +4 -4
  224. package/SVF-doxygen/html/search/typedefs_a.js +28 -28
  225. package/SVF-doxygen/html/search/typedefs_b.js +29 -29
  226. package/SVF-doxygen/html/search/typedefs_c.js +41 -41
  227. package/SVF-doxygen/html/search/typedefs_d.js +15 -15
  228. package/SVF-doxygen/html/search/typedefs_e.js +52 -52
  229. package/SVF-doxygen/html/search/typedefs_f.js +14 -14
  230. package/SVF-doxygen/html/search/variables_0.js +169 -170
  231. package/SVF-doxygen/html/search/variables_1.js +78 -78
  232. package/SVF-doxygen/html/search/variables_10.js +98 -98
  233. package/SVF-doxygen/html/search/variables_11.js +47 -47
  234. package/SVF-doxygen/html/search/variables_12.js +93 -93
  235. package/SVF-doxygen/html/search/variables_13.js +76 -76
  236. package/SVF-doxygen/html/search/variables_14.js +14 -14
  237. package/SVF-doxygen/html/search/variables_15.js +49 -49
  238. package/SVF-doxygen/html/search/variables_16.js +11 -11
  239. package/SVF-doxygen/html/search/variables_17.js +1 -1
  240. package/SVF-doxygen/html/search/variables_18.js +17 -17
  241. package/SVF-doxygen/html/search/variables_2.js +40 -40
  242. package/SVF-doxygen/html/search/variables_3.js +143 -143
  243. package/SVF-doxygen/html/search/variables_4.js +51 -51
  244. package/SVF-doxygen/html/search/variables_5.js +39 -39
  245. package/SVF-doxygen/html/search/variables_6.js +66 -66
  246. package/SVF-doxygen/html/search/variables_7.js +32 -32
  247. package/SVF-doxygen/html/search/variables_8.js +8 -8
  248. package/SVF-doxygen/html/search/variables_9.js +80 -80
  249. package/SVF-doxygen/html/search/variables_a.js +4 -4
  250. package/SVF-doxygen/html/search/variables_b.js +10 -10
  251. package/SVF-doxygen/html/search/variables_c.js +44 -44
  252. package/SVF-doxygen/html/search/variables_d.js +58 -58
  253. package/SVF-doxygen/html/search/variables_e.js +123 -123
  254. package/SVF-doxygen/html/search/variables_f.js +31 -31
  255. package/SVF-doxygen/html/svf-ex_8cpp.html +199 -197
  256. package/SVF-doxygen/html/svf-ex_8cpp_source.html +204 -202
  257. package/package.json +1 -1
  258. package/svf/include/AE/Svfexe/AbstractInterpretation.h +28 -21
  259. package/svf/include/AE/Svfexe/SVFIR2AbsState.h +37 -67
  260. package/svf/lib/AE/Svfexe/AbstractInterpretation.cpp +123 -139
  261. package/svf/lib/AE/Svfexe/BufOverflowChecker.cpp +52 -42
  262. package/svf/lib/AE/Svfexe/SVFIR2AbsState.cpp +134 -146
  263. package/svf-llvm/tools/Example/svf-ex.cpp +13 -12
  264. package/svf/lib/AE/Core/SVFIR2Relation.cpp +0 -193
package/SVF-doxygen/html/BufOverflowChecker_8cpp_source.html CHANGED
@@ -133,801 +133,812 @@ $(function() {
133
133
  <div class="line"><a name="l00062"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#a0b79c3694a08100d2d8d1b8109998131"> 62</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0b79c3694a08100d2d8d1b8109998131">BufOverflowChecker::handleSVFStatement</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFStmt.html">SVFStmt</a> *stmt)</div>
134
134
  <div class="line"><a name="l00063"></a><span class="lineno"> 63</span>&#160;{</div>
135
135
  <div class="line"><a name="l00064"></a><span class="lineno"> 64</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a896d04a02951947bc228bf97b2c00313">AbstractInterpretation::handleSVFStatement</a>(stmt);</div>
136
- <div class="line"><a name="l00065"></a><span class="lineno"> 65</span>&#160; <span class="comment">// for gep stmt, add the gep stmt to the addrToGep map</span></div>
137
- <div class="line"><a name="l00066"></a><span class="lineno"> 66</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1GepStmt.html">GepStmt</a> *gep = SVFUtil::dyn_cast&lt;GepStmt&gt;(stmt))</div>
138
- <div class="line"><a name="l00067"></a><span class="lineno"> 67</span>&#160; {</div>
139
- <div class="line"><a name="l00068"></a><span class="lineno"> 68</span>&#160; <span class="keywordflow">for</span> (<a class="code" href="namespaceSVF.html#a43a65e0d33af3c743294f7a1139d2301">NodeID</a> addrID:</div>
140
- <div class="line"><a name="l00069"></a><span class="lineno"> 69</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#aa3e62b9ef912def502b95992199f5d8c">getAddrs</a>(gep-&gt;getLHSVarID()).<a class="code" href="structSVF_1_1AbstractValue.html#ab1fe6a57f784971b3bc603dbfda746e8">getAddrs</a>())</div>
141
- <div class="line"><a name="l00070"></a><span class="lineno"> 70</span>&#160; {</div>
142
- <div class="line"><a name="l00071"></a><span class="lineno"> 71</span>&#160; <a class="code" href="namespaceSVF.html#a43a65e0d33af3c743294f7a1139d2301">NodeID</a> objId = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#ac37760566b534d89a61d789b00efb993">getInternalID</a>(addrID);</div>
143
- <div class="line"><a name="l00072"></a><span class="lineno"> 72</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>[objId] = gep;</div>
144
- <div class="line"><a name="l00073"></a><span class="lineno"> 73</span>&#160; }</div>
145
- <div class="line"><a name="l00074"></a><span class="lineno"> 74</span>&#160; }</div>
146
- <div class="line"><a name="l00075"></a><span class="lineno"> 75</span>&#160;}</div>
147
- <div class="line"><a name="l00076"></a><span class="lineno"> 76</span>&#160; </div>
148
- <div class="line"><a name="l00077"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#aed959fce840cbea32d3567ee1ac01e82"> 77</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#aed959fce840cbea32d3567ee1ac01e82">BufOverflowChecker::initExtAPIBufOverflowCheckRules</a>()</div>
149
- <div class="line"><a name="l00078"></a><span class="lineno"> 78</span>&#160;{</div>
150
- <div class="line"><a name="l00079"></a><span class="lineno"> 79</span>&#160; <span class="comment">//void llvm_memcpy_p0i8_p0i8_i64(char* dst, char* src, int sz, int flag){}</span></div>
151
- <div class="line"><a name="l00080"></a><span class="lineno"> 80</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memcpy_p0i8_p0i8_i64&quot;</span>] = {{0, 2}, {1,2}};</div>
152
- <div class="line"><a name="l00081"></a><span class="lineno"> 81</span>&#160; <span class="comment">//void llvm_memcpy_p0_p0_i64(char* dst, char* src, int sz, int flag){}</span></div>
153
- <div class="line"><a name="l00082"></a><span class="lineno"> 82</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memcpy_p0_p0_i64&quot;</span>] = {{0, 2}, {1,2}};</div>
154
- <div class="line"><a name="l00083"></a><span class="lineno"> 83</span>&#160; <span class="comment">//void llvm_memcpy_p0i8_p0i8_i32(char* dst, char* src, int sz, int flag){}</span></div>
155
- <div class="line"><a name="l00084"></a><span class="lineno"> 84</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memcpy_p0i8_p0i8_i32&quot;</span>] = {{0, 2}, {1,2}};</div>
156
- <div class="line"><a name="l00085"></a><span class="lineno"> 85</span>&#160; <span class="comment">//void llvm_memcpy(char* dst, char* src, int sz, int flag){}</span></div>
157
- <div class="line"><a name="l00086"></a><span class="lineno"> 86</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memcpy&quot;</span>] = {{0, 2}, {1,2}};</div>
158
- <div class="line"><a name="l00087"></a><span class="lineno"> 87</span>&#160; <span class="comment">//void llvm_memmove(char* dst, char* src, int sz, int flag){}</span></div>
159
- <div class="line"><a name="l00088"></a><span class="lineno"> 88</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memmove&quot;</span>] = {{0, 2}, {1,2}};</div>
160
- <div class="line"><a name="l00089"></a><span class="lineno"> 89</span>&#160; <span class="comment">//void llvm_memmove_p0i8_p0i8_i64(char* dst, char* src, int sz, int flag){}</span></div>
161
- <div class="line"><a name="l00090"></a><span class="lineno"> 90</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memmove_p0i8_p0i8_i64&quot;</span>] = {{0, 2}, {1,2}};</div>
162
- <div class="line"><a name="l00091"></a><span class="lineno"> 91</span>&#160; <span class="comment">//void llvm_memmove_p0_p0_i64(char* dst, char* src, int sz, int flag){}</span></div>
163
- <div class="line"><a name="l00092"></a><span class="lineno"> 92</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memmove_p0_p0_i64&quot;</span>] = {{0, 2}, {1,2}};</div>
164
- <div class="line"><a name="l00093"></a><span class="lineno"> 93</span>&#160; <span class="comment">//void llvm_memmove_p0i8_p0i8_i32(char* dst, char* src, int sz, int flag){}</span></div>
165
- <div class="line"><a name="l00094"></a><span class="lineno"> 94</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memmove_p0i8_p0i8_i32&quot;</span>] = {{0, 2}, {1,2}};</div>
166
- <div class="line"><a name="l00095"></a><span class="lineno"> 95</span>&#160; <span class="comment">//void __memcpy_chk(char* dst, char* src, int sz, int flag){}</span></div>
167
- <div class="line"><a name="l00096"></a><span class="lineno"> 96</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;__memcpy_chk&quot;</span>] = {{0, 2}, {1,2}};</div>
168
- <div class="line"><a name="l00097"></a><span class="lineno"> 97</span>&#160; <span class="comment">//void *memmove(void *str1, const void *str2, unsigned long n)</span></div>
169
- <div class="line"><a name="l00098"></a><span class="lineno"> 98</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;memmove&quot;</span>] = {{0, 2}, {1,2}};</div>
170
- <div class="line"><a name="l00099"></a><span class="lineno"> 99</span>&#160; <span class="comment">//void bcopy(const void *s1, void *s2, unsigned long n){}</span></div>
171
- <div class="line"><a name="l00100"></a><span class="lineno"> 100</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;bcopy&quot;</span>] = {{0, 2}, {1,2}};</div>
172
- <div class="line"><a name="l00101"></a><span class="lineno"> 101</span>&#160; <span class="comment">//void *memccpy( void * restrict dest, const void * restrict src, int c, unsigned long count)</span></div>
173
- <div class="line"><a name="l00102"></a><span class="lineno"> 102</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;memccpy&quot;</span>] = {{0, 3}, {1,3}};</div>
174
- <div class="line"><a name="l00103"></a><span class="lineno"> 103</span>&#160; <span class="comment">//void __memmove_chk(char* dst, char* src, int sz){}</span></div>
175
- <div class="line"><a name="l00104"></a><span class="lineno"> 104</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;__memmove_chk&quot;</span>] = {{0, 2}, {1,2}};</div>
176
- <div class="line"><a name="l00105"></a><span class="lineno"> 105</span>&#160; <span class="comment">//void llvm_memset(char* dst, char elem, int sz, int flag){}</span></div>
177
- <div class="line"><a name="l00106"></a><span class="lineno"> 106</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memset&quot;</span>] = {{0, 2}};</div>
178
- <div class="line"><a name="l00107"></a><span class="lineno"> 107</span>&#160; <span class="comment">//void llvm_memset_p0i8_i32(char* dst, char elem, int sz, int flag){}</span></div>
179
- <div class="line"><a name="l00108"></a><span class="lineno"> 108</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memset_p0i8_i32&quot;</span>] = {{0, 2}};</div>
180
- <div class="line"><a name="l00109"></a><span class="lineno"> 109</span>&#160; <span class="comment">//void llvm_memset_p0i8_i64(char* dst, char elem, int sz, int flag){}</span></div>
181
- <div class="line"><a name="l00110"></a><span class="lineno"> 110</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memset_p0i8_i64&quot;</span>] = {{0, 2}};</div>
182
- <div class="line"><a name="l00111"></a><span class="lineno"> 111</span>&#160; <span class="comment">//void llvm_memset_p0_i64(char* dst, char elem, int sz, int flag){}</span></div>
183
- <div class="line"><a name="l00112"></a><span class="lineno"> 112</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memset_p0_i64&quot;</span>] = {{0, 2}};</div>
184
- <div class="line"><a name="l00113"></a><span class="lineno"> 113</span>&#160; <span class="comment">//char *__memset_chk(char * dest, int c, unsigned long destlen, int flag)</span></div>
185
- <div class="line"><a name="l00114"></a><span class="lineno"> 114</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;__memset_chk&quot;</span>] = {{0, 2}};</div>
186
- <div class="line"><a name="l00115"></a><span class="lineno"> 115</span>&#160; <span class="comment">//char *wmemset(wchar_t * dst, wchar_t elem, int sz, int flag) {</span></div>
187
- <div class="line"><a name="l00116"></a><span class="lineno"> 116</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;wmemset&quot;</span>] = {{0, 2}};</div>
188
- <div class="line"><a name="l00117"></a><span class="lineno"> 117</span>&#160; <span class="comment">//char *strncpy(char *dest, const char *src, unsigned long n)</span></div>
189
- <div class="line"><a name="l00118"></a><span class="lineno"> 118</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;strncpy&quot;</span>] = {{0, 2}, {1,2}};</div>
190
- <div class="line"><a name="l00119"></a><span class="lineno"> 119</span>&#160; <span class="comment">//unsigned long iconv(void* cd, char **restrict inbuf, unsigned long *restrict inbytesleft, char **restrict outbuf, unsigned long *restrict outbytesleft)</span></div>
191
- <div class="line"><a name="l00120"></a><span class="lineno"> 120</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;iconv&quot;</span>] = {{1, 2}, {3, 4}};</div>
192
- <div class="line"><a name="l00121"></a><span class="lineno"> 121</span>&#160;}</div>
193
- <div class="line"><a name="l00122"></a><span class="lineno"> 122</span>&#160; </div>
136
+ <div class="line"><a name="l00065"></a><span class="lineno"> 65</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp; es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a11ceda75dbe328bcabdc6ff6919f9526">getState</a>(stmt-&gt;<a class="code" href="classSVF_1_1SVFStmt.html#aa809a57c8cdaaa35dfc3cc0f3b33b52b">getICFGNode</a>());</div>
137
+ <div class="line"><a name="l00066"></a><span class="lineno"> 66</span>&#160; <span class="comment">// for gep stmt, add the gep stmt to the addrToGep map</span></div>
138
+ <div class="line"><a name="l00067"></a><span class="lineno"> 67</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1GepStmt.html">GepStmt</a> *gep = SVFUtil::dyn_cast&lt;GepStmt&gt;(stmt))</div>
139
+ <div class="line"><a name="l00068"></a><span class="lineno"> 68</span>&#160; {</div>
140
+ <div class="line"><a name="l00069"></a><span class="lineno"> 69</span>&#160; <span class="keywordflow">for</span> (<a class="code" href="namespaceSVF.html#a43a65e0d33af3c743294f7a1139d2301">NodeID</a> addrID:</div>
141
+ <div class="line"><a name="l00070"></a><span class="lineno"> 70</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a611ac228efd661b301ea1dd675cd1c0c">getAddrs</a>(es, gep-&gt;getLHSVarID()).<a class="code" href="structSVF_1_1AbstractValue.html#ab1fe6a57f784971b3bc603dbfda746e8">getAddrs</a>())</div>
142
+ <div class="line"><a name="l00071"></a><span class="lineno"> 71</span>&#160; {</div>
143
+ <div class="line"><a name="l00072"></a><span class="lineno"> 72</span>&#160; <a class="code" href="namespaceSVF.html#a43a65e0d33af3c743294f7a1139d2301">NodeID</a> objId = <a class="code" href="classSVF_1_1AbstractState.html#aaabe5850dbf1620c6058f5ac6cb169b6">AbstractState::getInternalID</a>(addrID);</div>
144
+ <div class="line"><a name="l00073"></a><span class="lineno"> 73</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>[objId] = gep;</div>
145
+ <div class="line"><a name="l00074"></a><span class="lineno"> 74</span>&#160; }</div>
146
+ <div class="line"><a name="l00075"></a><span class="lineno"> 75</span>&#160; }</div>
147
+ <div class="line"><a name="l00076"></a><span class="lineno"> 76</span>&#160;}</div>
148
+ <div class="line"><a name="l00077"></a><span class="lineno"> 77</span>&#160; </div>
149
+ <div class="line"><a name="l00078"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#aed959fce840cbea32d3567ee1ac01e82"> 78</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#aed959fce840cbea32d3567ee1ac01e82">BufOverflowChecker::initExtAPIBufOverflowCheckRules</a>()</div>
150
+ <div class="line"><a name="l00079"></a><span class="lineno"> 79</span>&#160;{</div>
151
+ <div class="line"><a name="l00080"></a><span class="lineno"> 80</span>&#160; <span class="comment">//void llvm_memcpy_p0i8_p0i8_i64(char* dst, char* src, int sz, int flag){}</span></div>
152
+ <div class="line"><a name="l00081"></a><span class="lineno"> 81</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memcpy_p0i8_p0i8_i64&quot;</span>] = {{0, 2}, {1,2}};</div>
153
+ <div class="line"><a name="l00082"></a><span class="lineno"> 82</span>&#160; <span class="comment">//void llvm_memcpy_p0_p0_i64(char* dst, char* src, int sz, int flag){}</span></div>
154
+ <div class="line"><a name="l00083"></a><span class="lineno"> 83</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memcpy_p0_p0_i64&quot;</span>] = {{0, 2}, {1,2}};</div>
155
+ <div class="line"><a name="l00084"></a><span class="lineno"> 84</span>&#160; <span class="comment">//void llvm_memcpy_p0i8_p0i8_i32(char* dst, char* src, int sz, int flag){}</span></div>
156
+ <div class="line"><a name="l00085"></a><span class="lineno"> 85</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memcpy_p0i8_p0i8_i32&quot;</span>] = {{0, 2}, {1,2}};</div>
157
+ <div class="line"><a name="l00086"></a><span class="lineno"> 86</span>&#160; <span class="comment">//void llvm_memcpy(char* dst, char* src, int sz, int flag){}</span></div>
158
+ <div class="line"><a name="l00087"></a><span class="lineno"> 87</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memcpy&quot;</span>] = {{0, 2}, {1,2}};</div>
159
+ <div class="line"><a name="l00088"></a><span class="lineno"> 88</span>&#160; <span class="comment">//void llvm_memmove(char* dst, char* src, int sz, int flag){}</span></div>
160
+ <div class="line"><a name="l00089"></a><span class="lineno"> 89</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memmove&quot;</span>] = {{0, 2}, {1,2}};</div>
161
+ <div class="line"><a name="l00090"></a><span class="lineno"> 90</span>&#160; <span class="comment">//void llvm_memmove_p0i8_p0i8_i64(char* dst, char* src, int sz, int flag){}</span></div>
162
+ <div class="line"><a name="l00091"></a><span class="lineno"> 91</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memmove_p0i8_p0i8_i64&quot;</span>] = {{0, 2}, {1,2}};</div>
163
+ <div class="line"><a name="l00092"></a><span class="lineno"> 92</span>&#160; <span class="comment">//void llvm_memmove_p0_p0_i64(char* dst, char* src, int sz, int flag){}</span></div>
164
+ <div class="line"><a name="l00093"></a><span class="lineno"> 93</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memmove_p0_p0_i64&quot;</span>] = {{0, 2}, {1,2}};</div>
165
+ <div class="line"><a name="l00094"></a><span class="lineno"> 94</span>&#160; <span class="comment">//void llvm_memmove_p0i8_p0i8_i32(char* dst, char* src, int sz, int flag){}</span></div>
166
+ <div class="line"><a name="l00095"></a><span class="lineno"> 95</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memmove_p0i8_p0i8_i32&quot;</span>] = {{0, 2}, {1,2}};</div>
167
+ <div class="line"><a name="l00096"></a><span class="lineno"> 96</span>&#160; <span class="comment">//void __memcpy_chk(char* dst, char* src, int sz, int flag){}</span></div>
168
+ <div class="line"><a name="l00097"></a><span class="lineno"> 97</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;__memcpy_chk&quot;</span>] = {{0, 2}, {1,2}};</div>
169
+ <div class="line"><a name="l00098"></a><span class="lineno"> 98</span>&#160; <span class="comment">//void *memmove(void *str1, const void *str2, unsigned long n)</span></div>
170
+ <div class="line"><a name="l00099"></a><span class="lineno"> 99</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;memmove&quot;</span>] = {{0, 2}, {1,2}};</div>
171
+ <div class="line"><a name="l00100"></a><span class="lineno"> 100</span>&#160; <span class="comment">//void bcopy(const void *s1, void *s2, unsigned long n){}</span></div>
172
+ <div class="line"><a name="l00101"></a><span class="lineno"> 101</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;bcopy&quot;</span>] = {{0, 2}, {1,2}};</div>
173
+ <div class="line"><a name="l00102"></a><span class="lineno"> 102</span>&#160; <span class="comment">//void *memccpy( void * restrict dest, const void * restrict src, int c, unsigned long count)</span></div>
174
+ <div class="line"><a name="l00103"></a><span class="lineno"> 103</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;memccpy&quot;</span>] = {{0, 3}, {1,3}};</div>
175
+ <div class="line"><a name="l00104"></a><span class="lineno"> 104</span>&#160; <span class="comment">//void __memmove_chk(char* dst, char* src, int sz){}</span></div>
176
+ <div class="line"><a name="l00105"></a><span class="lineno"> 105</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;__memmove_chk&quot;</span>] = {{0, 2}, {1,2}};</div>
177
+ <div class="line"><a name="l00106"></a><span class="lineno"> 106</span>&#160; <span class="comment">//void llvm_memset(char* dst, char elem, int sz, int flag){}</span></div>
178
+ <div class="line"><a name="l00107"></a><span class="lineno"> 107</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memset&quot;</span>] = {{0, 2}};</div>
179
+ <div class="line"><a name="l00108"></a><span class="lineno"> 108</span>&#160; <span class="comment">//void llvm_memset_p0i8_i32(char* dst, char elem, int sz, int flag){}</span></div>
180
+ <div class="line"><a name="l00109"></a><span class="lineno"> 109</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memset_p0i8_i32&quot;</span>] = {{0, 2}};</div>
181
+ <div class="line"><a name="l00110"></a><span class="lineno"> 110</span>&#160; <span class="comment">//void llvm_memset_p0i8_i64(char* dst, char elem, int sz, int flag){}</span></div>
182
+ <div class="line"><a name="l00111"></a><span class="lineno"> 111</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memset_p0i8_i64&quot;</span>] = {{0, 2}};</div>
183
+ <div class="line"><a name="l00112"></a><span class="lineno"> 112</span>&#160; <span class="comment">//void llvm_memset_p0_i64(char* dst, char elem, int sz, int flag){}</span></div>
184
+ <div class="line"><a name="l00113"></a><span class="lineno"> 113</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memset_p0_i64&quot;</span>] = {{0, 2}};</div>
185
+ <div class="line"><a name="l00114"></a><span class="lineno"> 114</span>&#160; <span class="comment">//char *__memset_chk(char * dest, int c, unsigned long destlen, int flag)</span></div>
186
+ <div class="line"><a name="l00115"></a><span class="lineno"> 115</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;__memset_chk&quot;</span>] = {{0, 2}};</div>
187
+ <div class="line"><a name="l00116"></a><span class="lineno"> 116</span>&#160; <span class="comment">//char *wmemset(wchar_t * dst, wchar_t elem, int sz, int flag) {</span></div>
188
+ <div class="line"><a name="l00117"></a><span class="lineno"> 117</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;wmemset&quot;</span>] = {{0, 2}};</div>
189
+ <div class="line"><a name="l00118"></a><span class="lineno"> 118</span>&#160; <span class="comment">//char *strncpy(char *dest, const char *src, unsigned long n)</span></div>
190
+ <div class="line"><a name="l00119"></a><span class="lineno"> 119</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;strncpy&quot;</span>] = {{0, 2}, {1,2}};</div>
191
+ <div class="line"><a name="l00120"></a><span class="lineno"> 120</span>&#160; <span class="comment">//unsigned long iconv(void* cd, char **restrict inbuf, unsigned long *restrict inbytesleft, char **restrict outbuf, unsigned long *restrict outbytesleft)</span></div>
192
+ <div class="line"><a name="l00121"></a><span class="lineno"> 121</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;iconv&quot;</span>] = {{1, 2}, {3, 4}};</div>
193
+ <div class="line"><a name="l00122"></a><span class="lineno"> 122</span>&#160;}</div>
194
194
  <div class="line"><a name="l00123"></a><span class="lineno"> 123</span>&#160; </div>
195
- <div class="line"><a name="l00124"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#ad8b2f2fa6f22b9d1655135c819cbad8a"> 124</a></span>&#160;<span class="keywordtype">bool</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad8b2f2fa6f22b9d1655135c819cbad8a">BufOverflowChecker::detectStrcpy</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a> *call)</div>
196
- <div class="line"><a name="l00125"></a><span class="lineno"> 125</span>&#160;{</div>
197
- <div class="line"><a name="l00126"></a><span class="lineno"> 126</span>&#160; <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> cs = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a9815a5b31ac7dc21239d08e5b9f61106">SVFUtil::getSVFCallSite</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
198
- <div class="line"><a name="l00127"></a><span class="lineno"> 127</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg0Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(0);</div>
199
- <div class="line"><a name="l00128"></a><span class="lineno"> 128</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg1Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(1);</div>
200
- <div class="line"><a name="l00129"></a><span class="lineno"> 129</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> strLen = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a5bba3c0570d73acc743742a30af1b0b4">getStrlen</a>(arg1Val);</div>
201
- <div class="line"><a name="l00130"></a><span class="lineno"> 130</span>&#160; <span class="comment">// no need to -1, since it has \0 as the last byte</span></div>
202
- <div class="line"><a name="l00131"></a><span class="lineno"> 131</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(arg0Val, strLen, call);</div>
203
- <div class="line"><a name="l00132"></a><span class="lineno"> 132</span>&#160;}</div>
204
- <div class="line"><a name="l00133"></a><span class="lineno"> 133</span>&#160; </div>
205
- <div class="line"><a name="l00134"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#af0e2276001df7d51c45b22d5d11ca09b"> 134</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#af0e2276001df7d51c45b22d5d11ca09b">BufOverflowChecker::initExtFunMap</a>()</div>
206
- <div class="line"><a name="l00135"></a><span class="lineno"> 135</span>&#160;{</div>
207
- <div class="line"><a name="l00136"></a><span class="lineno"> 136</span>&#160; </div>
208
- <div class="line"><a name="l00137"></a><span class="lineno"> 137</span>&#160; <span class="keyword">auto</span> sse_scanf = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
209
- <div class="line"><a name="l00138"></a><span class="lineno"> 138</span>&#160; {</div>
210
- <div class="line"><a name="l00139"></a><span class="lineno"> 139</span>&#160; <span class="comment">//scanf(&quot;%d&quot;, &amp;data);</span></div>
211
- <div class="line"><a name="l00140"></a><span class="lineno"> 140</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 2) <span class="keywordflow">return</span>;</div>
212
- <div class="line"><a name="l00141"></a><span class="lineno"> 141</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>();</div>
213
- <div class="line"><a name="l00142"></a><span class="lineno"> 142</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> dst_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
214
- <div class="line"><a name="l00143"></a><span class="lineno"> 143</span>&#160; <span class="keywordflow">if</span> (!<a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a62baa9403069a9b1e010eaeb2f6b9b34">inVarToAddrsTable</a>(dst_id))</div>
215
- <div class="line"><a name="l00144"></a><span class="lineno"> 144</span>&#160; {</div>
216
- <div class="line"><a name="l00145"></a><span class="lineno"> 145</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<span class="stringliteral">&quot;scanf may cause buffer overflow.\n&quot;</span>, 0, 0, 0, 0, cs.getArgument(1));</div>
217
- <div class="line"><a name="l00146"></a><span class="lineno"> 146</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
218
- <div class="line"><a name="l00147"></a><span class="lineno"> 147</span>&#160; <span class="keywordflow">return</span>;</div>
219
- <div class="line"><a name="l00148"></a><span class="lineno"> 148</span>&#160; }</div>
220
- <div class="line"><a name="l00149"></a><span class="lineno"> 149</span>&#160; <span class="keywordflow">else</span></div>
221
- <div class="line"><a name="l00150"></a><span class="lineno"> 150</span>&#160; {</div>
222
- <div class="line"><a name="l00151"></a><span class="lineno"> 151</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> Addrs = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#aa3e62b9ef912def502b95992199f5d8c">getAddrs</a>(dst_id);</div>
223
- <div class="line"><a name="l00152"></a><span class="lineno"> 152</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> vaddr: Addrs.<a class="code" href="structSVF_1_1AbstractValue.html#ab1fe6a57f784971b3bc603dbfda746e8">getAddrs</a>())</div>
224
- <div class="line"><a name="l00153"></a><span class="lineno"> 153</span>&#160; {</div>
225
- <div class="line"><a name="l00154"></a><span class="lineno"> 154</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> objId = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#ac37760566b534d89a61d789b00efb993">getInternalID</a>(vaddr);</div>
226
- <div class="line"><a name="l00155"></a><span class="lineno"> 155</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> range = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a4e032a5e0898f0e349927d5a86c8477c">getRangeLimitFromType</a>(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1GenericGraph.html#a43c9c773bfa17abf481c33073e30d01b">getGNode</a>(objId)-&gt;<a class="code" href="classSVF_1_1SVFVar.html#ab6f95d3e7e099d75cfc9645ebc037047">getType</a>());</div>
227
- <div class="line"><a name="l00156"></a><span class="lineno"> 156</span>&#160; es.<a class="code" href="classSVF_1_1AbstractState.html#a1f935ea8ab16b04699284bf92bbbb23c">store</a>(vaddr, range);</div>
228
- <div class="line"><a name="l00157"></a><span class="lineno"> 157</span>&#160; }</div>
229
- <div class="line"><a name="l00158"></a><span class="lineno"> 158</span>&#160; }</div>
230
- <div class="line"><a name="l00159"></a><span class="lineno"> 159</span>&#160; };</div>
231
- <div class="line"><a name="l00160"></a><span class="lineno"> 160</span>&#160; <span class="keyword">auto</span> sse_fscanf = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
232
- <div class="line"><a name="l00161"></a><span class="lineno"> 161</span>&#160; {</div>
233
- <div class="line"><a name="l00162"></a><span class="lineno"> 162</span>&#160; <span class="comment">//fscanf(stdin, &quot;%d&quot;, &amp;data);</span></div>
234
- <div class="line"><a name="l00163"></a><span class="lineno"> 163</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 3) <span class="keywordflow">return</span>;</div>
235
- <div class="line"><a name="l00164"></a><span class="lineno"> 164</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>();</div>
236
- <div class="line"><a name="l00165"></a><span class="lineno"> 165</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> dst_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(2));</div>
237
- <div class="line"><a name="l00166"></a><span class="lineno"> 166</span>&#160; <span class="keywordflow">if</span> (!<a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a62baa9403069a9b1e010eaeb2f6b9b34">inVarToAddrsTable</a>(dst_id))</div>
238
- <div class="line"><a name="l00167"></a><span class="lineno"> 167</span>&#160; {</div>
239
- <div class="line"><a name="l00168"></a><span class="lineno"> 168</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<span class="stringliteral">&quot;scanf may cause buffer overflow.\n&quot;</span>, 0, 0, 0, 0, cs.getArgument(2));</div>
240
- <div class="line"><a name="l00169"></a><span class="lineno"> 169</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
241
- <div class="line"><a name="l00170"></a><span class="lineno"> 170</span>&#160; <span class="keywordflow">return</span>;</div>
242
- <div class="line"><a name="l00171"></a><span class="lineno"> 171</span>&#160; }</div>
243
- <div class="line"><a name="l00172"></a><span class="lineno"> 172</span>&#160; <span class="keywordflow">else</span></div>
244
- <div class="line"><a name="l00173"></a><span class="lineno"> 173</span>&#160; {</div>
245
- <div class="line"><a name="l00174"></a><span class="lineno"> 174</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> Addrs = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#aa3e62b9ef912def502b95992199f5d8c">getAddrs</a>(dst_id);</div>
246
- <div class="line"><a name="l00175"></a><span class="lineno"> 175</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> vaddr: Addrs.<a class="code" href="structSVF_1_1AbstractValue.html#ab1fe6a57f784971b3bc603dbfda746e8">getAddrs</a>())</div>
247
- <div class="line"><a name="l00176"></a><span class="lineno"> 176</span>&#160; {</div>
248
- <div class="line"><a name="l00177"></a><span class="lineno"> 177</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> objId = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#ac37760566b534d89a61d789b00efb993">getInternalID</a>(vaddr);</div>
249
- <div class="line"><a name="l00178"></a><span class="lineno"> 178</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> range = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a4e032a5e0898f0e349927d5a86c8477c">getRangeLimitFromType</a>(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1GenericGraph.html#a43c9c773bfa17abf481c33073e30d01b">getGNode</a>(objId)-&gt;<a class="code" href="classSVF_1_1SVFVar.html#ab6f95d3e7e099d75cfc9645ebc037047">getType</a>());</div>
250
- <div class="line"><a name="l00179"></a><span class="lineno"> 179</span>&#160; es.<a class="code" href="classSVF_1_1AbstractState.html#a1f935ea8ab16b04699284bf92bbbb23c">store</a>(vaddr, range);</div>
251
- <div class="line"><a name="l00180"></a><span class="lineno"> 180</span>&#160; }</div>
252
- <div class="line"><a name="l00181"></a><span class="lineno"> 181</span>&#160; }</div>
253
- <div class="line"><a name="l00182"></a><span class="lineno"> 182</span>&#160; };</div>
254
- <div class="line"><a name="l00183"></a><span class="lineno"> 183</span>&#160; </div>
255
- <div class="line"><a name="l00184"></a><span class="lineno"> 184</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__isoc99_fscanf&quot;</span>] = sse_fscanf;</div>
256
- <div class="line"><a name="l00185"></a><span class="lineno"> 185</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__isoc99_scanf&quot;</span>] = sse_scanf;</div>
257
- <div class="line"><a name="l00186"></a><span class="lineno"> 186</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__isoc99_vscanf&quot;</span>] = sse_scanf;</div>
258
- <div class="line"><a name="l00187"></a><span class="lineno"> 187</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;fscanf&quot;</span>] = sse_fscanf;</div>
259
- <div class="line"><a name="l00188"></a><span class="lineno"> 188</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;scanf&quot;</span>] = sse_scanf;</div>
260
- <div class="line"><a name="l00189"></a><span class="lineno"> 189</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;sscanf&quot;</span>] = sse_scanf;</div>
261
- <div class="line"><a name="l00190"></a><span class="lineno"> 190</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__isoc99_sscanf&quot;</span>] = sse_scanf;</div>
262
- <div class="line"><a name="l00191"></a><span class="lineno"> 191</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;vscanf&quot;</span>] = sse_scanf;</div>
263
- <div class="line"><a name="l00192"></a><span class="lineno"> 192</span>&#160; </div>
264
- <div class="line"><a name="l00193"></a><span class="lineno"> 193</span>&#160; <span class="keyword">auto</span> sse_fread = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
265
- <div class="line"><a name="l00194"></a><span class="lineno"> 194</span>&#160; {</div>
266
- <div class="line"><a name="l00195"></a><span class="lineno"> 195</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 3) <span class="keywordflow">return</span>;</div>
267
- <div class="line"><a name="l00196"></a><span class="lineno"> 196</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>();</div>
268
- <div class="line"><a name="l00197"></a><span class="lineno"> 197</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> block_count_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(2));</div>
269
- <div class="line"><a name="l00198"></a><span class="lineno"> 198</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> block_size_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
270
- <div class="line"><a name="l00199"></a><span class="lineno"> 199</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> block_count = es[block_count_id];</div>
271
- <div class="line"><a name="l00200"></a><span class="lineno"> 200</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> block_size = es[block_size_id];</div>
272
- <div class="line"><a name="l00201"></a><span class="lineno"> 201</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> block_byte = block_count * block_size;</div>
273
- <div class="line"><a name="l00202"></a><span class="lineno"> 202</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(0), block_byte, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
274
- <div class="line"><a name="l00203"></a><span class="lineno"> 203</span>&#160; };</div>
275
- <div class="line"><a name="l00204"></a><span class="lineno"> 204</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;fread&quot;</span>] = sse_fread;</div>
276
- <div class="line"><a name="l00205"></a><span class="lineno"> 205</span>&#160; </div>
277
- <div class="line"><a name="l00206"></a><span class="lineno"> 206</span>&#160; <span class="keyword">auto</span> sse_sprintf = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
278
- <div class="line"><a name="l00207"></a><span class="lineno"> 207</span>&#160; {</div>
279
- <div class="line"><a name="l00208"></a><span class="lineno"> 208</span>&#160; <span class="comment">// printf is difficult to predict since it has no byte size arguments</span></div>
195
+ <div class="line"><a name="l00124"></a><span class="lineno"> 124</span>&#160; </div>
196
+ <div class="line"><a name="l00125"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#ad8b2f2fa6f22b9d1655135c819cbad8a"> 125</a></span>&#160;<span class="keywordtype">bool</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad8b2f2fa6f22b9d1655135c819cbad8a">BufOverflowChecker::detectStrcpy</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a> *call)</div>
197
+ <div class="line"><a name="l00126"></a><span class="lineno"> 126</span>&#160;{</div>
198
+ <div class="line"><a name="l00127"></a><span class="lineno"> 127</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp; es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a11ceda75dbe328bcabdc6ff6919f9526">getState</a>(call);</div>
199
+ <div class="line"><a name="l00128"></a><span class="lineno"> 128</span>&#160; <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> cs = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a9815a5b31ac7dc21239d08e5b9f61106">SVFUtil::getSVFCallSite</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
200
+ <div class="line"><a name="l00129"></a><span class="lineno"> 129</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg0Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(0);</div>
201
+ <div class="line"><a name="l00130"></a><span class="lineno"> 130</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg1Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(1);</div>
202
+ <div class="line"><a name="l00131"></a><span class="lineno"> 131</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> strLen = <a class="code" href="classSVF_1_1AbstractInterpretation.html#af3c6f27181cc271332919732e490ad1d">getStrlen</a>(es, arg1Val);</div>
203
+ <div class="line"><a name="l00132"></a><span class="lineno"> 132</span>&#160; <span class="comment">// no need to -1, since it has \0 as the last byte</span></div>
204
+ <div class="line"><a name="l00133"></a><span class="lineno"> 133</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(arg0Val, strLen, call);</div>
205
+ <div class="line"><a name="l00134"></a><span class="lineno"> 134</span>&#160;}</div>
206
+ <div class="line"><a name="l00135"></a><span class="lineno"> 135</span>&#160; </div>
207
+ <div class="line"><a name="l00136"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#af0e2276001df7d51c45b22d5d11ca09b"> 136</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#af0e2276001df7d51c45b22d5d11ca09b">BufOverflowChecker::initExtFunMap</a>()</div>
208
+ <div class="line"><a name="l00137"></a><span class="lineno"> 137</span>&#160;{</div>
209
+ <div class="line"><a name="l00138"></a><span class="lineno"> 138</span>&#160; </div>
210
+ <div class="line"><a name="l00139"></a><span class="lineno"> 139</span>&#160; <span class="keyword">auto</span> sse_scanf = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
211
+ <div class="line"><a name="l00140"></a><span class="lineno"> 140</span>&#160; {</div>
212
+ <div class="line"><a name="l00141"></a><span class="lineno"> 141</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
213
+ <div class="line"><a name="l00142"></a><span class="lineno"> 142</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp; es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a11ceda75dbe328bcabdc6ff6919f9526">getState</a>(callNode);</div>
214
+ <div class="line"><a name="l00143"></a><span class="lineno"> 143</span>&#160; <span class="comment">//scanf(&quot;%d&quot;, &amp;data);</span></div>
215
+ <div class="line"><a name="l00144"></a><span class="lineno"> 144</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 2) <span class="keywordflow">return</span>;</div>
216
+ <div class="line"><a name="l00145"></a><span class="lineno"> 145</span>&#160; </div>
217
+ <div class="line"><a name="l00146"></a><span class="lineno"> 146</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> dst_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
218
+ <div class="line"><a name="l00147"></a><span class="lineno"> 147</span>&#160; <span class="keywordflow">if</span> (!<a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#ad42ca3cab47612c78a5d99cedea2f4ba">inVarToAddrsTable</a>(es, dst_id))</div>
219
+ <div class="line"><a name="l00148"></a><span class="lineno"> 148</span>&#160; {</div>
220
+ <div class="line"><a name="l00149"></a><span class="lineno"> 149</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<span class="stringliteral">&quot;scanf may cause buffer overflow.\n&quot;</span>, 0, 0, 0, 0, cs.getArgument(1));</div>
221
+ <div class="line"><a name="l00150"></a><span class="lineno"> 150</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
222
+ <div class="line"><a name="l00151"></a><span class="lineno"> 151</span>&#160; <span class="keywordflow">return</span>;</div>
223
+ <div class="line"><a name="l00152"></a><span class="lineno"> 152</span>&#160; }</div>
224
+ <div class="line"><a name="l00153"></a><span class="lineno"> 153</span>&#160; <span class="keywordflow">else</span></div>
225
+ <div class="line"><a name="l00154"></a><span class="lineno"> 154</span>&#160; {</div>
226
+ <div class="line"><a name="l00155"></a><span class="lineno"> 155</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> Addrs = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a611ac228efd661b301ea1dd675cd1c0c">getAddrs</a>(es, dst_id);</div>
227
+ <div class="line"><a name="l00156"></a><span class="lineno"> 156</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> vaddr: Addrs.<a class="code" href="structSVF_1_1AbstractValue.html#ab1fe6a57f784971b3bc603dbfda746e8">getAddrs</a>())</div>
228
+ <div class="line"><a name="l00157"></a><span class="lineno"> 157</span>&#160; {</div>
229
+ <div class="line"><a name="l00158"></a><span class="lineno"> 158</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> objId = <a class="code" href="classSVF_1_1AbstractState.html#aaabe5850dbf1620c6058f5ac6cb169b6">AbstractState::getInternalID</a>(vaddr);</div>
230
+ <div class="line"><a name="l00159"></a><span class="lineno"> 159</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> range = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a4e032a5e0898f0e349927d5a86c8477c">getRangeLimitFromType</a>(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1GenericGraph.html#a43c9c773bfa17abf481c33073e30d01b">getGNode</a>(objId)-&gt;<a class="code" href="classSVF_1_1SVFVar.html#ab6f95d3e7e099d75cfc9645ebc037047">getType</a>());</div>
231
+ <div class="line"><a name="l00160"></a><span class="lineno"> 160</span>&#160; es.<a class="code" href="classSVF_1_1AbstractState.html#a1f935ea8ab16b04699284bf92bbbb23c">store</a>(vaddr, range);</div>
232
+ <div class="line"><a name="l00161"></a><span class="lineno"> 161</span>&#160; }</div>
233
+ <div class="line"><a name="l00162"></a><span class="lineno"> 162</span>&#160; }</div>
234
+ <div class="line"><a name="l00163"></a><span class="lineno"> 163</span>&#160; };</div>
235
+ <div class="line"><a name="l00164"></a><span class="lineno"> 164</span>&#160; <span class="keyword">auto</span> sse_fscanf = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
236
+ <div class="line"><a name="l00165"></a><span class="lineno"> 165</span>&#160; {</div>
237
+ <div class="line"><a name="l00166"></a><span class="lineno"> 166</span>&#160; <span class="comment">//fscanf(stdin, &quot;%d&quot;, &amp;data);</span></div>
238
+ <div class="line"><a name="l00167"></a><span class="lineno"> 167</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 3) <span class="keywordflow">return</span>;</div>
239
+ <div class="line"><a name="l00168"></a><span class="lineno"> 168</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
240
+ <div class="line"><a name="l00169"></a><span class="lineno"> 169</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp; es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a11ceda75dbe328bcabdc6ff6919f9526">getState</a>(callNode);</div>
241
+ <div class="line"><a name="l00170"></a><span class="lineno"> 170</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> dst_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(2));</div>
242
+ <div class="line"><a name="l00171"></a><span class="lineno"> 171</span>&#160; <span class="keywordflow">if</span> (!<a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#ad42ca3cab47612c78a5d99cedea2f4ba">inVarToAddrsTable</a>(es, dst_id))</div>
243
+ <div class="line"><a name="l00172"></a><span class="lineno"> 172</span>&#160; {</div>
244
+ <div class="line"><a name="l00173"></a><span class="lineno"> 173</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<span class="stringliteral">&quot;scanf may cause buffer overflow.\n&quot;</span>, 0, 0, 0, 0, cs.getArgument(2));</div>
245
+ <div class="line"><a name="l00174"></a><span class="lineno"> 174</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
246
+ <div class="line"><a name="l00175"></a><span class="lineno"> 175</span>&#160; <span class="keywordflow">return</span>;</div>
247
+ <div class="line"><a name="l00176"></a><span class="lineno"> 176</span>&#160; }</div>
248
+ <div class="line"><a name="l00177"></a><span class="lineno"> 177</span>&#160; <span class="keywordflow">else</span></div>
249
+ <div class="line"><a name="l00178"></a><span class="lineno"> 178</span>&#160; {</div>
250
+ <div class="line"><a name="l00179"></a><span class="lineno"> 179</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> Addrs = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a611ac228efd661b301ea1dd675cd1c0c">getAddrs</a>(es, dst_id);</div>
251
+ <div class="line"><a name="l00180"></a><span class="lineno"> 180</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> vaddr: Addrs.<a class="code" href="structSVF_1_1AbstractValue.html#ab1fe6a57f784971b3bc603dbfda746e8">getAddrs</a>())</div>
252
+ <div class="line"><a name="l00181"></a><span class="lineno"> 181</span>&#160; {</div>
253
+ <div class="line"><a name="l00182"></a><span class="lineno"> 182</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> objId = <a class="code" href="classSVF_1_1AbstractState.html#aaabe5850dbf1620c6058f5ac6cb169b6">AbstractState::getInternalID</a>(vaddr);</div>
254
+ <div class="line"><a name="l00183"></a><span class="lineno"> 183</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> range = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a4e032a5e0898f0e349927d5a86c8477c">getRangeLimitFromType</a>(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1GenericGraph.html#a43c9c773bfa17abf481c33073e30d01b">getGNode</a>(objId)-&gt;<a class="code" href="classSVF_1_1SVFVar.html#ab6f95d3e7e099d75cfc9645ebc037047">getType</a>());</div>
255
+ <div class="line"><a name="l00184"></a><span class="lineno"> 184</span>&#160; es.<a class="code" href="classSVF_1_1AbstractState.html#a1f935ea8ab16b04699284bf92bbbb23c">store</a>(vaddr, range);</div>
256
+ <div class="line"><a name="l00185"></a><span class="lineno"> 185</span>&#160; }</div>
257
+ <div class="line"><a name="l00186"></a><span class="lineno"> 186</span>&#160; }</div>
258
+ <div class="line"><a name="l00187"></a><span class="lineno"> 187</span>&#160; };</div>
259
+ <div class="line"><a name="l00188"></a><span class="lineno"> 188</span>&#160; </div>
260
+ <div class="line"><a name="l00189"></a><span class="lineno"> 189</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__isoc99_fscanf&quot;</span>] = sse_fscanf;</div>
261
+ <div class="line"><a name="l00190"></a><span class="lineno"> 190</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__isoc99_scanf&quot;</span>] = sse_scanf;</div>
262
+ <div class="line"><a name="l00191"></a><span class="lineno"> 191</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__isoc99_vscanf&quot;</span>] = sse_scanf;</div>
263
+ <div class="line"><a name="l00192"></a><span class="lineno"> 192</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;fscanf&quot;</span>] = sse_fscanf;</div>
264
+ <div class="line"><a name="l00193"></a><span class="lineno"> 193</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;scanf&quot;</span>] = sse_scanf;</div>
265
+ <div class="line"><a name="l00194"></a><span class="lineno"> 194</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;sscanf&quot;</span>] = sse_scanf;</div>
266
+ <div class="line"><a name="l00195"></a><span class="lineno"> 195</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__isoc99_sscanf&quot;</span>] = sse_scanf;</div>
267
+ <div class="line"><a name="l00196"></a><span class="lineno"> 196</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;vscanf&quot;</span>] = sse_scanf;</div>
268
+ <div class="line"><a name="l00197"></a><span class="lineno"> 197</span>&#160; </div>
269
+ <div class="line"><a name="l00198"></a><span class="lineno"> 198</span>&#160; <span class="keyword">auto</span> sse_fread = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
270
+ <div class="line"><a name="l00199"></a><span class="lineno"> 199</span>&#160; {</div>
271
+ <div class="line"><a name="l00200"></a><span class="lineno"> 200</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 3) <span class="keywordflow">return</span>;</div>
272
+ <div class="line"><a name="l00201"></a><span class="lineno"> 201</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
273
+ <div class="line"><a name="l00202"></a><span class="lineno"> 202</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a11ceda75dbe328bcabdc6ff6919f9526">getState</a>(callNode);</div>
274
+ <div class="line"><a name="l00203"></a><span class="lineno"> 203</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> block_count_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(2));</div>
275
+ <div class="line"><a name="l00204"></a><span class="lineno"> 204</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> block_size_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
276
+ <div class="line"><a name="l00205"></a><span class="lineno"> 205</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> block_count = es[block_count_id];</div>
277
+ <div class="line"><a name="l00206"></a><span class="lineno"> 206</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> block_size = es[block_size_id];</div>
278
+ <div class="line"><a name="l00207"></a><span class="lineno"> 207</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> block_byte = block_count * block_size;</div>
279
+ <div class="line"><a name="l00208"></a><span class="lineno"> 208</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(0), block_byte, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
280
280
  <div class="line"><a name="l00209"></a><span class="lineno"> 209</span>&#160; };</div>
281
- <div class="line"><a name="l00210"></a><span class="lineno"> 210</span>&#160; </div>
282
- <div class="line"><a name="l00211"></a><span class="lineno"> 211</span>&#160; <span class="keyword">auto</span> sse_snprintf = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
283
- <div class="line"><a name="l00212"></a><span class="lineno"> 212</span>&#160; {</div>
284
- <div class="line"><a name="l00213"></a><span class="lineno"> 213</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 2) <span class="keywordflow">return</span>;</div>
285
- <div class="line"><a name="l00214"></a><span class="lineno"> 214</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>();</div>
286
- <div class="line"><a name="l00215"></a><span class="lineno"> 215</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> size_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
287
- <div class="line"><a name="l00216"></a><span class="lineno"> 216</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> dst_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(0));</div>
288
- <div class="line"><a name="l00217"></a><span class="lineno"> 217</span>&#160; <span class="comment">// get elem size of arg2</span></div>
289
- <div class="line"><a name="l00218"></a><span class="lineno"> 218</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> elemSize = 1;</div>
290
- <div class="line"><a name="l00219"></a><span class="lineno"> 219</span>&#160; <span class="keywordflow">if</span> (cs.getArgument(2)-&gt;getType()-&gt;isArrayTy())</div>
291
- <div class="line"><a name="l00220"></a><span class="lineno"> 220</span>&#160; {</div>
292
- <div class="line"><a name="l00221"></a><span class="lineno"> 221</span>&#160; elemSize = SVFUtil::dyn_cast&lt;SVFArrayType&gt;(cs.getArgument(2)-&gt;getType())-&gt;getTypeOfElement()-&gt;getByteSize();</div>
293
- <div class="line"><a name="l00222"></a><span class="lineno"> 222</span>&#160; }</div>
294
- <div class="line"><a name="l00223"></a><span class="lineno"> 223</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (cs.getArgument(2)-&gt;getType()-&gt;isPointerTy())</div>
295
- <div class="line"><a name="l00224"></a><span class="lineno"> 224</span>&#160; {</div>
296
- <div class="line"><a name="l00225"></a><span class="lineno"> 225</span>&#160; elemSize = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2057e8e1c0aaf39e74f0a8fb2a1b580c">getPointeeElement</a>(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(2)))-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
297
- <div class="line"><a name="l00226"></a><span class="lineno"> 226</span>&#160; }</div>
298
- <div class="line"><a name="l00227"></a><span class="lineno"> 227</span>&#160; <span class="keywordflow">else</span></div>
299
- <div class="line"><a name="l00228"></a><span class="lineno"> 228</span>&#160; {</div>
300
- <div class="line"><a name="l00229"></a><span class="lineno"> 229</span>&#160; <span class="keywordflow">return</span>;</div>
301
- <div class="line"><a name="l00230"></a><span class="lineno"> 230</span>&#160; <span class="comment">// assert(false &amp;&amp; &quot;we cannot support this type&quot;);</span></div>
302
- <div class="line"><a name="l00231"></a><span class="lineno"> 231</span>&#160; }</div>
303
- <div class="line"><a name="l00232"></a><span class="lineno"> 232</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> size = es[size_id] * <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(elemSize) - <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(1);</div>
304
- <div class="line"><a name="l00233"></a><span class="lineno"> 233</span>&#160; <span class="keywordflow">if</span> (!es.<a class="code" href="classSVF_1_1AbstractState.html#aa34516a95191c5ec56ce44a117e8b018">inVarToAddrsTable</a>(dst_id))</div>
305
- <div class="line"><a name="l00234"></a><span class="lineno"> 234</span>&#160; {</div>
306
- <div class="line"><a name="l00235"></a><span class="lineno"> 235</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1Options.html#afbe432aabda95308e2c190a04d227a6d">Options::BufferOverflowCheck</a>())</div>
307
- <div class="line"><a name="l00236"></a><span class="lineno"> 236</span>&#160; {</div>
308
- <div class="line"><a name="l00237"></a><span class="lineno"> 237</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(</div>
309
- <div class="line"><a name="l00238"></a><span class="lineno"> 238</span>&#160; <span class="stringliteral">&quot;snprintf dst_id or dst is not defined nor initializesd.\n&quot;</span>,</div>
310
- <div class="line"><a name="l00239"></a><span class="lineno"> 239</span>&#160; 0, 0, 0, 0, cs.getArgument(0));</div>
311
- <div class="line"><a name="l00240"></a><span class="lineno"> 240</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
312
- <div class="line"><a name="l00241"></a><span class="lineno"> 241</span>&#160; <span class="keywordflow">return</span>;</div>
313
- <div class="line"><a name="l00242"></a><span class="lineno"> 242</span>&#160; }</div>
314
- <div class="line"><a name="l00243"></a><span class="lineno"> 243</span>&#160; }</div>
315
- <div class="line"><a name="l00244"></a><span class="lineno"> 244</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(0), size, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
316
- <div class="line"><a name="l00245"></a><span class="lineno"> 245</span>&#160; };</div>
317
- <div class="line"><a name="l00246"></a><span class="lineno"> 246</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__snprintf_chk&quot;</span>] = sse_snprintf;</div>
318
- <div class="line"><a name="l00247"></a><span class="lineno"> 247</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__vsprintf_chk&quot;</span>] = sse_sprintf;</div>
319
- <div class="line"><a name="l00248"></a><span class="lineno"> 248</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__sprintf_chk&quot;</span>] = sse_sprintf;</div>
320
- <div class="line"><a name="l00249"></a><span class="lineno"> 249</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;snprintf&quot;</span>] = sse_snprintf;</div>
321
- <div class="line"><a name="l00250"></a><span class="lineno"> 250</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;sprintf&quot;</span>] = sse_sprintf;</div>
322
- <div class="line"><a name="l00251"></a><span class="lineno"> 251</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;vsprintf&quot;</span>] = sse_sprintf;</div>
323
- <div class="line"><a name="l00252"></a><span class="lineno"> 252</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;vsnprintf&quot;</span>] = sse_snprintf;</div>
324
- <div class="line"><a name="l00253"></a><span class="lineno"> 253</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__vsnprintf_chk&quot;</span>] = sse_snprintf;</div>
325
- <div class="line"><a name="l00254"></a><span class="lineno"> 254</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;swprintf&quot;</span>] = sse_snprintf;</div>
326
- <div class="line"><a name="l00255"></a><span class="lineno"> 255</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;_snwprintf&quot;</span>] = sse_snprintf;</div>
327
- <div class="line"><a name="l00256"></a><span class="lineno"> 256</span>&#160; </div>
328
- <div class="line"><a name="l00257"></a><span class="lineno"> 257</span>&#160; </div>
329
- <div class="line"><a name="l00258"></a><span class="lineno"> 258</span>&#160; <span class="keyword">auto</span> sse_itoa = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
330
- <div class="line"><a name="l00259"></a><span class="lineno"> 259</span>&#160; {</div>
331
- <div class="line"><a name="l00260"></a><span class="lineno"> 260</span>&#160; <span class="comment">// itoa(num, ch, 10);</span></div>
332
- <div class="line"><a name="l00261"></a><span class="lineno"> 261</span>&#160; <span class="comment">// num: int, ch: char*, 10 is decimal</span></div>
333
- <div class="line"><a name="l00262"></a><span class="lineno"> 262</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 3) <span class="keywordflow">return</span>;</div>
334
- <div class="line"><a name="l00263"></a><span class="lineno"> 263</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>();</div>
335
- <div class="line"><a name="l00264"></a><span class="lineno"> 264</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> num_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(0));</div>
336
- <div class="line"><a name="l00265"></a><span class="lineno"> 265</span>&#160; </div>
337
- <div class="line"><a name="l00266"></a><span class="lineno"> 266</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> num = (<a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a>) es[num_id].getInterval().getNumeral();</div>
338
- <div class="line"><a name="l00267"></a><span class="lineno"> 267</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> snum = std::to_string(num);</div>
339
- <div class="line"><a name="l00268"></a><span class="lineno"> 268</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(1), <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a>((<a class="code" href="namespaceSVF.html#a9b707002523ece2ac54ca893ee9a2d4e">s32_t</a>)snum.size()), <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
340
- <div class="line"><a name="l00269"></a><span class="lineno"> 269</span>&#160; };</div>
341
- <div class="line"><a name="l00270"></a><span class="lineno"> 270</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;itoa&quot;</span>] = sse_itoa;</div>
342
- <div class="line"><a name="l00271"></a><span class="lineno"> 271</span>&#160; </div>
343
- <div class="line"><a name="l00272"></a><span class="lineno"> 272</span>&#160; </div>
344
- <div class="line"><a name="l00273"></a><span class="lineno"> 273</span>&#160; <span class="keyword">auto</span> sse_strlen = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
345
- <div class="line"><a name="l00274"></a><span class="lineno"> 274</span>&#160; {</div>
346
- <div class="line"><a name="l00275"></a><span class="lineno"> 275</span>&#160; <span class="comment">// check the arg size</span></div>
347
- <div class="line"><a name="l00276"></a><span class="lineno"> 276</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 1) <span class="keywordflow">return</span>;</div>
348
- <div class="line"><a name="l00277"></a><span class="lineno"> 277</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* strValue = cs.getArgument(0);</div>
349
- <div class="line"><a name="l00278"></a><span class="lineno"> 278</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>();</div>
350
- <div class="line"><a name="l00279"></a><span class="lineno"> 279</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> dst_size = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a5bba3c0570d73acc743742a30af1b0b4">getStrlen</a>(strValue);</div>
351
- <div class="line"><a name="l00280"></a><span class="lineno"> 280</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> elemSize = 1;</div>
352
- <div class="line"><a name="l00281"></a><span class="lineno"> 281</span>&#160; <span class="keywordflow">if</span> (strValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a11f2d9b6e969ede6fca2c204cc15b821">getType</a>()-&gt;<a class="code" href="classSVF_1_1SVFType.html#a330084f9a3deb6e5acb52a8ee3eb7fe4">isArrayTy</a>())</div>
353
- <div class="line"><a name="l00282"></a><span class="lineno"> 282</span>&#160; {</div>
354
- <div class="line"><a name="l00283"></a><span class="lineno"> 283</span>&#160; elemSize = SVFUtil::dyn_cast&lt;SVFArrayType&gt;(strValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a11f2d9b6e969ede6fca2c204cc15b821">getType</a>())-&gt;getTypeOfElement()-&gt;getByteSize();</div>
355
- <div class="line"><a name="l00284"></a><span class="lineno"> 284</span>&#160; }</div>
356
- <div class="line"><a name="l00285"></a><span class="lineno"> 285</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (strValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a11f2d9b6e969ede6fca2c204cc15b821">getType</a>()-&gt;<a class="code" href="classSVF_1_1SVFType.html#a870b63af2bf9fe43cdf1df3d56b20f6c">isPointerTy</a>())</div>
357
- <div class="line"><a name="l00286"></a><span class="lineno"> 286</span>&#160; {</div>
358
- <div class="line"><a name="l00287"></a><span class="lineno"> 287</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFType.html">SVFType</a>* pointee = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2057e8e1c0aaf39e74f0a8fb2a1b580c">getPointeeElement</a>(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(strValue)))</div>
359
- <div class="line"><a name="l00288"></a><span class="lineno"> 288</span>&#160; elemSize = pointee-&gt;getByteSize();</div>
360
- <div class="line"><a name="l00289"></a><span class="lineno"> 289</span>&#160; <span class="keywordflow">else</span></div>
361
- <div class="line"><a name="l00290"></a><span class="lineno"> 290</span>&#160; elemSize = 1;</div>
362
- <div class="line"><a name="l00291"></a><span class="lineno"> 291</span>&#160; }</div>
363
- <div class="line"><a name="l00292"></a><span class="lineno"> 292</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> lhsId = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getInstruction());</div>
364
- <div class="line"><a name="l00293"></a><span class="lineno"> 293</span>&#160; es[lhsId] = dst_size / <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(elemSize);</div>
365
- <div class="line"><a name="l00294"></a><span class="lineno"> 294</span>&#160; };</div>
366
- <div class="line"><a name="l00295"></a><span class="lineno"> 295</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;strlen&quot;</span>] = sse_strlen;</div>
367
- <div class="line"><a name="l00296"></a><span class="lineno"> 296</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;wcslen&quot;</span>] = sse_strlen;</div>
368
- <div class="line"><a name="l00297"></a><span class="lineno"> 297</span>&#160; </div>
369
- <div class="line"><a name="l00298"></a><span class="lineno"> 298</span>&#160; <span class="keyword">auto</span> sse_recv = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
370
- <div class="line"><a name="l00299"></a><span class="lineno"> 299</span>&#160; {</div>
371
- <div class="line"><a name="l00300"></a><span class="lineno"> 300</span>&#160; <span class="comment">// recv(sockfd, buf, len, flags);</span></div>
372
- <div class="line"><a name="l00301"></a><span class="lineno"> 301</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 4) <span class="keywordflow">return</span>;</div>
373
- <div class="line"><a name="l00302"></a><span class="lineno"> 302</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>();</div>
374
- <div class="line"><a name="l00303"></a><span class="lineno"> 303</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> len_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(2));</div>
375
- <div class="line"><a name="l00304"></a><span class="lineno"> 304</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> len = es[len_id] - <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(1);</div>
376
- <div class="line"><a name="l00305"></a><span class="lineno"> 305</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> lhsId = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getInstruction());</div>
377
- <div class="line"><a name="l00306"></a><span class="lineno"> 306</span>&#160; es[lhsId] = len;</div>
378
- <div class="line"><a name="l00307"></a><span class="lineno"> 307</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(1), len, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));;</div>
379
- <div class="line"><a name="l00308"></a><span class="lineno"> 308</span>&#160; };</div>
380
- <div class="line"><a name="l00309"></a><span class="lineno"> 309</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;recv&quot;</span>] = sse_recv;</div>
381
- <div class="line"><a name="l00310"></a><span class="lineno"> 310</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__recv&quot;</span>] = sse_recv;</div>
382
- <div class="line"><a name="l00311"></a><span class="lineno"> 311</span>&#160; <span class="keyword">auto</span> safe_bufaccess = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
383
- <div class="line"><a name="l00312"></a><span class="lineno"> 312</span>&#160; {</div>
384
- <div class="line"><a name="l00313"></a><span class="lineno"> 313</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
385
- <div class="line"><a name="l00314"></a><span class="lineno"> 314</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a219313e979d779221116c1bc45becc1b">_checkpoints</a>.erase(callNode);</div>
386
- <div class="line"><a name="l00315"></a><span class="lineno"> 315</span>&#160; <span class="comment">//void SAFE_BUFACCESS(void* data, int size);</span></div>
387
- <div class="line"><a name="l00316"></a><span class="lineno"> 316</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 2) <span class="keywordflow">return</span>;</div>
388
- <div class="line"><a name="l00317"></a><span class="lineno"> 317</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>();</div>
389
- <div class="line"><a name="l00318"></a><span class="lineno"> 318</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> size_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
390
- <div class="line"><a name="l00319"></a><span class="lineno"> 319</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> val = es[size_id];</div>
391
- <div class="line"><a name="l00320"></a><span class="lineno"> 320</span>&#160; <span class="keywordflow">if</span> (val.<a class="code" href="structSVF_1_1AbstractValue.html#a8b1af972fa8a4e40347990d179ec1c52">isBottom</a>())</div>
392
- <div class="line"><a name="l00321"></a><span class="lineno"> 321</span>&#160; {</div>
393
- <div class="line"><a name="l00322"></a><span class="lineno"> 322</span>&#160; val = <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(0);</div>
394
- <div class="line"><a name="l00323"></a><span class="lineno"> 323</span>&#160; assert(<span class="keyword">false</span> &amp;&amp; <span class="stringliteral">&quot;SAFE_BUFACCESS size is bottom&quot;</span>);</div>
395
- <div class="line"><a name="l00324"></a><span class="lineno"> 324</span>&#160; }</div>
396
- <div class="line"><a name="l00325"></a><span class="lineno"> 325</span>&#160; <span class="keywordtype">bool</span> isSafe = <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(0), val, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
397
- <div class="line"><a name="l00326"></a><span class="lineno"> 326</span>&#160; <span class="keywordflow">if</span> (isSafe)</div>
398
- <div class="line"><a name="l00327"></a><span class="lineno"> 327</span>&#160; {</div>
399
- <div class="line"><a name="l00328"></a><span class="lineno"> 328</span>&#160; std::cout &lt;&lt; <span class="stringliteral">&quot;safe buffer access success\n&quot;</span>;</div>
400
- <div class="line"><a name="l00329"></a><span class="lineno"> 329</span>&#160; <span class="keywordflow">return</span>;</div>
401
- <div class="line"><a name="l00330"></a><span class="lineno"> 330</span>&#160; }</div>
402
- <div class="line"><a name="l00331"></a><span class="lineno"> 331</span>&#160; <span class="keywordflow">else</span></div>
403
- <div class="line"><a name="l00332"></a><span class="lineno"> 332</span>&#160; {</div>
404
- <div class="line"><a name="l00333"></a><span class="lineno"> 333</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> err_msg = <span class="stringliteral">&quot;this SAFE_BUFACCESS should be a safe access but detected buffer overflow. Pos: &quot;</span>;</div>
405
- <div class="line"><a name="l00334"></a><span class="lineno"> 334</span>&#160; err_msg += cs.getInstruction()-&gt;getSourceLoc();</div>
406
- <div class="line"><a name="l00335"></a><span class="lineno"> 335</span>&#160; std::cerr &lt;&lt; err_msg &lt;&lt; std::endl;</div>
407
- <div class="line"><a name="l00336"></a><span class="lineno"> 336</span>&#160; assert(<span class="keyword">false</span>);</div>
408
- <div class="line"><a name="l00337"></a><span class="lineno"> 337</span>&#160; }</div>
409
- <div class="line"><a name="l00338"></a><span class="lineno"> 338</span>&#160; };</div>
410
- <div class="line"><a name="l00339"></a><span class="lineno"> 339</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;SAFE_BUFACCESS&quot;</span>] = safe_bufaccess;</div>
411
- <div class="line"><a name="l00340"></a><span class="lineno"> 340</span>&#160; </div>
412
- <div class="line"><a name="l00341"></a><span class="lineno"> 341</span>&#160; <span class="keyword">auto</span> unsafe_bufaccess = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
413
- <div class="line"><a name="l00342"></a><span class="lineno"> 342</span>&#160; {</div>
414
- <div class="line"><a name="l00343"></a><span class="lineno"> 343</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
415
- <div class="line"><a name="l00344"></a><span class="lineno"> 344</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a219313e979d779221116c1bc45becc1b">_checkpoints</a>.erase(callNode);</div>
416
- <div class="line"><a name="l00345"></a><span class="lineno"> 345</span>&#160; <span class="comment">//void UNSAFE_BUFACCESS(void* data, int size);</span></div>
417
- <div class="line"><a name="l00346"></a><span class="lineno"> 346</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 2) <span class="keywordflow">return</span>;</div>
418
- <div class="line"><a name="l00347"></a><span class="lineno"> 347</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>();</div>
419
- <div class="line"><a name="l00348"></a><span class="lineno"> 348</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> size_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
420
- <div class="line"><a name="l00349"></a><span class="lineno"> 349</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> val = es[size_id];</div>
421
- <div class="line"><a name="l00350"></a><span class="lineno"> 350</span>&#160; <span class="keywordflow">if</span> (val.<a class="code" href="structSVF_1_1AbstractValue.html#a8b1af972fa8a4e40347990d179ec1c52">isBottom</a>())</div>
422
- <div class="line"><a name="l00351"></a><span class="lineno"> 351</span>&#160; {</div>
423
- <div class="line"><a name="l00352"></a><span class="lineno"> 352</span>&#160; assert(<span class="keyword">false</span> &amp;&amp; <span class="stringliteral">&quot;UNSAFE_BUFACCESS size is bottom&quot;</span>);</div>
424
- <div class="line"><a name="l00353"></a><span class="lineno"> 353</span>&#160; }</div>
425
- <div class="line"><a name="l00354"></a><span class="lineno"> 354</span>&#160; <span class="keywordtype">bool</span> isSafe = <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(0), val, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
426
- <div class="line"><a name="l00355"></a><span class="lineno"> 355</span>&#160; <span class="keywordflow">if</span> (!isSafe)</div>
427
- <div class="line"><a name="l00356"></a><span class="lineno"> 356</span>&#160; {</div>
428
- <div class="line"><a name="l00357"></a><span class="lineno"> 357</span>&#160; std::cout &lt;&lt; <span class="stringliteral">&quot;detect buffer overflow success\n&quot;</span>;</div>
429
- <div class="line"><a name="l00358"></a><span class="lineno"> 358</span>&#160; <span class="keywordflow">return</span>;</div>
430
- <div class="line"><a name="l00359"></a><span class="lineno"> 359</span>&#160; }</div>
431
- <div class="line"><a name="l00360"></a><span class="lineno"> 360</span>&#160; <span class="keywordflow">else</span></div>
281
+ <div class="line"><a name="l00210"></a><span class="lineno"> 210</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;fread&quot;</span>] = sse_fread;</div>
282
+ <div class="line"><a name="l00211"></a><span class="lineno"> 211</span>&#160; </div>
283
+ <div class="line"><a name="l00212"></a><span class="lineno"> 212</span>&#160; <span class="keyword">auto</span> sse_sprintf = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
284
+ <div class="line"><a name="l00213"></a><span class="lineno"> 213</span>&#160; {</div>
285
+ <div class="line"><a name="l00214"></a><span class="lineno"> 214</span>&#160; <span class="comment">// printf is difficult to predict since it has no byte size arguments</span></div>
286
+ <div class="line"><a name="l00215"></a><span class="lineno"> 215</span>&#160; };</div>
287
+ <div class="line"><a name="l00216"></a><span class="lineno"> 216</span>&#160; </div>
288
+ <div class="line"><a name="l00217"></a><span class="lineno"> 217</span>&#160; <span class="keyword">auto</span> sse_snprintf = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
289
+ <div class="line"><a name="l00218"></a><span class="lineno"> 218</span>&#160; {</div>
290
+ <div class="line"><a name="l00219"></a><span class="lineno"> 219</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 2) <span class="keywordflow">return</span>;</div>
291
+ <div class="line"><a name="l00220"></a><span class="lineno"> 220</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
292
+ <div class="line"><a name="l00221"></a><span class="lineno"> 221</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a11ceda75dbe328bcabdc6ff6919f9526">getState</a>(callNode);</div>
293
+ <div class="line"><a name="l00222"></a><span class="lineno"> 222</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> size_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
294
+ <div class="line"><a name="l00223"></a><span class="lineno"> 223</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> dst_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(0));</div>
295
+ <div class="line"><a name="l00224"></a><span class="lineno"> 224</span>&#160; <span class="comment">// get elem size of arg2</span></div>
296
+ <div class="line"><a name="l00225"></a><span class="lineno"> 225</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> elemSize = 1;</div>
297
+ <div class="line"><a name="l00226"></a><span class="lineno"> 226</span>&#160; <span class="keywordflow">if</span> (cs.getArgument(2)-&gt;getType()-&gt;isArrayTy())</div>
298
+ <div class="line"><a name="l00227"></a><span class="lineno"> 227</span>&#160; {</div>
299
+ <div class="line"><a name="l00228"></a><span class="lineno"> 228</span>&#160; elemSize = SVFUtil::dyn_cast&lt;SVFArrayType&gt;(cs.getArgument(2)-&gt;getType())-&gt;getTypeOfElement()-&gt;getByteSize();</div>
300
+ <div class="line"><a name="l00229"></a><span class="lineno"> 229</span>&#160; }</div>
301
+ <div class="line"><a name="l00230"></a><span class="lineno"> 230</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (cs.getArgument(2)-&gt;getType()-&gt;isPointerTy())</div>
302
+ <div class="line"><a name="l00231"></a><span class="lineno"> 231</span>&#160; {</div>
303
+ <div class="line"><a name="l00232"></a><span class="lineno"> 232</span>&#160; elemSize = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a319cdab5339e6fe56fec8ade68f9da92">getPointeeElement</a>(es, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(2)))-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
304
+ <div class="line"><a name="l00233"></a><span class="lineno"> 233</span>&#160; }</div>
305
+ <div class="line"><a name="l00234"></a><span class="lineno"> 234</span>&#160; <span class="keywordflow">else</span></div>
306
+ <div class="line"><a name="l00235"></a><span class="lineno"> 235</span>&#160; {</div>
307
+ <div class="line"><a name="l00236"></a><span class="lineno"> 236</span>&#160; <span class="keywordflow">return</span>;</div>
308
+ <div class="line"><a name="l00237"></a><span class="lineno"> 237</span>&#160; <span class="comment">// assert(false &amp;&amp; &quot;we cannot support this type&quot;);</span></div>
309
+ <div class="line"><a name="l00238"></a><span class="lineno"> 238</span>&#160; }</div>
310
+ <div class="line"><a name="l00239"></a><span class="lineno"> 239</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> size = es[size_id] * <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(elemSize) - <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(1);</div>
311
+ <div class="line"><a name="l00240"></a><span class="lineno"> 240</span>&#160; <span class="keywordflow">if</span> (!es.<a class="code" href="classSVF_1_1AbstractState.html#aa34516a95191c5ec56ce44a117e8b018">inVarToAddrsTable</a>(dst_id))</div>
312
+ <div class="line"><a name="l00241"></a><span class="lineno"> 241</span>&#160; {</div>
313
+ <div class="line"><a name="l00242"></a><span class="lineno"> 242</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1Options.html#afbe432aabda95308e2c190a04d227a6d">Options::BufferOverflowCheck</a>())</div>
314
+ <div class="line"><a name="l00243"></a><span class="lineno"> 243</span>&#160; {</div>
315
+ <div class="line"><a name="l00244"></a><span class="lineno"> 244</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(</div>
316
+ <div class="line"><a name="l00245"></a><span class="lineno"> 245</span>&#160; <span class="stringliteral">&quot;snprintf dst_id or dst is not defined nor initializesd.\n&quot;</span>,</div>
317
+ <div class="line"><a name="l00246"></a><span class="lineno"> 246</span>&#160; 0, 0, 0, 0, cs.getArgument(0));</div>
318
+ <div class="line"><a name="l00247"></a><span class="lineno"> 247</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
319
+ <div class="line"><a name="l00248"></a><span class="lineno"> 248</span>&#160; <span class="keywordflow">return</span>;</div>
320
+ <div class="line"><a name="l00249"></a><span class="lineno"> 249</span>&#160; }</div>
321
+ <div class="line"><a name="l00250"></a><span class="lineno"> 250</span>&#160; }</div>
322
+ <div class="line"><a name="l00251"></a><span class="lineno"> 251</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(0), size, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
323
+ <div class="line"><a name="l00252"></a><span class="lineno"> 252</span>&#160; };</div>
324
+ <div class="line"><a name="l00253"></a><span class="lineno"> 253</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__snprintf_chk&quot;</span>] = sse_snprintf;</div>
325
+ <div class="line"><a name="l00254"></a><span class="lineno"> 254</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__vsprintf_chk&quot;</span>] = sse_sprintf;</div>
326
+ <div class="line"><a name="l00255"></a><span class="lineno"> 255</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__sprintf_chk&quot;</span>] = sse_sprintf;</div>
327
+ <div class="line"><a name="l00256"></a><span class="lineno"> 256</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;snprintf&quot;</span>] = sse_snprintf;</div>
328
+ <div class="line"><a name="l00257"></a><span class="lineno"> 257</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;sprintf&quot;</span>] = sse_sprintf;</div>
329
+ <div class="line"><a name="l00258"></a><span class="lineno"> 258</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;vsprintf&quot;</span>] = sse_sprintf;</div>
330
+ <div class="line"><a name="l00259"></a><span class="lineno"> 259</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;vsnprintf&quot;</span>] = sse_snprintf;</div>
331
+ <div class="line"><a name="l00260"></a><span class="lineno"> 260</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__vsnprintf_chk&quot;</span>] = sse_snprintf;</div>
332
+ <div class="line"><a name="l00261"></a><span class="lineno"> 261</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;swprintf&quot;</span>] = sse_snprintf;</div>
333
+ <div class="line"><a name="l00262"></a><span class="lineno"> 262</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;_snwprintf&quot;</span>] = sse_snprintf;</div>
334
+ <div class="line"><a name="l00263"></a><span class="lineno"> 263</span>&#160; </div>
335
+ <div class="line"><a name="l00264"></a><span class="lineno"> 264</span>&#160; </div>
336
+ <div class="line"><a name="l00265"></a><span class="lineno"> 265</span>&#160; <span class="keyword">auto</span> sse_itoa = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
337
+ <div class="line"><a name="l00266"></a><span class="lineno"> 266</span>&#160; {</div>
338
+ <div class="line"><a name="l00267"></a><span class="lineno"> 267</span>&#160; <span class="comment">// itoa(num, ch, 10);</span></div>
339
+ <div class="line"><a name="l00268"></a><span class="lineno"> 268</span>&#160; <span class="comment">// num: int, ch: char*, 10 is decimal</span></div>
340
+ <div class="line"><a name="l00269"></a><span class="lineno"> 269</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 3) <span class="keywordflow">return</span>;</div>
341
+ <div class="line"><a name="l00270"></a><span class="lineno"> 270</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
342
+ <div class="line"><a name="l00271"></a><span class="lineno"> 271</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a11ceda75dbe328bcabdc6ff6919f9526">getState</a>(callNode);</div>
343
+ <div class="line"><a name="l00272"></a><span class="lineno"> 272</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> num_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(0));</div>
344
+ <div class="line"><a name="l00273"></a><span class="lineno"> 273</span>&#160; </div>
345
+ <div class="line"><a name="l00274"></a><span class="lineno"> 274</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> num = (<a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a>) es[num_id].getInterval().getNumeral();</div>
346
+ <div class="line"><a name="l00275"></a><span class="lineno"> 275</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> snum = std::to_string(num);</div>
347
+ <div class="line"><a name="l00276"></a><span class="lineno"> 276</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(1), <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a>((<a class="code" href="namespaceSVF.html#a9b707002523ece2ac54ca893ee9a2d4e">s32_t</a>)snum.size()), <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
348
+ <div class="line"><a name="l00277"></a><span class="lineno"> 277</span>&#160; };</div>
349
+ <div class="line"><a name="l00278"></a><span class="lineno"> 278</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;itoa&quot;</span>] = sse_itoa;</div>
350
+ <div class="line"><a name="l00279"></a><span class="lineno"> 279</span>&#160; </div>
351
+ <div class="line"><a name="l00280"></a><span class="lineno"> 280</span>&#160; </div>
352
+ <div class="line"><a name="l00281"></a><span class="lineno"> 281</span>&#160; <span class="keyword">auto</span> sse_strlen = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
353
+ <div class="line"><a name="l00282"></a><span class="lineno"> 282</span>&#160; {</div>
354
+ <div class="line"><a name="l00283"></a><span class="lineno"> 283</span>&#160; <span class="comment">// check the arg size</span></div>
355
+ <div class="line"><a name="l00284"></a><span class="lineno"> 284</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 1) <span class="keywordflow">return</span>;</div>
356
+ <div class="line"><a name="l00285"></a><span class="lineno"> 285</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* strValue = cs.getArgument(0);</div>
357
+ <div class="line"><a name="l00286"></a><span class="lineno"> 286</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
358
+ <div class="line"><a name="l00287"></a><span class="lineno"> 287</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp; es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a11ceda75dbe328bcabdc6ff6919f9526">getState</a>(callNode);</div>
359
+ <div class="line"><a name="l00288"></a><span class="lineno"> 288</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> dst_size = <a class="code" href="classSVF_1_1AbstractInterpretation.html#af3c6f27181cc271332919732e490ad1d">getStrlen</a>(es, strValue);</div>
360
+ <div class="line"><a name="l00289"></a><span class="lineno"> 289</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> elemSize = 1;</div>
361
+ <div class="line"><a name="l00290"></a><span class="lineno"> 290</span>&#160; <span class="keywordflow">if</span> (strValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a11f2d9b6e969ede6fca2c204cc15b821">getType</a>()-&gt;<a class="code" href="classSVF_1_1SVFType.html#a330084f9a3deb6e5acb52a8ee3eb7fe4">isArrayTy</a>())</div>
362
+ <div class="line"><a name="l00291"></a><span class="lineno"> 291</span>&#160; {</div>
363
+ <div class="line"><a name="l00292"></a><span class="lineno"> 292</span>&#160; elemSize = SVFUtil::dyn_cast&lt;SVFArrayType&gt;(strValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a11f2d9b6e969ede6fca2c204cc15b821">getType</a>())-&gt;getTypeOfElement()-&gt;getByteSize();</div>
364
+ <div class="line"><a name="l00293"></a><span class="lineno"> 293</span>&#160; }</div>
365
+ <div class="line"><a name="l00294"></a><span class="lineno"> 294</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (strValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a11f2d9b6e969ede6fca2c204cc15b821">getType</a>()-&gt;<a class="code" href="classSVF_1_1SVFType.html#a870b63af2bf9fe43cdf1df3d56b20f6c">isPointerTy</a>())</div>
366
+ <div class="line"><a name="l00295"></a><span class="lineno"> 295</span>&#160; {</div>
367
+ <div class="line"><a name="l00296"></a><span class="lineno"> 296</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFType.html">SVFType</a>* pointee = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a319cdab5339e6fe56fec8ade68f9da92">getPointeeElement</a>(es, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(strValue)))</div>
368
+ <div class="line"><a name="l00297"></a><span class="lineno"> 297</span>&#160; elemSize = pointee-&gt;getByteSize();</div>
369
+ <div class="line"><a name="l00298"></a><span class="lineno"> 298</span>&#160; <span class="keywordflow">else</span></div>
370
+ <div class="line"><a name="l00299"></a><span class="lineno"> 299</span>&#160; elemSize = 1;</div>
371
+ <div class="line"><a name="l00300"></a><span class="lineno"> 300</span>&#160; }</div>
372
+ <div class="line"><a name="l00301"></a><span class="lineno"> 301</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> lhsId = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getInstruction());</div>
373
+ <div class="line"><a name="l00302"></a><span class="lineno"> 302</span>&#160; es[lhsId] = dst_size / <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(elemSize);</div>
374
+ <div class="line"><a name="l00303"></a><span class="lineno"> 303</span>&#160; };</div>
375
+ <div class="line"><a name="l00304"></a><span class="lineno"> 304</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;strlen&quot;</span>] = sse_strlen;</div>
376
+ <div class="line"><a name="l00305"></a><span class="lineno"> 305</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;wcslen&quot;</span>] = sse_strlen;</div>
377
+ <div class="line"><a name="l00306"></a><span class="lineno"> 306</span>&#160; </div>
378
+ <div class="line"><a name="l00307"></a><span class="lineno"> 307</span>&#160; <span class="keyword">auto</span> sse_recv = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
379
+ <div class="line"><a name="l00308"></a><span class="lineno"> 308</span>&#160; {</div>
380
+ <div class="line"><a name="l00309"></a><span class="lineno"> 309</span>&#160; <span class="comment">// recv(sockfd, buf, len, flags);</span></div>
381
+ <div class="line"><a name="l00310"></a><span class="lineno"> 310</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 4) <span class="keywordflow">return</span>;</div>
382
+ <div class="line"><a name="l00311"></a><span class="lineno"> 311</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
383
+ <div class="line"><a name="l00312"></a><span class="lineno"> 312</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a11ceda75dbe328bcabdc6ff6919f9526">getState</a>(callNode);</div>
384
+ <div class="line"><a name="l00313"></a><span class="lineno"> 313</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> len_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(2));</div>
385
+ <div class="line"><a name="l00314"></a><span class="lineno"> 314</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> len = es[len_id] - <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(1);</div>
386
+ <div class="line"><a name="l00315"></a><span class="lineno"> 315</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> lhsId = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getInstruction());</div>
387
+ <div class="line"><a name="l00316"></a><span class="lineno"> 316</span>&#160; es[lhsId] = len;</div>
388
+ <div class="line"><a name="l00317"></a><span class="lineno"> 317</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(1), len, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));;</div>
389
+ <div class="line"><a name="l00318"></a><span class="lineno"> 318</span>&#160; };</div>
390
+ <div class="line"><a name="l00319"></a><span class="lineno"> 319</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;recv&quot;</span>] = sse_recv;</div>
391
+ <div class="line"><a name="l00320"></a><span class="lineno"> 320</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__recv&quot;</span>] = sse_recv;</div>
392
+ <div class="line"><a name="l00321"></a><span class="lineno"> 321</span>&#160; <span class="keyword">auto</span> safe_bufaccess = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
393
+ <div class="line"><a name="l00322"></a><span class="lineno"> 322</span>&#160; {</div>
394
+ <div class="line"><a name="l00323"></a><span class="lineno"> 323</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
395
+ <div class="line"><a name="l00324"></a><span class="lineno"> 324</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a219313e979d779221116c1bc45becc1b">_checkpoints</a>.erase(callNode);</div>
396
+ <div class="line"><a name="l00325"></a><span class="lineno"> 325</span>&#160; <span class="comment">//void SAFE_BUFACCESS(void* data, int size);</span></div>
397
+ <div class="line"><a name="l00326"></a><span class="lineno"> 326</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 2) <span class="keywordflow">return</span>;</div>
398
+ <div class="line"><a name="l00327"></a><span class="lineno"> 327</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a11ceda75dbe328bcabdc6ff6919f9526">getState</a>(callNode);</div>
399
+ <div class="line"><a name="l00328"></a><span class="lineno"> 328</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> size_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
400
+ <div class="line"><a name="l00329"></a><span class="lineno"> 329</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> val = es[size_id];</div>
401
+ <div class="line"><a name="l00330"></a><span class="lineno"> 330</span>&#160; <span class="keywordflow">if</span> (val.<a class="code" href="structSVF_1_1AbstractValue.html#a8b1af972fa8a4e40347990d179ec1c52">isBottom</a>())</div>
402
+ <div class="line"><a name="l00331"></a><span class="lineno"> 331</span>&#160; {</div>
403
+ <div class="line"><a name="l00332"></a><span class="lineno"> 332</span>&#160; val = <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(0);</div>
404
+ <div class="line"><a name="l00333"></a><span class="lineno"> 333</span>&#160; assert(<span class="keyword">false</span> &amp;&amp; <span class="stringliteral">&quot;SAFE_BUFACCESS size is bottom&quot;</span>);</div>
405
+ <div class="line"><a name="l00334"></a><span class="lineno"> 334</span>&#160; }</div>
406
+ <div class="line"><a name="l00335"></a><span class="lineno"> 335</span>&#160; <span class="keywordtype">bool</span> isSafe = <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(0), val, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
407
+ <div class="line"><a name="l00336"></a><span class="lineno"> 336</span>&#160; <span class="keywordflow">if</span> (isSafe)</div>
408
+ <div class="line"><a name="l00337"></a><span class="lineno"> 337</span>&#160; {</div>
409
+ <div class="line"><a name="l00338"></a><span class="lineno"> 338</span>&#160; std::cout &lt;&lt; <span class="stringliteral">&quot;safe buffer access success\n&quot;</span>;</div>
410
+ <div class="line"><a name="l00339"></a><span class="lineno"> 339</span>&#160; <span class="keywordflow">return</span>;</div>
411
+ <div class="line"><a name="l00340"></a><span class="lineno"> 340</span>&#160; }</div>
412
+ <div class="line"><a name="l00341"></a><span class="lineno"> 341</span>&#160; <span class="keywordflow">else</span></div>
413
+ <div class="line"><a name="l00342"></a><span class="lineno"> 342</span>&#160; {</div>
414
+ <div class="line"><a name="l00343"></a><span class="lineno"> 343</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> err_msg = <span class="stringliteral">&quot;this SAFE_BUFACCESS should be a safe access but detected buffer overflow. Pos: &quot;</span>;</div>
415
+ <div class="line"><a name="l00344"></a><span class="lineno"> 344</span>&#160; err_msg += cs.getInstruction()-&gt;getSourceLoc();</div>
416
+ <div class="line"><a name="l00345"></a><span class="lineno"> 345</span>&#160; std::cerr &lt;&lt; err_msg &lt;&lt; std::endl;</div>
417
+ <div class="line"><a name="l00346"></a><span class="lineno"> 346</span>&#160; assert(<span class="keyword">false</span>);</div>
418
+ <div class="line"><a name="l00347"></a><span class="lineno"> 347</span>&#160; }</div>
419
+ <div class="line"><a name="l00348"></a><span class="lineno"> 348</span>&#160; };</div>
420
+ <div class="line"><a name="l00349"></a><span class="lineno"> 349</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;SAFE_BUFACCESS&quot;</span>] = safe_bufaccess;</div>
421
+ <div class="line"><a name="l00350"></a><span class="lineno"> 350</span>&#160; </div>
422
+ <div class="line"><a name="l00351"></a><span class="lineno"> 351</span>&#160; <span class="keyword">auto</span> unsafe_bufaccess = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
423
+ <div class="line"><a name="l00352"></a><span class="lineno"> 352</span>&#160; {</div>
424
+ <div class="line"><a name="l00353"></a><span class="lineno"> 353</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
425
+ <div class="line"><a name="l00354"></a><span class="lineno"> 354</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a219313e979d779221116c1bc45becc1b">_checkpoints</a>.erase(callNode);</div>
426
+ <div class="line"><a name="l00355"></a><span class="lineno"> 355</span>&#160; <span class="comment">//void UNSAFE_BUFACCESS(void* data, int size);</span></div>
427
+ <div class="line"><a name="l00356"></a><span class="lineno"> 356</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 2) <span class="keywordflow">return</span>;</div>
428
+ <div class="line"><a name="l00357"></a><span class="lineno"> 357</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a11ceda75dbe328bcabdc6ff6919f9526">getState</a>(callNode);</div>
429
+ <div class="line"><a name="l00358"></a><span class="lineno"> 358</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> size_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
430
+ <div class="line"><a name="l00359"></a><span class="lineno"> 359</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> val = es[size_id];</div>
431
+ <div class="line"><a name="l00360"></a><span class="lineno"> 360</span>&#160; <span class="keywordflow">if</span> (val.<a class="code" href="structSVF_1_1AbstractValue.html#a8b1af972fa8a4e40347990d179ec1c52">isBottom</a>())</div>
432
432
  <div class="line"><a name="l00361"></a><span class="lineno"> 361</span>&#160; {</div>
433
- <div class="line"><a name="l00362"></a><span class="lineno"> 362</span>&#160; <span class="comment">// if it is safe, it means it is wrongly labeled, assert false.</span></div>
434
- <div class="line"><a name="l00363"></a><span class="lineno"> 363</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> err_msg = <span class="stringliteral">&quot;this UNSAFE_BUFACCESS should be a buffer overflow but not detected. Pos: &quot;</span>;</div>
435
- <div class="line"><a name="l00364"></a><span class="lineno"> 364</span>&#160; err_msg += cs.getInstruction()-&gt;getSourceLoc();</div>
436
- <div class="line"><a name="l00365"></a><span class="lineno"> 365</span>&#160; std::cerr &lt;&lt; err_msg &lt;&lt; std::endl;</div>
437
- <div class="line"><a name="l00366"></a><span class="lineno"> 366</span>&#160; assert(<span class="keyword">false</span>);</div>
438
- <div class="line"><a name="l00367"></a><span class="lineno"> 367</span>&#160; }</div>
439
- <div class="line"><a name="l00368"></a><span class="lineno"> 368</span>&#160; };</div>
440
- <div class="line"><a name="l00369"></a><span class="lineno"> 369</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;UNSAFE_BUFACCESS&quot;</span>] = unsafe_bufaccess;</div>
441
- <div class="line"><a name="l00370"></a><span class="lineno"> 370</span>&#160; </div>
442
- <div class="line"><a name="l00371"></a><span class="lineno"> 371</span>&#160; <span class="comment">// init _checkpoint_names</span></div>
443
- <div class="line"><a name="l00372"></a><span class="lineno"> 372</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a1e1b72ed740cef4c3e57e3e32c3f75">_checkpoint_names</a>.insert(<span class="stringliteral">&quot;SAFE_BUFACCESS&quot;</span>);</div>
444
- <div class="line"><a name="l00373"></a><span class="lineno"> 373</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a1e1b72ed740cef4c3e57e3e32c3f75">_checkpoint_names</a>.insert(<span class="stringliteral">&quot;UNSAFE_BUFACCESS&quot;</span>);</div>
445
- <div class="line"><a name="l00374"></a><span class="lineno"> 374</span>&#160;}</div>
446
- <div class="line"><a name="l00375"></a><span class="lineno"> 375</span>&#160; </div>
447
- <div class="line"><a name="l00376"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#aa68f8aef09481d7c07dc59d7dfb83822"> 376</a></span>&#160;<span class="keywordtype">bool</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#aa68f8aef09481d7c07dc59d7dfb83822">BufOverflowChecker::detectStrcat</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a> *call)</div>
448
- <div class="line"><a name="l00377"></a><span class="lineno"> 377</span>&#160;{</div>
449
- <div class="line"><a name="l00378"></a><span class="lineno"> 378</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFFunction.html">SVFFunction</a> *fun = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a145abbd2958629718fbca41d25c3124d">SVFUtil::getCallee</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
450
- <div class="line"><a name="l00379"></a><span class="lineno"> 379</span>&#160; <span class="comment">// check the arg size</span></div>
451
- <div class="line"><a name="l00380"></a><span class="lineno"> 380</span>&#160; <span class="comment">// if it is strcat group, we need to check the length of string,</span></div>
452
- <div class="line"><a name="l00381"></a><span class="lineno"> 381</span>&#160; <span class="comment">// e.g. strcat(str1, str2); which checks AllocSize(str1) &gt;= Strlen(str1) + Strlen(str2);</span></div>
453
- <div class="line"><a name="l00382"></a><span class="lineno"> 382</span>&#160; <span class="comment">// if it is strncat group, we do not need to check the length of string,</span></div>
454
- <div class="line"><a name="l00383"></a><span class="lineno"> 383</span>&#160; <span class="comment">// e.g. strncat(str1, str2, n); which checks AllocSize(str1) &gt;= Strlen(str1) + n;</span></div>
455
- <div class="line"><a name="l00384"></a><span class="lineno"> 384</span>&#160; </div>
456
- <div class="line"><a name="l00385"></a><span class="lineno"> 385</span>&#160; <span class="keyword">const</span> std::vector&lt;std::string&gt; strcatGroup = {<span class="stringliteral">&quot;__strcat_chk&quot;</span>, <span class="stringliteral">&quot;strcat&quot;</span>, <span class="stringliteral">&quot;__wcscat_chk&quot;</span>, <span class="stringliteral">&quot;wcscat&quot;</span>};</div>
457
- <div class="line"><a name="l00386"></a><span class="lineno"> 386</span>&#160; <span class="keyword">const</span> std::vector&lt;std::string&gt; strncatGroup = {<span class="stringliteral">&quot;__strncat_chk&quot;</span>, <span class="stringliteral">&quot;strncat&quot;</span>, <span class="stringliteral">&quot;__wcsncat_chk&quot;</span>, <span class="stringliteral">&quot;wcsncat&quot;</span>};</div>
458
- <div class="line"><a name="l00387"></a><span class="lineno"> 387</span>&#160; <span class="keywordflow">if</span> (std::find(strcatGroup.begin(), strcatGroup.end(), fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>()) != strcatGroup.end())</div>
459
- <div class="line"><a name="l00388"></a><span class="lineno"> 388</span>&#160; {</div>
460
- <div class="line"><a name="l00389"></a><span class="lineno"> 389</span>&#160; <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> cs = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a9815a5b31ac7dc21239d08e5b9f61106">SVFUtil::getSVFCallSite</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
461
- <div class="line"><a name="l00390"></a><span class="lineno"> 390</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg0Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(0);</div>
462
- <div class="line"><a name="l00391"></a><span class="lineno"> 391</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg1Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(1);</div>
463
- <div class="line"><a name="l00392"></a><span class="lineno"> 392</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> strLen0 = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a5bba3c0570d73acc743742a30af1b0b4">getStrlen</a>(arg0Val);</div>
464
- <div class="line"><a name="l00393"></a><span class="lineno"> 393</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> strLen1 = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a5bba3c0570d73acc743742a30af1b0b4">getStrlen</a>(arg1Val);</div>
465
- <div class="line"><a name="l00394"></a><span class="lineno"> 394</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> totalLen = strLen0 + strLen1;</div>
466
- <div class="line"><a name="l00395"></a><span class="lineno"> 395</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(arg0Val, totalLen, call);</div>
467
- <div class="line"><a name="l00396"></a><span class="lineno"> 396</span>&#160; }</div>
468
- <div class="line"><a name="l00397"></a><span class="lineno"> 397</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (std::find(strncatGroup.begin(), strncatGroup.end(), fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>()) != strncatGroup.end())</div>
469
- <div class="line"><a name="l00398"></a><span class="lineno"> 398</span>&#160; {</div>
470
- <div class="line"><a name="l00399"></a><span class="lineno"> 399</span>&#160; <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> cs = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a9815a5b31ac7dc21239d08e5b9f61106">SVFUtil::getSVFCallSite</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
471
- <div class="line"><a name="l00400"></a><span class="lineno"> 400</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg0Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(0);</div>
472
- <div class="line"><a name="l00401"></a><span class="lineno"> 401</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg2Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(2);</div>
473
- <div class="line"><a name="l00402"></a><span class="lineno"> 402</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> arg2Num =</div>
474
- <div class="line"><a name="l00403"></a><span class="lineno"> 403</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>()[<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(arg2Val)];</div>
475
- <div class="line"><a name="l00404"></a><span class="lineno"> 404</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> strLen0 = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a5bba3c0570d73acc743742a30af1b0b4">getStrlen</a>(arg0Val);</div>
476
- <div class="line"><a name="l00405"></a><span class="lineno"> 405</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> totalLen = strLen0 + arg2Num;</div>
433
+ <div class="line"><a name="l00362"></a><span class="lineno"> 362</span>&#160; assert(<span class="keyword">false</span> &amp;&amp; <span class="stringliteral">&quot;UNSAFE_BUFACCESS size is bottom&quot;</span>);</div>
434
+ <div class="line"><a name="l00363"></a><span class="lineno"> 363</span>&#160; }</div>
435
+ <div class="line"><a name="l00364"></a><span class="lineno"> 364</span>&#160; <span class="keywordtype">bool</span> isSafe = <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(0), val, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
436
+ <div class="line"><a name="l00365"></a><span class="lineno"> 365</span>&#160; <span class="keywordflow">if</span> (!isSafe)</div>
437
+ <div class="line"><a name="l00366"></a><span class="lineno"> 366</span>&#160; {</div>
438
+ <div class="line"><a name="l00367"></a><span class="lineno"> 367</span>&#160; std::cout &lt;&lt; <span class="stringliteral">&quot;detect buffer overflow success\n&quot;</span>;</div>
439
+ <div class="line"><a name="l00368"></a><span class="lineno"> 368</span>&#160; <span class="keywordflow">return</span>;</div>
440
+ <div class="line"><a name="l00369"></a><span class="lineno"> 369</span>&#160; }</div>
441
+ <div class="line"><a name="l00370"></a><span class="lineno"> 370</span>&#160; <span class="keywordflow">else</span></div>
442
+ <div class="line"><a name="l00371"></a><span class="lineno"> 371</span>&#160; {</div>
443
+ <div class="line"><a name="l00372"></a><span class="lineno"> 372</span>&#160; <span class="comment">// if it is safe, it means it is wrongly labeled, assert false.</span></div>
444
+ <div class="line"><a name="l00373"></a><span class="lineno"> 373</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> err_msg = <span class="stringliteral">&quot;this UNSAFE_BUFACCESS should be a buffer overflow but not detected. Pos: &quot;</span>;</div>
445
+ <div class="line"><a name="l00374"></a><span class="lineno"> 374</span>&#160; err_msg += cs.getInstruction()-&gt;getSourceLoc();</div>
446
+ <div class="line"><a name="l00375"></a><span class="lineno"> 375</span>&#160; std::cerr &lt;&lt; err_msg &lt;&lt; std::endl;</div>
447
+ <div class="line"><a name="l00376"></a><span class="lineno"> 376</span>&#160; assert(<span class="keyword">false</span>);</div>
448
+ <div class="line"><a name="l00377"></a><span class="lineno"> 377</span>&#160; }</div>
449
+ <div class="line"><a name="l00378"></a><span class="lineno"> 378</span>&#160; };</div>
450
+ <div class="line"><a name="l00379"></a><span class="lineno"> 379</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;UNSAFE_BUFACCESS&quot;</span>] = unsafe_bufaccess;</div>
451
+ <div class="line"><a name="l00380"></a><span class="lineno"> 380</span>&#160; </div>
452
+ <div class="line"><a name="l00381"></a><span class="lineno"> 381</span>&#160; <span class="comment">// init _checkpoint_names</span></div>
453
+ <div class="line"><a name="l00382"></a><span class="lineno"> 382</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a1e1b72ed740cef4c3e57e3e32c3f75">_checkpoint_names</a>.insert(<span class="stringliteral">&quot;SAFE_BUFACCESS&quot;</span>);</div>
454
+ <div class="line"><a name="l00383"></a><span class="lineno"> 383</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a1e1b72ed740cef4c3e57e3e32c3f75">_checkpoint_names</a>.insert(<span class="stringliteral">&quot;UNSAFE_BUFACCESS&quot;</span>);</div>
455
+ <div class="line"><a name="l00384"></a><span class="lineno"> 384</span>&#160;}</div>
456
+ <div class="line"><a name="l00385"></a><span class="lineno"> 385</span>&#160; </div>
457
+ <div class="line"><a name="l00386"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#aa68f8aef09481d7c07dc59d7dfb83822"> 386</a></span>&#160;<span class="keywordtype">bool</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#aa68f8aef09481d7c07dc59d7dfb83822">BufOverflowChecker::detectStrcat</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a> *call)</div>
458
+ <div class="line"><a name="l00387"></a><span class="lineno"> 387</span>&#160;{</div>
459
+ <div class="line"><a name="l00388"></a><span class="lineno"> 388</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp; es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a11ceda75dbe328bcabdc6ff6919f9526">getState</a>(call);</div>
460
+ <div class="line"><a name="l00389"></a><span class="lineno"> 389</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFFunction.html">SVFFunction</a> *fun = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a145abbd2958629718fbca41d25c3124d">SVFUtil::getCallee</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
461
+ <div class="line"><a name="l00390"></a><span class="lineno"> 390</span>&#160; <span class="comment">// check the arg size</span></div>
462
+ <div class="line"><a name="l00391"></a><span class="lineno"> 391</span>&#160; <span class="comment">// if it is strcat group, we need to check the length of string,</span></div>
463
+ <div class="line"><a name="l00392"></a><span class="lineno"> 392</span>&#160; <span class="comment">// e.g. strcat(str1, str2); which checks AllocSize(str1) &gt;= Strlen(str1) + Strlen(str2);</span></div>
464
+ <div class="line"><a name="l00393"></a><span class="lineno"> 393</span>&#160; <span class="comment">// if it is strncat group, we do not need to check the length of string,</span></div>
465
+ <div class="line"><a name="l00394"></a><span class="lineno"> 394</span>&#160; <span class="comment">// e.g. strncat(str1, str2, n); which checks AllocSize(str1) &gt;= Strlen(str1) + n;</span></div>
466
+ <div class="line"><a name="l00395"></a><span class="lineno"> 395</span>&#160; </div>
467
+ <div class="line"><a name="l00396"></a><span class="lineno"> 396</span>&#160; <span class="keyword">const</span> std::vector&lt;std::string&gt; strcatGroup = {<span class="stringliteral">&quot;__strcat_chk&quot;</span>, <span class="stringliteral">&quot;strcat&quot;</span>, <span class="stringliteral">&quot;__wcscat_chk&quot;</span>, <span class="stringliteral">&quot;wcscat&quot;</span>};</div>
468
+ <div class="line"><a name="l00397"></a><span class="lineno"> 397</span>&#160; <span class="keyword">const</span> std::vector&lt;std::string&gt; strncatGroup = {<span class="stringliteral">&quot;__strncat_chk&quot;</span>, <span class="stringliteral">&quot;strncat&quot;</span>, <span class="stringliteral">&quot;__wcsncat_chk&quot;</span>, <span class="stringliteral">&quot;wcsncat&quot;</span>};</div>
469
+ <div class="line"><a name="l00398"></a><span class="lineno"> 398</span>&#160; <span class="keywordflow">if</span> (std::find(strcatGroup.begin(), strcatGroup.end(), fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>()) != strcatGroup.end())</div>
470
+ <div class="line"><a name="l00399"></a><span class="lineno"> 399</span>&#160; {</div>
471
+ <div class="line"><a name="l00400"></a><span class="lineno"> 400</span>&#160; <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> cs = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a9815a5b31ac7dc21239d08e5b9f61106">SVFUtil::getSVFCallSite</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
472
+ <div class="line"><a name="l00401"></a><span class="lineno"> 401</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg0Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(0);</div>
473
+ <div class="line"><a name="l00402"></a><span class="lineno"> 402</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg1Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(1);</div>
474
+ <div class="line"><a name="l00403"></a><span class="lineno"> 403</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> strLen0 = <a class="code" href="classSVF_1_1AbstractInterpretation.html#af3c6f27181cc271332919732e490ad1d">getStrlen</a>(es, arg0Val);</div>
475
+ <div class="line"><a name="l00404"></a><span class="lineno"> 404</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> strLen1 = <a class="code" href="classSVF_1_1AbstractInterpretation.html#af3c6f27181cc271332919732e490ad1d">getStrlen</a>(es, arg1Val);</div>
476
+ <div class="line"><a name="l00405"></a><span class="lineno"> 405</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> totalLen = strLen0 + strLen1;</div>
477
477
  <div class="line"><a name="l00406"></a><span class="lineno"> 406</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(arg0Val, totalLen, call);</div>
478
478
  <div class="line"><a name="l00407"></a><span class="lineno"> 407</span>&#160; }</div>
479
- <div class="line"><a name="l00408"></a><span class="lineno"> 408</span>&#160; <span class="keywordflow">else</span></div>
479
+ <div class="line"><a name="l00408"></a><span class="lineno"> 408</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (std::find(strncatGroup.begin(), strncatGroup.end(), fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>()) != strncatGroup.end())</div>
480
480
  <div class="line"><a name="l00409"></a><span class="lineno"> 409</span>&#160; {</div>
481
- <div class="line"><a name="l00410"></a><span class="lineno"> 410</span>&#160; assert(<span class="keyword">false</span> &amp;&amp; <span class="stringliteral">&quot;unknown strcat function, please add it to strcatGroup or strncatGroup&quot;</span>);</div>
482
- <div class="line"><a name="l00411"></a><span class="lineno"> 411</span>&#160; abort();</div>
483
- <div class="line"><a name="l00412"></a><span class="lineno"> 412</span>&#160; }</div>
484
- <div class="line"><a name="l00413"></a><span class="lineno"> 413</span>&#160;}</div>
485
- <div class="line"><a name="l00414"></a><span class="lineno"> 414</span>&#160; </div>
486
- <div class="line"><a name="l00415"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#a1ed3cb0a1a118d9e505b192841a58dde"> 415</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#a1ed3cb0a1a118d9e505b192841a58dde">BufOverflowChecker::handleExtAPI</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a> *call)</div>
487
- <div class="line"><a name="l00416"></a><span class="lineno"> 416</span>&#160;{</div>
488
- <div class="line"><a name="l00417"></a><span class="lineno"> 417</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a6cac9b69d85111a5a26373ec848a3282">AbstractInterpretation::handleExtAPI</a>(call);</div>
489
- <div class="line"><a name="l00418"></a><span class="lineno"> 418</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFFunction.html">SVFFunction</a> *fun = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a145abbd2958629718fbca41d25c3124d">SVFUtil::getCallee</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
490
- <div class="line"><a name="l00419"></a><span class="lineno"> 419</span>&#160; assert(fun &amp;&amp; <span class="stringliteral">&quot;SVFFunction* is nullptr&quot;</span>);</div>
491
- <div class="line"><a name="l00420"></a><span class="lineno"> 420</span>&#160; <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> cs = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a9815a5b31ac7dc21239d08e5b9f61106">SVFUtil::getSVFCallSite</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
492
- <div class="line"><a name="l00421"></a><span class="lineno"> 421</span>&#160; <span class="comment">// check the type of mem api,</span></div>
493
- <div class="line"><a name="l00422"></a><span class="lineno"> 422</span>&#160; <span class="comment">// MEMCPY: like memcpy, memcpy_chk, llvm.memcpy etc.</span></div>
494
- <div class="line"><a name="l00423"></a><span class="lineno"> 423</span>&#160; <span class="comment">// MEMSET: like memset, memset_chk, llvm.memset etc.</span></div>
495
- <div class="line"><a name="l00424"></a><span class="lineno"> 424</span>&#160; <span class="comment">// STRCPY: like strcpy, strcpy_chk, wcscpy etc.</span></div>
496
- <div class="line"><a name="l00425"></a><span class="lineno"> 425</span>&#160; <span class="comment">// STRCAT: like strcat, strcat_chk, wcscat etc.</span></div>
497
- <div class="line"><a name="l00426"></a><span class="lineno"> 426</span>&#160; <span class="comment">// for other ext api like printf, scanf, etc., they have their own handlers</span></div>
498
- <div class="line"><a name="l00427"></a><span class="lineno"> 427</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616da">ExtAPIType</a> extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daad20658cd0f68b92583461b0b1f68d543">UNCLASSIFIED</a>;</div>
499
- <div class="line"><a name="l00428"></a><span class="lineno"> 428</span>&#160; <span class="comment">// get type of mem api</span></div>
500
- <div class="line"><a name="l00429"></a><span class="lineno"> 429</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">const</span> <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> &amp;annotation: fun-&gt;<a class="code" href="classSVF_1_1SVFFunction.html#a067bd6dbaf74a028d546fa56b095791b">getAnnotations</a>())</div>
501
- <div class="line"><a name="l00430"></a><span class="lineno"> 430</span>&#160; {</div>
502
- <div class="line"><a name="l00431"></a><span class="lineno"> 431</span>&#160; <span class="keywordflow">if</span> (annotation.find(<span class="stringliteral">&quot;MEMCPY&quot;</span>) != std::string::npos)</div>
503
- <div class="line"><a name="l00432"></a><span class="lineno"> 432</span>&#160; extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa9cc269dadf9cff7d399c54d9570a6614">MEMCPY</a>;</div>
504
- <div class="line"><a name="l00433"></a><span class="lineno"> 433</span>&#160; <span class="keywordflow">if</span> (annotation.find(<span class="stringliteral">&quot;MEMSET&quot;</span>) != std::string::npos)</div>
505
- <div class="line"><a name="l00434"></a><span class="lineno"> 434</span>&#160; extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa5aec33226dc590ec951d0f12bf35f15f">MEMSET</a>;</div>
506
- <div class="line"><a name="l00435"></a><span class="lineno"> 435</span>&#160; <span class="keywordflow">if</span> (annotation.find(<span class="stringliteral">&quot;STRCPY&quot;</span>) != std::string::npos)</div>
507
- <div class="line"><a name="l00436"></a><span class="lineno"> 436</span>&#160; extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa93c9b2a9dc4bdfba5a7b23cfa5f80ccb">STRCPY</a>;</div>
508
- <div class="line"><a name="l00437"></a><span class="lineno"> 437</span>&#160; <span class="keywordflow">if</span> (annotation.find(<span class="stringliteral">&quot;STRCAT&quot;</span>) != std::string::npos)</div>
509
- <div class="line"><a name="l00438"></a><span class="lineno"> 438</span>&#160; extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daae8dad405c06383859d8db715fd455317">STRCAT</a>;</div>
510
- <div class="line"><a name="l00439"></a><span class="lineno"> 439</span>&#160; }</div>
511
- <div class="line"><a name="l00440"></a><span class="lineno"> 440</span>&#160; <span class="comment">// 1. memcpy functions like memcpy_chk, strncpy, annotate(&quot;MEMCPY&quot;), annotate(&quot;BUF_CHECK:Arg0, Arg2&quot;), annotate(&quot;BUF_CHECK:Arg1, Arg2&quot;)</span></div>
512
- <div class="line"><a name="l00441"></a><span class="lineno"> 441</span>&#160; <span class="keywordflow">if</span> (extType == <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa9cc269dadf9cff7d399c54d9570a6614">MEMCPY</a>)</div>
513
- <div class="line"><a name="l00442"></a><span class="lineno"> 442</span>&#160; {</div>
514
- <div class="line"><a name="l00443"></a><span class="lineno"> 443</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>.count(fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>()) == 0)</div>
515
- <div class="line"><a name="l00444"></a><span class="lineno"> 444</span>&#160; {</div>
516
- <div class="line"><a name="l00445"></a><span class="lineno"> 445</span>&#160; <span class="comment">// if it is not in the rules, we do not check it</span></div>
517
- <div class="line"><a name="l00446"></a><span class="lineno"> 446</span>&#160; <a class="code" href="namespaceSVF_1_1SVFUtil.html#ab65033f068bfbeb0a1c52dcec3beb6bc">SVFUtil::errs</a>() &lt;&lt; <span class="stringliteral">&quot;Warning: &quot;</span> &lt;&lt; fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>() &lt;&lt; <span class="stringliteral">&quot; is not in the rules, please implement it\n&quot;</span>;</div>
518
- <div class="line"><a name="l00447"></a><span class="lineno"> 447</span>&#160; <span class="keywordflow">return</span>;</div>
519
- <div class="line"><a name="l00448"></a><span class="lineno"> 448</span>&#160; }</div>
520
- <div class="line"><a name="l00449"></a><span class="lineno"> 449</span>&#160; <span class="comment">// call parseMemcpyBufferCheckArgs to parse the BUF_CHECK annotation</span></div>
521
- <div class="line"><a name="l00450"></a><span class="lineno"> 450</span>&#160; std::vector&lt;std::pair&lt;u32_t, u32_t&gt;&gt; args = <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>.at(fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>());</div>
522
- <div class="line"><a name="l00451"></a><span class="lineno"> 451</span>&#160; <span class="comment">// loop the args and check the offset</span></div>
523
- <div class="line"><a name="l00452"></a><span class="lineno"> 452</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> arg: args)</div>
524
- <div class="line"><a name="l00453"></a><span class="lineno"> 453</span>&#160; {</div>
525
- <div class="line"><a name="l00454"></a><span class="lineno"> 454</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> <a class="code" href="cJSON_8cpp.html#a95bf816579e97b6f33bdb5e25ed6d5de">offset</a> =</div>
526
- <div class="line"><a name="l00455"></a><span class="lineno"> 455</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>()[<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(arg.second))] - <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(1);</div>
527
- <div class="line"><a name="l00456"></a><span class="lineno"> 456</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(arg.first), <a class="code" href="cJSON_8cpp.html#a95bf816579e97b6f33bdb5e25ed6d5de">offset</a>, call);</div>
528
- <div class="line"><a name="l00457"></a><span class="lineno"> 457</span>&#160; }</div>
529
- <div class="line"><a name="l00458"></a><span class="lineno"> 458</span>&#160; }</div>
530
- <div class="line"><a name="l00459"></a><span class="lineno"> 459</span>&#160; <span class="comment">// 2. memset functions like memset, memset_chk, annotate(&quot;MEMSET&quot;), annotate(&quot;BUF_CHECK:Arg0, Arg2&quot;)</span></div>
531
- <div class="line"><a name="l00460"></a><span class="lineno"> 460</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (extType == <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa5aec33226dc590ec951d0f12bf35f15f">MEMSET</a>)</div>
532
- <div class="line"><a name="l00461"></a><span class="lineno"> 461</span>&#160; {</div>
533
- <div class="line"><a name="l00462"></a><span class="lineno"> 462</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>.count(fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>()) == 0)</div>
534
- <div class="line"><a name="l00463"></a><span class="lineno"> 463</span>&#160; {</div>
535
- <div class="line"><a name="l00464"></a><span class="lineno"> 464</span>&#160; <span class="comment">// if it is not in the rules, we do not check it</span></div>
536
- <div class="line"><a name="l00465"></a><span class="lineno"> 465</span>&#160; <a class="code" href="namespaceSVF_1_1SVFUtil.html#ab65033f068bfbeb0a1c52dcec3beb6bc">SVFUtil::errs</a>() &lt;&lt; <span class="stringliteral">&quot;Warning: &quot;</span> &lt;&lt; fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>() &lt;&lt; <span class="stringliteral">&quot; is not in the rules, please implement it\n&quot;</span>;</div>
537
- <div class="line"><a name="l00466"></a><span class="lineno"> 466</span>&#160; <span class="keywordflow">return</span>;</div>
481
+ <div class="line"><a name="l00410"></a><span class="lineno"> 410</span>&#160; <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> cs = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a9815a5b31ac7dc21239d08e5b9f61106">SVFUtil::getSVFCallSite</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
482
+ <div class="line"><a name="l00411"></a><span class="lineno"> 411</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg0Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(0);</div>
483
+ <div class="line"><a name="l00412"></a><span class="lineno"> 412</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg2Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(2);</div>
484
+ <div class="line"><a name="l00413"></a><span class="lineno"> 413</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> arg2Num = es[<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(arg2Val)];</div>
485
+ <div class="line"><a name="l00414"></a><span class="lineno"> 414</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> strLen0 = <a class="code" href="classSVF_1_1AbstractInterpretation.html#af3c6f27181cc271332919732e490ad1d">getStrlen</a>(es, arg0Val);</div>
486
+ <div class="line"><a name="l00415"></a><span class="lineno"> 415</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> totalLen = strLen0 + arg2Num;</div>
487
+ <div class="line"><a name="l00416"></a><span class="lineno"> 416</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(arg0Val, totalLen, call);</div>
488
+ <div class="line"><a name="l00417"></a><span class="lineno"> 417</span>&#160; }</div>
489
+ <div class="line"><a name="l00418"></a><span class="lineno"> 418</span>&#160; <span class="keywordflow">else</span></div>
490
+ <div class="line"><a name="l00419"></a><span class="lineno"> 419</span>&#160; {</div>
491
+ <div class="line"><a name="l00420"></a><span class="lineno"> 420</span>&#160; assert(<span class="keyword">false</span> &amp;&amp; <span class="stringliteral">&quot;unknown strcat function, please add it to strcatGroup or strncatGroup&quot;</span>);</div>
492
+ <div class="line"><a name="l00421"></a><span class="lineno"> 421</span>&#160; abort();</div>
493
+ <div class="line"><a name="l00422"></a><span class="lineno"> 422</span>&#160; }</div>
494
+ <div class="line"><a name="l00423"></a><span class="lineno"> 423</span>&#160;}</div>
495
+ <div class="line"><a name="l00424"></a><span class="lineno"> 424</span>&#160; </div>
496
+ <div class="line"><a name="l00425"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#a1ed3cb0a1a118d9e505b192841a58dde"> 425</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#a1ed3cb0a1a118d9e505b192841a58dde">BufOverflowChecker::handleExtAPI</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a> *call)</div>
497
+ <div class="line"><a name="l00426"></a><span class="lineno"> 426</span>&#160;{</div>
498
+ <div class="line"><a name="l00427"></a><span class="lineno"> 427</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp; es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a11ceda75dbe328bcabdc6ff6919f9526">getState</a>(call);</div>
499
+ <div class="line"><a name="l00428"></a><span class="lineno"> 428</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a6cac9b69d85111a5a26373ec848a3282">AbstractInterpretation::handleExtAPI</a>(call);</div>
500
+ <div class="line"><a name="l00429"></a><span class="lineno"> 429</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFFunction.html">SVFFunction</a> *fun = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a145abbd2958629718fbca41d25c3124d">SVFUtil::getCallee</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
501
+ <div class="line"><a name="l00430"></a><span class="lineno"> 430</span>&#160; assert(fun &amp;&amp; <span class="stringliteral">&quot;SVFFunction* is nullptr&quot;</span>);</div>
502
+ <div class="line"><a name="l00431"></a><span class="lineno"> 431</span>&#160; <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> cs = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a9815a5b31ac7dc21239d08e5b9f61106">SVFUtil::getSVFCallSite</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
503
+ <div class="line"><a name="l00432"></a><span class="lineno"> 432</span>&#160; <span class="comment">// check the type of mem api,</span></div>
504
+ <div class="line"><a name="l00433"></a><span class="lineno"> 433</span>&#160; <span class="comment">// MEMCPY: like memcpy, memcpy_chk, llvm.memcpy etc.</span></div>
505
+ <div class="line"><a name="l00434"></a><span class="lineno"> 434</span>&#160; <span class="comment">// MEMSET: like memset, memset_chk, llvm.memset etc.</span></div>
506
+ <div class="line"><a name="l00435"></a><span class="lineno"> 435</span>&#160; <span class="comment">// STRCPY: like strcpy, strcpy_chk, wcscpy etc.</span></div>
507
+ <div class="line"><a name="l00436"></a><span class="lineno"> 436</span>&#160; <span class="comment">// STRCAT: like strcat, strcat_chk, wcscat etc.</span></div>
508
+ <div class="line"><a name="l00437"></a><span class="lineno"> 437</span>&#160; <span class="comment">// for other ext api like printf, scanf, etc., they have their own handlers</span></div>
509
+ <div class="line"><a name="l00438"></a><span class="lineno"> 438</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616da">ExtAPIType</a> extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daad20658cd0f68b92583461b0b1f68d543">UNCLASSIFIED</a>;</div>
510
+ <div class="line"><a name="l00439"></a><span class="lineno"> 439</span>&#160; <span class="comment">// get type of mem api</span></div>
511
+ <div class="line"><a name="l00440"></a><span class="lineno"> 440</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">const</span> <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> &amp;annotation: fun-&gt;<a class="code" href="classSVF_1_1SVFFunction.html#a067bd6dbaf74a028d546fa56b095791b">getAnnotations</a>())</div>
512
+ <div class="line"><a name="l00441"></a><span class="lineno"> 441</span>&#160; {</div>
513
+ <div class="line"><a name="l00442"></a><span class="lineno"> 442</span>&#160; <span class="keywordflow">if</span> (annotation.find(<span class="stringliteral">&quot;MEMCPY&quot;</span>) != std::string::npos)</div>
514
+ <div class="line"><a name="l00443"></a><span class="lineno"> 443</span>&#160; extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa9cc269dadf9cff7d399c54d9570a6614">MEMCPY</a>;</div>
515
+ <div class="line"><a name="l00444"></a><span class="lineno"> 444</span>&#160; <span class="keywordflow">if</span> (annotation.find(<span class="stringliteral">&quot;MEMSET&quot;</span>) != std::string::npos)</div>
516
+ <div class="line"><a name="l00445"></a><span class="lineno"> 445</span>&#160; extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa5aec33226dc590ec951d0f12bf35f15f">MEMSET</a>;</div>
517
+ <div class="line"><a name="l00446"></a><span class="lineno"> 446</span>&#160; <span class="keywordflow">if</span> (annotation.find(<span class="stringliteral">&quot;STRCPY&quot;</span>) != std::string::npos)</div>
518
+ <div class="line"><a name="l00447"></a><span class="lineno"> 447</span>&#160; extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa93c9b2a9dc4bdfba5a7b23cfa5f80ccb">STRCPY</a>;</div>
519
+ <div class="line"><a name="l00448"></a><span class="lineno"> 448</span>&#160; <span class="keywordflow">if</span> (annotation.find(<span class="stringliteral">&quot;STRCAT&quot;</span>) != std::string::npos)</div>
520
+ <div class="line"><a name="l00449"></a><span class="lineno"> 449</span>&#160; extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daae8dad405c06383859d8db715fd455317">STRCAT</a>;</div>
521
+ <div class="line"><a name="l00450"></a><span class="lineno"> 450</span>&#160; }</div>
522
+ <div class="line"><a name="l00451"></a><span class="lineno"> 451</span>&#160; <span class="comment">// 1. memcpy functions like memcpy_chk, strncpy, annotate(&quot;MEMCPY&quot;), annotate(&quot;BUF_CHECK:Arg0, Arg2&quot;), annotate(&quot;BUF_CHECK:Arg1, Arg2&quot;)</span></div>
523
+ <div class="line"><a name="l00452"></a><span class="lineno"> 452</span>&#160; <span class="keywordflow">if</span> (extType == <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa9cc269dadf9cff7d399c54d9570a6614">MEMCPY</a>)</div>
524
+ <div class="line"><a name="l00453"></a><span class="lineno"> 453</span>&#160; {</div>
525
+ <div class="line"><a name="l00454"></a><span class="lineno"> 454</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>.count(fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>()) == 0)</div>
526
+ <div class="line"><a name="l00455"></a><span class="lineno"> 455</span>&#160; {</div>
527
+ <div class="line"><a name="l00456"></a><span class="lineno"> 456</span>&#160; <span class="comment">// if it is not in the rules, we do not check it</span></div>
528
+ <div class="line"><a name="l00457"></a><span class="lineno"> 457</span>&#160; <a class="code" href="namespaceSVF_1_1SVFUtil.html#ab65033f068bfbeb0a1c52dcec3beb6bc">SVFUtil::errs</a>() &lt;&lt; <span class="stringliteral">&quot;Warning: &quot;</span> &lt;&lt; fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>() &lt;&lt; <span class="stringliteral">&quot; is not in the rules, please implement it\n&quot;</span>;</div>
529
+ <div class="line"><a name="l00458"></a><span class="lineno"> 458</span>&#160; <span class="keywordflow">return</span>;</div>
530
+ <div class="line"><a name="l00459"></a><span class="lineno"> 459</span>&#160; }</div>
531
+ <div class="line"><a name="l00460"></a><span class="lineno"> 460</span>&#160; <span class="comment">// call parseMemcpyBufferCheckArgs to parse the BUF_CHECK annotation</span></div>
532
+ <div class="line"><a name="l00461"></a><span class="lineno"> 461</span>&#160; std::vector&lt;std::pair&lt;u32_t, u32_t&gt;&gt; args = <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>.at(fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>());</div>
533
+ <div class="line"><a name="l00462"></a><span class="lineno"> 462</span>&#160; <span class="comment">// loop the args and check the offset</span></div>
534
+ <div class="line"><a name="l00463"></a><span class="lineno"> 463</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> arg: args)</div>
535
+ <div class="line"><a name="l00464"></a><span class="lineno"> 464</span>&#160; {</div>
536
+ <div class="line"><a name="l00465"></a><span class="lineno"> 465</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> <a class="code" href="cJSON_8cpp.html#a95bf816579e97b6f33bdb5e25ed6d5de">offset</a> = es[<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(arg.second))] - <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(1);</div>
537
+ <div class="line"><a name="l00466"></a><span class="lineno"> 466</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(arg.first), <a class="code" href="cJSON_8cpp.html#a95bf816579e97b6f33bdb5e25ed6d5de">offset</a>, call);</div>
538
538
  <div class="line"><a name="l00467"></a><span class="lineno"> 467</span>&#160; }</div>
539
- <div class="line"><a name="l00468"></a><span class="lineno"> 468</span>&#160; std::vector&lt;std::pair&lt;u32_t, u32_t&gt;&gt; args = <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>.at(fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>());</div>
540
- <div class="line"><a name="l00469"></a><span class="lineno"> 469</span>&#160; <span class="comment">// loop the args and check the offset</span></div>
541
- <div class="line"><a name="l00470"></a><span class="lineno"> 470</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> arg: args)</div>
542
- <div class="line"><a name="l00471"></a><span class="lineno"> 471</span>&#160; {</div>
543
- <div class="line"><a name="l00472"></a><span class="lineno"> 472</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> <a class="code" href="cJSON_8cpp.html#a95bf816579e97b6f33bdb5e25ed6d5de">offset</a> =</div>
544
- <div class="line"><a name="l00473"></a><span class="lineno"> 473</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>()[<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(arg.second))] - <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(1);</div>
545
- <div class="line"><a name="l00474"></a><span class="lineno"> 474</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(arg.first), <a class="code" href="cJSON_8cpp.html#a95bf816579e97b6f33bdb5e25ed6d5de">offset</a>, call);</div>
546
- <div class="line"><a name="l00475"></a><span class="lineno"> 475</span>&#160; }</div>
547
- <div class="line"><a name="l00476"></a><span class="lineno"> 476</span>&#160; }</div>
548
- <div class="line"><a name="l00477"></a><span class="lineno"> 477</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (extType == <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa93c9b2a9dc4bdfba5a7b23cfa5f80ccb">STRCPY</a>)</div>
549
- <div class="line"><a name="l00478"></a><span class="lineno"> 478</span>&#160; {</div>
550
- <div class="line"><a name="l00479"></a><span class="lineno"> 479</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad8b2f2fa6f22b9d1655135c819cbad8a">detectStrcpy</a>(call);</div>
551
- <div class="line"><a name="l00480"></a><span class="lineno"> 480</span>&#160; }</div>
552
- <div class="line"><a name="l00481"></a><span class="lineno"> 481</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (extType == <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daae8dad405c06383859d8db715fd455317">STRCAT</a>)</div>
553
- <div class="line"><a name="l00482"></a><span class="lineno"> 482</span>&#160; {</div>
554
- <div class="line"><a name="l00483"></a><span class="lineno"> 483</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#aa68f8aef09481d7c07dc59d7dfb83822">detectStrcat</a>(call);</div>
555
- <div class="line"><a name="l00484"></a><span class="lineno"> 484</span>&#160; }</div>
556
- <div class="line"><a name="l00485"></a><span class="lineno"> 485</span>&#160; <span class="keywordflow">else</span></div>
557
- <div class="line"><a name="l00486"></a><span class="lineno"> 486</span>&#160; {</div>
558
- <div class="line"><a name="l00487"></a><span class="lineno"> 487</span>&#160; </div>
559
- <div class="line"><a name="l00488"></a><span class="lineno"> 488</span>&#160; }</div>
560
- <div class="line"><a name="l00489"></a><span class="lineno"> 489</span>&#160; <span class="keywordflow">return</span>;</div>
561
- <div class="line"><a name="l00490"></a><span class="lineno"> 490</span>&#160;}</div>
562
- <div class="line"><a name="l00491"></a><span class="lineno"> 491</span>&#160; </div>
563
- <div class="line"><a name="l00492"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf"> 492</a></span>&#160;<span class="keywordtype">bool</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">BufOverflowChecker::canSafelyAccessMemory</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a> *value, <span class="keyword">const</span> <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> &amp;len, <span class="keyword">const</span> <a class="code" href="classSVF_1_1ICFGNode.html">ICFGNode</a> *curNode)</div>
564
- <div class="line"><a name="l00493"></a><span class="lineno"> 493</span>&#160;{</div>
565
- <div class="line"><a name="l00494"></a><span class="lineno"> 494</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a> *firstValue = value;</div>
539
+ <div class="line"><a name="l00468"></a><span class="lineno"> 468</span>&#160; }</div>
540
+ <div class="line"><a name="l00469"></a><span class="lineno"> 469</span>&#160; <span class="comment">// 2. memset functions like memset, memset_chk, annotate(&quot;MEMSET&quot;), annotate(&quot;BUF_CHECK:Arg0, Arg2&quot;)</span></div>
541
+ <div class="line"><a name="l00470"></a><span class="lineno"> 470</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (extType == <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa5aec33226dc590ec951d0f12bf35f15f">MEMSET</a>)</div>
542
+ <div class="line"><a name="l00471"></a><span class="lineno"> 471</span>&#160; {</div>
543
+ <div class="line"><a name="l00472"></a><span class="lineno"> 472</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>.count(fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>()) == 0)</div>
544
+ <div class="line"><a name="l00473"></a><span class="lineno"> 473</span>&#160; {</div>
545
+ <div class="line"><a name="l00474"></a><span class="lineno"> 474</span>&#160; <span class="comment">// if it is not in the rules, we do not check it</span></div>
546
+ <div class="line"><a name="l00475"></a><span class="lineno"> 475</span>&#160; <a class="code" href="namespaceSVF_1_1SVFUtil.html#ab65033f068bfbeb0a1c52dcec3beb6bc">SVFUtil::errs</a>() &lt;&lt; <span class="stringliteral">&quot;Warning: &quot;</span> &lt;&lt; fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>() &lt;&lt; <span class="stringliteral">&quot; is not in the rules, please implement it\n&quot;</span>;</div>
547
+ <div class="line"><a name="l00476"></a><span class="lineno"> 476</span>&#160; <span class="keywordflow">return</span>;</div>
548
+ <div class="line"><a name="l00477"></a><span class="lineno"> 477</span>&#160; }</div>
549
+ <div class="line"><a name="l00478"></a><span class="lineno"> 478</span>&#160; std::vector&lt;std::pair&lt;u32_t, u32_t&gt;&gt; args = <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>.at(fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>());</div>
550
+ <div class="line"><a name="l00479"></a><span class="lineno"> 479</span>&#160; <span class="comment">// loop the args and check the offset</span></div>
551
+ <div class="line"><a name="l00480"></a><span class="lineno"> 480</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> arg: args)</div>
552
+ <div class="line"><a name="l00481"></a><span class="lineno"> 481</span>&#160; {</div>
553
+ <div class="line"><a name="l00482"></a><span class="lineno"> 482</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> <a class="code" href="cJSON_8cpp.html#a95bf816579e97b6f33bdb5e25ed6d5de">offset</a> = es[<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(arg.second))] - <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(1);</div>
554
+ <div class="line"><a name="l00483"></a><span class="lineno"> 483</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(arg.first), <a class="code" href="cJSON_8cpp.html#a95bf816579e97b6f33bdb5e25ed6d5de">offset</a>, call);</div>
555
+ <div class="line"><a name="l00484"></a><span class="lineno"> 484</span>&#160; }</div>
556
+ <div class="line"><a name="l00485"></a><span class="lineno"> 485</span>&#160; }</div>
557
+ <div class="line"><a name="l00486"></a><span class="lineno"> 486</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (extType == <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa93c9b2a9dc4bdfba5a7b23cfa5f80ccb">STRCPY</a>)</div>
558
+ <div class="line"><a name="l00487"></a><span class="lineno"> 487</span>&#160; {</div>
559
+ <div class="line"><a name="l00488"></a><span class="lineno"> 488</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad8b2f2fa6f22b9d1655135c819cbad8a">detectStrcpy</a>(call);</div>
560
+ <div class="line"><a name="l00489"></a><span class="lineno"> 489</span>&#160; }</div>
561
+ <div class="line"><a name="l00490"></a><span class="lineno"> 490</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (extType == <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daae8dad405c06383859d8db715fd455317">STRCAT</a>)</div>
562
+ <div class="line"><a name="l00491"></a><span class="lineno"> 491</span>&#160; {</div>
563
+ <div class="line"><a name="l00492"></a><span class="lineno"> 492</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#aa68f8aef09481d7c07dc59d7dfb83822">detectStrcat</a>(call);</div>
564
+ <div class="line"><a name="l00493"></a><span class="lineno"> 493</span>&#160; }</div>
565
+ <div class="line"><a name="l00494"></a><span class="lineno"> 494</span>&#160; <span class="keywordflow">else</span></div>
566
+ <div class="line"><a name="l00495"></a><span class="lineno"> 495</span>&#160; {</div>
567
+ <div class="line"><a name="l00496"></a><span class="lineno"> 496</span>&#160; </div>
568
+ <div class="line"><a name="l00497"></a><span class="lineno"> 497</span>&#160; }</div>
569
+ <div class="line"><a name="l00498"></a><span class="lineno"> 498</span>&#160; <span class="keywordflow">return</span>;</div>
570
+ <div class="line"><a name="l00499"></a><span class="lineno"> 499</span>&#160;}</div>
566
571
  <div class="line"><a name="l00500"></a><span class="lineno"> 500</span>&#160; </div>
567
- <div class="line"><a name="l00503"></a><span class="lineno"> 503</span>&#160; <a class="code" href="classSVF_1_1FILOWorkList.html">SVF::FILOWorkList&lt;const SVFValue *&gt;</a> worklist;</div>
568
- <div class="line"><a name="l00504"></a><span class="lineno"> 504</span>&#160; <a class="code" href="namespaceSVF.html#af739db846e47ba6b2fd15eaad31ab7fb">Set&lt;const SVFValue *&gt;</a> visited;</div>
569
- <div class="line"><a name="l00505"></a><span class="lineno"> 505</span>&#160; visited.insert(value);</div>
570
- <div class="line"><a name="l00506"></a><span class="lineno"> 506</span>&#160; <a class="code" href="namespaceSVF.html#a8234d4b959abc9123993bcff4eee34c1">Map&lt;const ICFGNode *, IntervalValue&gt;</a> gep_offsets;</div>
571
- <div class="line"><a name="l00507"></a><span class="lineno"> 507</span>&#160; <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a> total_bytes = len.<a class="code" href="structSVF_1_1AbstractValue.html#acbcec6f55d23e6cd278fe8572a68f393">getInterval</a>();</div>
572
- <div class="line"><a name="l00508"></a><span class="lineno"> 508</span>&#160; worklist.<a class="code" href="classSVF_1_1FILOWorkList.html#afcf3fcda18e8d3e2bad70a51376c0ce1">push</a>(value);</div>
573
- <div class="line"><a name="l00509"></a><span class="lineno"> 509</span>&#160; std::vector&lt;const CallICFGNode *&gt; callstack = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9885b50cf28b65bebb488442085fab26">_callSiteStack</a>;</div>
574
- <div class="line"><a name="l00510"></a><span class="lineno"> 510</span>&#160; <span class="keywordflow">while</span> (!worklist.<a class="code" href="classSVF_1_1FILOWorkList.html#a071a624c91def82a4bbbf3806c7b7eea">empty</a>())</div>
575
- <div class="line"><a name="l00511"></a><span class="lineno"> 511</span>&#160; {</div>
576
- <div class="line"><a name="l00512"></a><span class="lineno"> 512</span>&#160; value = worklist.<a class="code" href="classSVF_1_1FILOWorkList.html#a3fd9acb6d09fd142bfd402fdf8cac93b">pop</a>();</div>
577
- <div class="line"><a name="l00513"></a><span class="lineno"> 513</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFInstruction.html">SVFInstruction</a> *ins = SVFUtil::dyn_cast&lt;SVFInstruction&gt;(value))</div>
578
- <div class="line"><a name="l00514"></a><span class="lineno"> 514</span>&#160; {</div>
579
- <div class="line"><a name="l00515"></a><span class="lineno"> 515</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1ICFGNode.html">ICFGNode</a> *node = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(ins);</div>
580
- <div class="line"><a name="l00516"></a><span class="lineno"> 516</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a> *callnode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(node))</div>
581
- <div class="line"><a name="l00517"></a><span class="lineno"> 517</span>&#160; {</div>
582
- <div class="line"><a name="l00518"></a><span class="lineno"> 518</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a29fe7c63c61a7aec8ae1477a061f5bf2">AccessMemoryViaRetNode</a>(callnode, worklist, visited);</div>
583
- <div class="line"><a name="l00519"></a><span class="lineno"> 519</span>&#160; }</div>
584
- <div class="line"><a name="l00520"></a><span class="lineno"> 520</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFStmt.html">SVFStmt</a> *stmt: node-&gt;<a class="code" href="classSVF_1_1ICFGNode.html#a6c68f52dd90728073fb79141df9b0661">getSVFStmts</a>())</div>
585
- <div class="line"><a name="l00521"></a><span class="lineno"> 521</span>&#160; {</div>
586
- <div class="line"><a name="l00522"></a><span class="lineno"> 522</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1CopyStmt.html">CopyStmt</a> *<a class="code" href="cJSON_8cpp.html#a7669ee67a0563250c1efaa24d130e1ac">copy</a> = SVFUtil::dyn_cast&lt;CopyStmt&gt;(stmt))</div>
587
- <div class="line"><a name="l00523"></a><span class="lineno"> 523</span>&#160; {</div>
588
- <div class="line"><a name="l00524"></a><span class="lineno"> 524</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a550c12360c2149ba0e55bdf4cf7b8dd0">AccessMemoryViaCopyStmt</a>(<a class="code" href="cJSON_8cpp.html#a7669ee67a0563250c1efaa24d130e1ac">copy</a>, worklist, visited);</div>
589
- <div class="line"><a name="l00525"></a><span class="lineno"> 525</span>&#160; }</div>
590
- <div class="line"><a name="l00526"></a><span class="lineno"> 526</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1LoadStmt.html">LoadStmt</a> *load = SVFUtil::dyn_cast&lt;LoadStmt&gt;(stmt))</div>
591
- <div class="line"><a name="l00527"></a><span class="lineno"> 527</span>&#160; {</div>
592
- <div class="line"><a name="l00528"></a><span class="lineno"> 528</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#ac60581a57407fa4c65b1975f5be687b8">AccessMemoryViaLoadStmt</a>(load, worklist, visited);</div>
593
- <div class="line"><a name="l00529"></a><span class="lineno"> 529</span>&#160; }</div>
594
- <div class="line"><a name="l00530"></a><span class="lineno"> 530</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1GepStmt.html">GepStmt</a> *gep = SVFUtil::dyn_cast&lt;GepStmt&gt;(stmt))</div>
595
- <div class="line"><a name="l00531"></a><span class="lineno"> 531</span>&#160; {</div>
596
- <div class="line"><a name="l00532"></a><span class="lineno"> 532</span>&#160; <span class="comment">// there are 3 type of gepStmt</span></div>
597
- <div class="line"><a name="l00533"></a><span class="lineno"> 533</span>&#160; <span class="comment">// 1. ptr get offset</span></div>
598
- <div class="line"><a name="l00534"></a><span class="lineno"> 534</span>&#160; <span class="comment">// 2. struct get field</span></div>
599
- <div class="line"><a name="l00535"></a><span class="lineno"> 535</span>&#160; <span class="comment">// 3. array get element</span></div>
600
- <div class="line"><a name="l00536"></a><span class="lineno"> 536</span>&#160; <span class="comment">// for array gep, there are two kind of overflow checking</span></div>
601
- <div class="line"><a name="l00537"></a><span class="lineno"> 537</span>&#160; <span class="comment">// Arr [Struct.C * 10] arr, Struct.C {i32 a, i32 b}</span></div>
602
- <div class="line"><a name="l00538"></a><span class="lineno"> 538</span>&#160; <span class="comment">// arr[11].a = **, it is &quot;lhs = gep *arr, 0 (ptr), 11 (arrIdx), 0 (ptr), 0(struct field)&quot;</span></div>
603
- <div class="line"><a name="l00539"></a><span class="lineno"> 539</span>&#160; <span class="comment">// 1) in this case arrIdx 11 is overflow.</span></div>
604
- <div class="line"><a name="l00540"></a><span class="lineno"> 540</span>&#160; <span class="comment">// Other case,</span></div>
605
- <div class="line"><a name="l00541"></a><span class="lineno"> 541</span>&#160; <span class="comment">// Struct.C {i32 a, [i32*10] b, i32 c}, C.b[11] = 1</span></div>
606
- <div class="line"><a name="l00542"></a><span class="lineno"> 542</span>&#160; <span class="comment">// it is &quot;lhs - gep *C, 0(ptr), 1(struct field), 0(ptr), 11(arrIdx)&quot;</span></div>
607
- <div class="line"><a name="l00543"></a><span class="lineno"> 543</span>&#160; <span class="comment">// 2) in this case arrIdx 11 is larger than its getOffsetVar.Type Array([i32*10])</span></div>
608
- <div class="line"><a name="l00544"></a><span class="lineno"> 544</span>&#160; </div>
609
- <div class="line"><a name="l00545"></a><span class="lineno"> 545</span>&#160; <span class="comment">// therefore, if last getOffsetVar.Type is not the Array, just check the overall offset and its</span></div>
610
- <div class="line"><a name="l00546"></a><span class="lineno"> 546</span>&#160; <span class="comment">// gep source type size (together with totalOffset along the value flow).</span></div>
611
- <div class="line"><a name="l00547"></a><span class="lineno"> 547</span>&#160; <span class="comment">// so if curgepOffset + totalOffset &gt;= gepSrc (overflow)</span></div>
612
- <div class="line"><a name="l00548"></a><span class="lineno"> 548</span>&#160; <span class="comment">// else totalOffset += curgepOffset</span></div>
613
- <div class="line"><a name="l00549"></a><span class="lineno"> 549</span>&#160; </div>
614
- <div class="line"><a name="l00550"></a><span class="lineno"> 550</span>&#160; <span class="comment">// otherwise, if last getOffsetVar.Type is the Array, check the last idx and array. (just offset,</span></div>
615
- <div class="line"><a name="l00551"></a><span class="lineno"> 551</span>&#160; <span class="comment">// not with totalOffset during check)</span></div>
616
- <div class="line"><a name="l00552"></a><span class="lineno"> 552</span>&#160; <span class="comment">// so if getOffsetVarVal &gt; getOffsetVar.TypeSize (overflow)</span></div>
617
- <div class="line"><a name="l00553"></a><span class="lineno"> 553</span>&#160; <span class="comment">// else safe and return.</span></div>
618
- <div class="line"><a name="l00554"></a><span class="lineno"> 554</span>&#160; <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a> byteOffset;</div>
619
- <div class="line"><a name="l00555"></a><span class="lineno"> 555</span>&#160; <span class="keywordflow">if</span> (gep-&gt;isConstantOffset())</div>
620
- <div class="line"><a name="l00556"></a><span class="lineno"> 556</span>&#160; {</div>
621
- <div class="line"><a name="l00557"></a><span class="lineno"> 557</span>&#160; byteOffset = <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(gep-&gt;accumulateConstantByteOffset());</div>
622
- <div class="line"><a name="l00558"></a><span class="lineno"> 558</span>&#160; }</div>
623
- <div class="line"><a name="l00559"></a><span class="lineno"> 559</span>&#160; <span class="keywordflow">else</span></div>
624
- <div class="line"><a name="l00560"></a><span class="lineno"> 560</span>&#160; {</div>
625
- <div class="line"><a name="l00561"></a><span class="lineno"> 561</span>&#160; byteOffset =</div>
626
- <div class="line"><a name="l00562"></a><span class="lineno"> 562</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a21e927af79c73460ff5629cbd4961163">getByteOffset</a>(gep).<a class="code" href="structSVF_1_1AbstractValue.html#acbcec6f55d23e6cd278fe8572a68f393">getInterval</a>();</div>
627
- <div class="line"><a name="l00563"></a><span class="lineno"> 563</span>&#160; }</div>
628
- <div class="line"><a name="l00564"></a><span class="lineno"> 564</span>&#160; <span class="comment">// for variable offset, join with accumulate gep offset</span></div>
629
- <div class="line"><a name="l00565"></a><span class="lineno"> 565</span>&#160; gep_offsets[gep-&gt;getICFGNode()] = byteOffset;</div>
630
- <div class="line"><a name="l00566"></a><span class="lineno"> 566</span>&#160; <span class="keywordflow">if</span> (byteOffset.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &gt;= <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>() &amp;&amp; <a class="code" href="classSVF_1_1Options.html#a6450b984f67d3cfa3f44892e8eea555e">Options::GepUnknownIdx</a>())</div>
631
- <div class="line"><a name="l00567"></a><span class="lineno"> 567</span>&#160; {</div>
632
- <div class="line"><a name="l00568"></a><span class="lineno"> 568</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
633
- <div class="line"><a name="l00569"></a><span class="lineno"> 569</span>&#160; }</div>
634
- <div class="line"><a name="l00570"></a><span class="lineno"> 570</span>&#160; </div>
635
- <div class="line"><a name="l00571"></a><span class="lineno"> 571</span>&#160; <span class="keywordflow">if</span> (gep-&gt;getOffsetVarAndGepTypePairVec().size() &gt; 0)</div>
636
- <div class="line"><a name="l00572"></a><span class="lineno"> 572</span>&#160; {</div>
637
- <div class="line"><a name="l00573"></a><span class="lineno"> 573</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFVar.html">SVFVar</a> *gepVal = gep-&gt;getOffsetVarAndGepTypePairVec().back().first;</div>
638
- <div class="line"><a name="l00574"></a><span class="lineno"> 574</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFType.html">SVFType</a> *gepType = gep-&gt;getOffsetVarAndGepTypePairVec().back().second;</div>
639
- <div class="line"><a name="l00575"></a><span class="lineno"> 575</span>&#160; </div>
640
- <div class="line"><a name="l00576"></a><span class="lineno"> 576</span>&#160; <span class="keywordflow">if</span> (gepType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a330084f9a3deb6e5acb52a8ee3eb7fe4">isArrayTy</a>())</div>
641
- <div class="line"><a name="l00577"></a><span class="lineno"> 577</span>&#160; {</div>
642
- <div class="line"><a name="l00578"></a><span class="lineno"> 578</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFArrayType.html">SVFArrayType</a> *gepArrType = SVFUtil::dyn_cast&lt;SVFArrayType&gt;(gepType);</div>
643
- <div class="line"><a name="l00579"></a><span class="lineno"> 579</span>&#160; <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a> gepArrTotalByte(0);</div>
644
- <div class="line"><a name="l00580"></a><span class="lineno"> 580</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a> *idxValue = gepVal-&gt;<a class="code" href="classSVF_1_1SVFVar.html#ac2db6304ea5526fb446ae882983beeb0">getValue</a>();</div>
645
- <div class="line"><a name="l00581"></a><span class="lineno"> 581</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> arrElemSize = gepArrType-&gt;<a class="code" href="classSVF_1_1SVFArrayType.html#a28da1169748e38b891133b76568a2759">getTypeOfElement</a>()-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
646
- <div class="line"><a name="l00582"></a><span class="lineno"> 582</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFConstantInt.html">SVFConstantInt</a> *op = SVFUtil::dyn_cast&lt;SVFConstantInt&gt;(idxValue))</div>
647
- <div class="line"><a name="l00583"></a><span class="lineno"> 583</span>&#160; {</div>
648
- <div class="line"><a name="l00584"></a><span class="lineno"> 584</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> lb = (double) <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>() / arrElemSize &gt;= op-&gt;getSExtValue() ?</div>
649
- <div class="line"><a name="l00585"></a><span class="lineno"> 585</span>&#160; op-&gt;getSExtValue() * arrElemSize : <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>();</div>
650
- <div class="line"><a name="l00586"></a><span class="lineno"> 586</span>&#160; gepArrTotalByte = gepArrTotalByte + <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(lb, lb);</div>
651
- <div class="line"><a name="l00587"></a><span class="lineno"> 587</span>&#160; }</div>
652
- <div class="line"><a name="l00588"></a><span class="lineno"> 588</span>&#160; <span class="keywordflow">else</span></div>
653
- <div class="line"><a name="l00589"></a><span class="lineno"> 589</span>&#160; {</div>
654
- <div class="line"><a name="l00590"></a><span class="lineno"> 590</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> idx = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(idxValue);</div>
655
- <div class="line"><a name="l00591"></a><span class="lineno"> 591</span>&#160; <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a> idxVal =</div>
656
- <div class="line"><a name="l00592"></a><span class="lineno"> 592</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>()[idx].getInterval();</div>
657
- <div class="line"><a name="l00593"></a><span class="lineno"> 593</span>&#160; <span class="keywordflow">if</span> (idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#a674f9bb98053f8658e246863d6561072">isBottom</a>())</div>
658
- <div class="line"><a name="l00594"></a><span class="lineno"> 594</span>&#160; {</div>
659
- <div class="line"><a name="l00595"></a><span class="lineno"> 595</span>&#160; gepArrTotalByte = gepArrTotalByte + <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(0, 0);</div>
660
- <div class="line"><a name="l00596"></a><span class="lineno"> 596</span>&#160; }</div>
661
- <div class="line"><a name="l00597"></a><span class="lineno"> 597</span>&#160; <span class="keywordflow">else</span></div>
662
- <div class="line"><a name="l00598"></a><span class="lineno"> 598</span>&#160; {</div>
663
- <div class="line"><a name="l00599"></a><span class="lineno"> 599</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> ub = (idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &lt; 0) ? 0 :</div>
664
- <div class="line"><a name="l00600"></a><span class="lineno"> 600</span>&#160; (<span class="keywordtype">double</span>) <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>() / arrElemSize &gt;=</div>
665
- <div class="line"><a name="l00601"></a><span class="lineno"> 601</span>&#160; idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() ?</div>
666
- <div class="line"><a name="l00602"></a><span class="lineno"> 602</span>&#160; arrElemSize * idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() : <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>();</div>
667
- <div class="line"><a name="l00603"></a><span class="lineno"> 603</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> lb = (idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &lt; 0) ? 0 :</div>
668
- <div class="line"><a name="l00604"></a><span class="lineno"> 604</span>&#160; ((<span class="keywordtype">double</span>) <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>() / arrElemSize &gt;=</div>
669
- <div class="line"><a name="l00605"></a><span class="lineno"> 605</span>&#160; idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>()) ?</div>
670
- <div class="line"><a name="l00606"></a><span class="lineno"> 606</span>&#160; arrElemSize * idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() : <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>();</div>
671
- <div class="line"><a name="l00607"></a><span class="lineno"> 607</span>&#160; gepArrTotalByte = gepArrTotalByte + <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(lb, ub);</div>
672
- <div class="line"><a name="l00608"></a><span class="lineno"> 608</span>&#160; }</div>
673
- <div class="line"><a name="l00609"></a><span class="lineno"> 609</span>&#160; }</div>
674
- <div class="line"><a name="l00610"></a><span class="lineno"> 610</span>&#160; total_bytes = total_bytes + gepArrTotalByte;</div>
675
- <div class="line"><a name="l00611"></a><span class="lineno"> 611</span>&#160; <span class="keywordflow">if</span> (total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &gt;= gepArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>())</div>
676
- <div class="line"><a name="l00612"></a><span class="lineno"> 612</span>&#160; {</div>
677
- <div class="line"><a name="l00613"></a><span class="lineno"> 613</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> msg =</div>
678
- <div class="line"><a name="l00614"></a><span class="lineno"> 614</span>&#160; <span class="stringliteral">&quot;Buffer overflow!! Accessing buffer range: &quot;</span> +</div>
679
- <div class="line"><a name="l00615"></a><span class="lineno"> 615</span>&#160; <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(total_bytes) +</div>
680
- <div class="line"><a name="l00616"></a><span class="lineno"> 616</span>&#160; <span class="stringliteral">&quot;\nAllocated Gep buffer size: &quot;</span> +</div>
681
- <div class="line"><a name="l00617"></a><span class="lineno"> 617</span>&#160; std::to_string(gepArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>()) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
682
- <div class="line"><a name="l00618"></a><span class="lineno"> 618</span>&#160; msg += <span class="stringliteral">&quot;Position: &quot;</span> + firstValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a4a0cfe3a8f37d33ffcdca3d66026dcc3">toString</a>() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
683
- <div class="line"><a name="l00619"></a><span class="lineno"> 619</span>&#160; msg += <span class="stringliteral">&quot; The following is the value flow. [[\n&quot;</span>;</div>
684
- <div class="line"><a name="l00620"></a><span class="lineno"> 620</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> it = gep_offsets.begin(); it != gep_offsets.end(); ++it)</div>
685
- <div class="line"><a name="l00621"></a><span class="lineno"> 621</span>&#160; {</div>
686
- <div class="line"><a name="l00622"></a><span class="lineno"> 622</span>&#160; msg += it-&gt;first-&gt;toString() + <span class="stringliteral">&quot;, Offset: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(it-&gt;second) +</div>
687
- <div class="line"><a name="l00623"></a><span class="lineno"> 623</span>&#160; <span class="stringliteral">&quot;\n&quot;</span>;</div>
688
- <div class="line"><a name="l00624"></a><span class="lineno"> 624</span>&#160; }</div>
689
- <div class="line"><a name="l00625"></a><span class="lineno"> 625</span>&#160; msg += <span class="stringliteral">&quot;]].\nAlloc Site: &quot;</span> + gep-&gt;toString() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
690
- <div class="line"><a name="l00626"></a><span class="lineno"> 626</span>&#160; </div>
691
- <div class="line"><a name="l00627"></a><span class="lineno"> 627</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<a class="code" href="namespaceSVF_1_1SVFUtil.html#a7655b13bbfe720ca2b8a25e0a72528e6">SVFUtil::errMsg</a>(msg), gepArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>(),</div>
692
- <div class="line"><a name="l00628"></a><span class="lineno"> 628</span>&#160; gepArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>(),</div>
693
- <div class="line"><a name="l00629"></a><span class="lineno"> 629</span>&#160; total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(), total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(),</div>
694
- <div class="line"><a name="l00630"></a><span class="lineno"> 630</span>&#160; firstValue);</div>
695
- <div class="line"><a name="l00631"></a><span class="lineno"> 631</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, curNode);</div>
696
- <div class="line"><a name="l00632"></a><span class="lineno"> 632</span>&#160; <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
697
- <div class="line"><a name="l00633"></a><span class="lineno"> 633</span>&#160; }</div>
698
- <div class="line"><a name="l00634"></a><span class="lineno"> 634</span>&#160; <span class="keywordflow">else</span></div>
699
- <div class="line"><a name="l00635"></a><span class="lineno"> 635</span>&#160; {</div>
700
- <div class="line"><a name="l00636"></a><span class="lineno"> 636</span>&#160; <span class="comment">// for gep last index&#39;s type is arr, stop here.</span></div>
701
- <div class="line"><a name="l00637"></a><span class="lineno"> 637</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
702
- <div class="line"><a name="l00638"></a><span class="lineno"> 638</span>&#160; }</div>
703
- <div class="line"><a name="l00639"></a><span class="lineno"> 639</span>&#160; }</div>
704
- <div class="line"><a name="l00640"></a><span class="lineno"> 640</span>&#160; <span class="keywordflow">else</span></div>
705
- <div class="line"><a name="l00641"></a><span class="lineno"> 641</span>&#160; {</div>
706
- <div class="line"><a name="l00642"></a><span class="lineno"> 642</span>&#160; total_bytes = total_bytes + byteOffset;</div>
707
- <div class="line"><a name="l00643"></a><span class="lineno"> 643</span>&#160; }</div>
708
- <div class="line"><a name="l00644"></a><span class="lineno"> 644</span>&#160; </div>
709
- <div class="line"><a name="l00645"></a><span class="lineno"> 645</span>&#160; }</div>
710
- <div class="line"><a name="l00646"></a><span class="lineno"> 646</span>&#160; <span class="keywordflow">if</span> (!visited.count(gep-&gt;getRHSVar()-&gt;getValue()))</div>
711
- <div class="line"><a name="l00647"></a><span class="lineno"> 647</span>&#160; {</div>
712
- <div class="line"><a name="l00648"></a><span class="lineno"> 648</span>&#160; visited.insert(gep-&gt;getRHSVar()-&gt;getValue());</div>
713
- <div class="line"><a name="l00649"></a><span class="lineno"> 649</span>&#160; worklist.<a class="code" href="classSVF_1_1FILOWorkList.html#afcf3fcda18e8d3e2bad70a51376c0ce1">push</a>(gep-&gt;getRHSVar()-&gt;getValue());</div>
714
- <div class="line"><a name="l00650"></a><span class="lineno"> 650</span>&#160; }</div>
715
- <div class="line"><a name="l00651"></a><span class="lineno"> 651</span>&#160; }</div>
716
- <div class="line"><a name="l00652"></a><span class="lineno"> 652</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1AddrStmt.html">AddrStmt</a> *addr = SVFUtil::dyn_cast&lt;AddrStmt&gt;(stmt))</div>
717
- <div class="line"><a name="l00653"></a><span class="lineno"> 653</span>&#160; {</div>
718
- <div class="line"><a name="l00654"></a><span class="lineno"> 654</span>&#160; <span class="comment">// addrStmt is source node.</span></div>
719
- <div class="line"><a name="l00655"></a><span class="lineno"> 655</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> arr_type_size = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a0e8b546f608417e218c2fab5a5893135">getAllocaInstByteSize</a>(addr);</div>
720
- <div class="line"><a name="l00656"></a><span class="lineno"> 656</span>&#160; <span class="keywordflow">if</span> (total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &gt;= arr_type_size ||</div>
721
- <div class="line"><a name="l00657"></a><span class="lineno"> 657</span>&#160; total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &lt; 0)</div>
722
- <div class="line"><a name="l00658"></a><span class="lineno"> 658</span>&#160; {</div>
723
- <div class="line"><a name="l00659"></a><span class="lineno"> 659</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> msg =</div>
724
- <div class="line"><a name="l00660"></a><span class="lineno"> 660</span>&#160; <span class="stringliteral">&quot;Buffer overflow!! Accessing buffer range: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(total_bytes) +</div>
725
- <div class="line"><a name="l00661"></a><span class="lineno"> 661</span>&#160; <span class="stringliteral">&quot;\nAllocated buffer size: &quot;</span> + std::to_string(arr_type_size) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
726
- <div class="line"><a name="l00662"></a><span class="lineno"> 662</span>&#160; msg += <span class="stringliteral">&quot;Position: &quot;</span> + firstValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a4a0cfe3a8f37d33ffcdca3d66026dcc3">toString</a>() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
727
- <div class="line"><a name="l00663"></a><span class="lineno"> 663</span>&#160; msg += <span class="stringliteral">&quot; The following is the value flow. [[\n&quot;</span>;</div>
728
- <div class="line"><a name="l00664"></a><span class="lineno"> 664</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> it = gep_offsets.begin(); it != gep_offsets.end(); ++it)</div>
729
- <div class="line"><a name="l00665"></a><span class="lineno"> 665</span>&#160; {</div>
730
- <div class="line"><a name="l00666"></a><span class="lineno"> 666</span>&#160; msg += it-&gt;first-&gt;toString() + <span class="stringliteral">&quot;, Offset: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(it-&gt;second) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
731
- <div class="line"><a name="l00667"></a><span class="lineno"> 667</span>&#160; }</div>
732
- <div class="line"><a name="l00668"></a><span class="lineno"> 668</span>&#160; msg += <span class="stringliteral">&quot;]].\n Alloc Site: &quot;</span> + addr-&gt;toString() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
733
- <div class="line"><a name="l00669"></a><span class="lineno"> 669</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<a class="code" href="namespaceSVF_1_1SVFUtil.html#ac71522e8c55f84cfc6c13a0ddff18436">SVFUtil::wrnMsg</a>(msg), arr_type_size, arr_type_size,</div>
734
- <div class="line"><a name="l00670"></a><span class="lineno"> 670</span>&#160; total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(), total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(),</div>
735
- <div class="line"><a name="l00671"></a><span class="lineno"> 671</span>&#160; firstValue);</div>
736
- <div class="line"><a name="l00672"></a><span class="lineno"> 672</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, curNode);</div>
737
- <div class="line"><a name="l00673"></a><span class="lineno"> 673</span>&#160; <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
738
- <div class="line"><a name="l00674"></a><span class="lineno"> 674</span>&#160; }</div>
739
- <div class="line"><a name="l00675"></a><span class="lineno"> 675</span>&#160; <span class="keywordflow">else</span></div>
740
- <div class="line"><a name="l00676"></a><span class="lineno"> 676</span>&#160; {</div>
741
- <div class="line"><a name="l00677"></a><span class="lineno"> 677</span>&#160; </div>
742
- <div class="line"><a name="l00678"></a><span class="lineno"> 678</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
743
- <div class="line"><a name="l00679"></a><span class="lineno"> 679</span>&#160; }</div>
744
- <div class="line"><a name="l00680"></a><span class="lineno"> 680</span>&#160; }</div>
745
- <div class="line"><a name="l00681"></a><span class="lineno"> 681</span>&#160; }</div>
746
- <div class="line"><a name="l00682"></a><span class="lineno"> 682</span>&#160; }</div>
747
- <div class="line"><a name="l00683"></a><span class="lineno"> 683</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFGlobalValue.html">SVF::SVFGlobalValue</a> *gvalue = SVFUtil::dyn_cast&lt;SVF::SVFGlobalValue&gt;(value))</div>
748
- <div class="line"><a name="l00684"></a><span class="lineno"> 684</span>&#160; {</div>
749
- <div class="line"><a name="l00685"></a><span class="lineno"> 685</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> arr_type_size = 0;</div>
750
- <div class="line"><a name="l00686"></a><span class="lineno"> 686</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFType.html">SVFType</a> *svftype = gvalue-&gt;getType();</div>
751
- <div class="line"><a name="l00687"></a><span class="lineno"> 687</span>&#160; <span class="keywordflow">if</span> (SVFUtil::isa&lt;SVFPointerType&gt;(svftype))</div>
752
- <div class="line"><a name="l00688"></a><span class="lineno"> 688</span>&#160; {</div>
753
- <div class="line"><a name="l00689"></a><span class="lineno"> 689</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFArrayType.html">SVFArrayType</a> *ptrArrType = SVFUtil::dyn_cast&lt;SVFArrayType&gt;(</div>
754
- <div class="line"><a name="l00690"></a><span class="lineno"> 690</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2057e8e1c0aaf39e74f0a8fb2a1b580c">getPointeeElement</a>(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(gvalue))))</div>
755
- <div class="line"><a name="l00691"></a><span class="lineno"> 691</span>&#160; arr_type_size = ptrArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
756
- <div class="line"><a name="l00692"></a><span class="lineno"> 692</span>&#160; <span class="keywordflow">else</span></div>
757
- <div class="line"><a name="l00693"></a><span class="lineno"> 693</span>&#160; arr_type_size = svftype-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
758
- <div class="line"><a name="l00694"></a><span class="lineno"> 694</span>&#160; }</div>
759
- <div class="line"><a name="l00695"></a><span class="lineno"> 695</span>&#160; <span class="keywordflow">else</span></div>
760
- <div class="line"><a name="l00696"></a><span class="lineno"> 696</span>&#160; arr_type_size = svftype-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
761
- <div class="line"><a name="l00697"></a><span class="lineno"> 697</span>&#160; </div>
762
- <div class="line"><a name="l00698"></a><span class="lineno"> 698</span>&#160; <span class="keywordflow">if</span> (total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &gt;= arr_type_size || total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &lt; 0)</div>
763
- <div class="line"><a name="l00699"></a><span class="lineno"> 699</span>&#160; {</div>
764
- <div class="line"><a name="l00700"></a><span class="lineno"> 700</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> msg = <span class="stringliteral">&quot;Buffer overflow!! Accessing buffer range: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(total_bytes) +</div>
765
- <div class="line"><a name="l00701"></a><span class="lineno"> 701</span>&#160; <span class="stringliteral">&quot;\nAllocated buffer size: &quot;</span> + std::to_string(arr_type_size) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
766
- <div class="line"><a name="l00702"></a><span class="lineno"> 702</span>&#160; msg += <span class="stringliteral">&quot;Position: &quot;</span> + firstValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a4a0cfe3a8f37d33ffcdca3d66026dcc3">toString</a>() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
767
- <div class="line"><a name="l00703"></a><span class="lineno"> 703</span>&#160; msg += <span class="stringliteral">&quot; The following is the value flow.\n[[&quot;</span>;</div>
768
- <div class="line"><a name="l00704"></a><span class="lineno"> 704</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> it = gep_offsets.begin(); it != gep_offsets.end(); ++it)</div>
769
- <div class="line"><a name="l00705"></a><span class="lineno"> 705</span>&#160; {</div>
770
- <div class="line"><a name="l00706"></a><span class="lineno"> 706</span>&#160; msg += it-&gt;first-&gt;toString() + <span class="stringliteral">&quot;, Offset: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(it-&gt;second) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
771
- <div class="line"><a name="l00707"></a><span class="lineno"> 707</span>&#160; }</div>
772
- <div class="line"><a name="l00708"></a><span class="lineno"> 708</span>&#160; msg += <span class="stringliteral">&quot;]]. \nAlloc Site: &quot;</span> + gvalue-&gt;toString() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
773
- <div class="line"><a name="l00709"></a><span class="lineno"> 709</span>&#160; </div>
774
- <div class="line"><a name="l00710"></a><span class="lineno"> 710</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<a class="code" href="namespaceSVF_1_1SVFUtil.html#ac71522e8c55f84cfc6c13a0ddff18436">SVFUtil::wrnMsg</a>(msg), arr_type_size, arr_type_size,</div>
775
- <div class="line"><a name="l00711"></a><span class="lineno"> 711</span>&#160; total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(), total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(), firstValue);</div>
776
- <div class="line"><a name="l00712"></a><span class="lineno"> 712</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, curNode);</div>
777
- <div class="line"><a name="l00713"></a><span class="lineno"> 713</span>&#160; <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
778
- <div class="line"><a name="l00714"></a><span class="lineno"> 714</span>&#160; }</div>
779
- <div class="line"><a name="l00715"></a><span class="lineno"> 715</span>&#160; <span class="keywordflow">else</span></div>
780
- <div class="line"><a name="l00716"></a><span class="lineno"> 716</span>&#160; {</div>
781
- <div class="line"><a name="l00717"></a><span class="lineno"> 717</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
782
- <div class="line"><a name="l00718"></a><span class="lineno"> 718</span>&#160; }</div>
783
- <div class="line"><a name="l00719"></a><span class="lineno"> 719</span>&#160; }</div>
784
- <div class="line"><a name="l00720"></a><span class="lineno"> 720</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFArgument.html">SVF::SVFArgument</a> *arg = SVFUtil::dyn_cast&lt;SVF::SVFArgument&gt;(value))</div>
785
- <div class="line"><a name="l00721"></a><span class="lineno"> 721</span>&#160; {</div>
786
- <div class="line"><a name="l00722"></a><span class="lineno"> 722</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a048e203517ac727e6fe0653e1f24052c">AccessMemoryViaCallArgs</a>(arg, worklist, visited);</div>
787
- <div class="line"><a name="l00723"></a><span class="lineno"> 723</span>&#160; }</div>
788
- <div class="line"><a name="l00724"></a><span class="lineno"> 724</span>&#160; <span class="keywordflow">else</span></div>
789
- <div class="line"><a name="l00725"></a><span class="lineno"> 725</span>&#160; {</div>
790
- <div class="line"><a name="l00726"></a><span class="lineno"> 726</span>&#160; <span class="comment">// maybe SVFConstant</span></div>
791
- <div class="line"><a name="l00727"></a><span class="lineno"> 727</span>&#160; <span class="comment">// it may be cannot find the source, maybe we start from non-main function,</span></div>
792
- <div class="line"><a name="l00728"></a><span class="lineno"> 728</span>&#160; <span class="comment">// therefore it loses the value flow track</span></div>
793
- <div class="line"><a name="l00729"></a><span class="lineno"> 729</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
794
- <div class="line"><a name="l00730"></a><span class="lineno"> 730</span>&#160; }</div>
795
- <div class="line"><a name="l00731"></a><span class="lineno"> 731</span>&#160; }</div>
796
- <div class="line"><a name="l00732"></a><span class="lineno"> 732</span>&#160; <span class="comment">// it may be cannot find the source, maybe we start from non-main function,</span></div>
797
- <div class="line"><a name="l00733"></a><span class="lineno"> 733</span>&#160; <span class="comment">// therefore it loses the value flow track</span></div>
798
- <div class="line"><a name="l00734"></a><span class="lineno"> 734</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
799
- <div class="line"><a name="l00735"></a><span class="lineno"> 735</span>&#160;}</div>
800
- <div class="line"><a name="l00736"></a><span class="lineno"> 736</span>&#160; </div>
801
- <div class="line"><a name="l00737"></a><span class="lineno"> 737</span>&#160; </div>
802
- <div class="line"><a name="l00738"></a><span class="lineno"> 738</span>&#160; </div>
803
- <div class="line"><a name="l00739"></a><span class="lineno"> 739</span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#afa6b30220b0b3261205a909def9ca44e">BufOverflowChecker::handleICFGNode</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1ICFGNode.html">SVF::ICFGNode</a> *node)</div>
804
- <div class="line"><a name="l00740"></a><span class="lineno"> 740</span>&#160;{</div>
805
- <div class="line"><a name="l00741"></a><span class="lineno"> 741</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9b179466955023f275b6692b59048846">AbstractInterpretation::handleICFGNode</a>(node);</div>
806
- <div class="line"><a name="l00742"></a><span class="lineno"> 742</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a52de7d619e8746a70718719306d7c5a1">detectBufOverflow</a>(node);</div>
807
- <div class="line"><a name="l00743"></a><span class="lineno"> 743</span>&#160;}</div>
808
- <div class="line"><a name="l00744"></a><span class="lineno"> 744</span>&#160; </div>
809
- <div class="line"><a name="l00745"></a><span class="lineno"> 745</span>&#160;<span class="comment">//</span></div>
810
- <div class="line"><a name="l00746"></a><span class="lineno"> 746</span>&#160;<span class="keywordtype">bool</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#a52de7d619e8746a70718719306d7c5a1">BufOverflowChecker::detectBufOverflow</a>(<span class="keyword">const</span> ICFGNode *node)</div>
811
- <div class="line"><a name="l00747"></a><span class="lineno"> 747</span>&#160;{</div>
812
- <div class="line"><a name="l00748"></a><span class="lineno"> 748</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span>* stmt: node-&gt;getSVFStmts())</div>
813
- <div class="line"><a name="l00749"></a><span class="lineno"> 749</span>&#160; {</div>
814
- <div class="line"><a name="l00750"></a><span class="lineno"> 750</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> GepStmt *gep = SVFUtil::dyn_cast&lt;GepStmt&gt;(stmt))</div>
815
- <div class="line"><a name="l00751"></a><span class="lineno"> 751</span>&#160; {</div>
816
- <div class="line"><a name="l00752"></a><span class="lineno"> 752</span>&#160; <span class="keyword">const</span> SVFVar* gepRhs = gep-&gt;getRHSVar();</div>
817
- <div class="line"><a name="l00753"></a><span class="lineno"> 753</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> SVFInstruction* inst = SVFUtil::dyn_cast&lt;SVFInstruction&gt;(gepRhs-&gt;getValue()))</div>
818
- <div class="line"><a name="l00754"></a><span class="lineno"> 754</span>&#160; {</div>
819
- <div class="line"><a name="l00755"></a><span class="lineno"> 755</span>&#160; <span class="keyword">const</span> ICFGNode* icfgNode = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(inst);</div>
820
- <div class="line"><a name="l00756"></a><span class="lineno"> 756</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">const</span> SVFStmt* stmt2: icfgNode-&gt;getSVFStmts())</div>
821
- <div class="line"><a name="l00757"></a><span class="lineno"> 757</span>&#160; {</div>
822
- <div class="line"><a name="l00758"></a><span class="lineno"> 758</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> GepStmt *gep2 = SVFUtil::dyn_cast&lt;GepStmt&gt;(stmt2))</div>
823
- <div class="line"><a name="l00759"></a><span class="lineno"> 759</span>&#160; {</div>
824
- <div class="line"><a name="l00760"></a><span class="lineno"> 760</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(gep2-&gt;getLHSVar()-&gt;getValue(), IntervalValue(0, 0), node);</div>
825
- <div class="line"><a name="l00761"></a><span class="lineno"> 761</span>&#160; }</div>
826
- <div class="line"><a name="l00762"></a><span class="lineno"> 762</span>&#160; }</div>
827
- <div class="line"><a name="l00763"></a><span class="lineno"> 763</span>&#160; }</div>
828
- <div class="line"><a name="l00764"></a><span class="lineno"> 764</span>&#160; }</div>
829
- <div class="line"><a name="l00765"></a><span class="lineno"> 765</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> LoadStmt* load = SVFUtil::dyn_cast&lt;LoadStmt&gt;(stmt))</div>
830
- <div class="line"><a name="l00766"></a><span class="lineno"> 766</span>&#160; {</div>
831
- <div class="line"><a name="l00767"></a><span class="lineno"> 767</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a62baa9403069a9b1e010eaeb2f6b9b34">inVarToAddrsTable</a>(load-&gt;getRHSVarID()))</div>
832
- <div class="line"><a name="l00768"></a><span class="lineno"> 768</span>&#160; {</div>
833
- <div class="line"><a name="l00769"></a><span class="lineno"> 769</span>&#160; AbstractValue Addrs =</div>
834
- <div class="line"><a name="l00770"></a><span class="lineno"> 770</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#aa3e62b9ef912def502b95992199f5d8c">getAddrs</a>(load-&gt;getRHSVarID());</div>
835
- <div class="line"><a name="l00771"></a><span class="lineno"> 771</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> vaddr: Addrs.getAddrs())</div>
836
- <div class="line"><a name="l00772"></a><span class="lineno"> 772</span>&#160; {</div>
837
- <div class="line"><a name="l00773"></a><span class="lineno"> 773</span>&#160; <a class="code" href="CommandLine_8h.html#a2429346d37bd4c40889bd7c6d319d9da">u32_t</a> objId = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#ac37760566b534d89a61d789b00efb993">getInternalID</a>(vaddr);</div>
838
- <div class="line"><a name="l00774"></a><span class="lineno"> 774</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.find(objId) != <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.end())</div>
839
- <div class="line"><a name="l00775"></a><span class="lineno"> 775</span>&#160; {</div>
840
- <div class="line"><a name="l00776"></a><span class="lineno"> 776</span>&#160; <span class="keyword">const</span> GepStmt* gep = <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.at(objId);</div>
841
- <div class="line"><a name="l00777"></a><span class="lineno"> 777</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(gep-&gt;getLHSVar()-&gt;getValue(), IntervalValue(0, 0), node);</div>
842
- <div class="line"><a name="l00778"></a><span class="lineno"> 778</span>&#160; }</div>
843
- <div class="line"><a name="l00779"></a><span class="lineno"> 779</span>&#160; }</div>
844
- <div class="line"><a name="l00780"></a><span class="lineno"> 780</span>&#160; }</div>
845
- <div class="line"><a name="l00781"></a><span class="lineno"> 781</span>&#160; }</div>
846
- <div class="line"><a name="l00782"></a><span class="lineno"> 782</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> StoreStmt* store = SVFUtil::dyn_cast&lt;StoreStmt&gt;(stmt))</div>
847
- <div class="line"><a name="l00783"></a><span class="lineno"> 783</span>&#160; {</div>
848
- <div class="line"><a name="l00784"></a><span class="lineno"> 784</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a62baa9403069a9b1e010eaeb2f6b9b34">inVarToAddrsTable</a>(store-&gt;getLHSVarID()))</div>
849
- <div class="line"><a name="l00785"></a><span class="lineno"> 785</span>&#160; {</div>
850
- <div class="line"><a name="l00786"></a><span class="lineno"> 786</span>&#160; AbstractValue Addrs =</div>
851
- <div class="line"><a name="l00787"></a><span class="lineno"> 787</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#aa3e62b9ef912def502b95992199f5d8c">getAddrs</a>(store-&gt;getLHSVarID());</div>
852
- <div class="line"><a name="l00788"></a><span class="lineno"> 788</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> vaddr: Addrs.getAddrs())</div>
853
- <div class="line"><a name="l00789"></a><span class="lineno"> 789</span>&#160; {</div>
854
- <div class="line"><a name="l00790"></a><span class="lineno"> 790</span>&#160; <a class="code" href="CommandLine_8h.html#a2429346d37bd4c40889bd7c6d319d9da">u32_t</a> objId = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#ac37760566b534d89a61d789b00efb993">getInternalID</a>(vaddr);</div>
855
- <div class="line"><a name="l00791"></a><span class="lineno"> 791</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.find(objId) != <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.end())</div>
856
- <div class="line"><a name="l00792"></a><span class="lineno"> 792</span>&#160; {</div>
857
- <div class="line"><a name="l00793"></a><span class="lineno"> 793</span>&#160; <span class="keyword">const</span> GepStmt* gep = <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.at(objId);</div>
858
- <div class="line"><a name="l00794"></a><span class="lineno"> 794</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(gep-&gt;getLHSVar()-&gt;getValue(), IntervalValue(0, 0), node);</div>
859
- <div class="line"><a name="l00795"></a><span class="lineno"> 795</span>&#160; }</div>
860
- <div class="line"><a name="l00796"></a><span class="lineno"> 796</span>&#160; }</div>
861
- <div class="line"><a name="l00797"></a><span class="lineno"> 797</span>&#160; }</div>
862
- <div class="line"><a name="l00798"></a><span class="lineno"> 798</span>&#160; }</div>
863
- <div class="line"><a name="l00799"></a><span class="lineno"> 799</span>&#160; }</div>
864
- <div class="line"><a name="l00800"></a><span class="lineno"> 800</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
865
- <div class="line"><a name="l00801"></a><span class="lineno"> 801</span>&#160;}</div>
866
- <div class="line"><a name="l00802"></a><span class="lineno"> 802</span>&#160; </div>
867
- <div class="line"><a name="l00803"></a><span class="lineno"> 803</span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">BufOverflowChecker::addBugToRecoder</a>(<span class="keyword">const</span> BufOverflowException&amp; e, <span class="keyword">const</span> ICFGNode* node)</div>
868
- <div class="line"><a name="l00804"></a><span class="lineno"> 804</span>&#160;{</div>
869
- <div class="line"><a name="l00805"></a><span class="lineno"> 805</span>&#160; <span class="keyword">const</span> SVFInstruction* inst = <span class="keyword">nullptr</span>;</div>
870
- <div class="line"><a name="l00806"></a><span class="lineno"> 806</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> CallICFGNode* call = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(node))</div>
871
- <div class="line"><a name="l00807"></a><span class="lineno"> 807</span>&#160; {</div>
872
- <div class="line"><a name="l00808"></a><span class="lineno"> 808</span>&#160; inst = call-&gt;getCallSite();</div>
572
+ <div class="line"><a name="l00501"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf"> 501</a></span>&#160;<span class="keywordtype">bool</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">BufOverflowChecker::canSafelyAccessMemory</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a> *value, <span class="keyword">const</span> <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> &amp;len, <span class="keyword">const</span> <a class="code" href="classSVF_1_1ICFGNode.html">ICFGNode</a> *curNode)</div>
573
+ <div class="line"><a name="l00502"></a><span class="lineno"> 502</span>&#160;{</div>
574
+ <div class="line"><a name="l00503"></a><span class="lineno"> 503</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp; es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a11ceda75dbe328bcabdc6ff6919f9526">getState</a>(curNode);</div>
575
+ <div class="line"><a name="l00504"></a><span class="lineno"> 504</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a> *firstValue = value;</div>
576
+ <div class="line"><a name="l00510"></a><span class="lineno"> 510</span>&#160; </div>
577
+ <div class="line"><a name="l00513"></a><span class="lineno"> 513</span>&#160; <a class="code" href="classSVF_1_1FILOWorkList.html">SVF::FILOWorkList&lt;const SVFValue *&gt;</a> worklist;</div>
578
+ <div class="line"><a name="l00514"></a><span class="lineno"> 514</span>&#160; <a class="code" href="namespaceSVF.html#af739db846e47ba6b2fd15eaad31ab7fb">Set&lt;const SVFValue *&gt;</a> visited;</div>
579
+ <div class="line"><a name="l00515"></a><span class="lineno"> 515</span>&#160; visited.insert(value);</div>
580
+ <div class="line"><a name="l00516"></a><span class="lineno"> 516</span>&#160; <a class="code" href="namespaceSVF.html#a8234d4b959abc9123993bcff4eee34c1">Map&lt;const ICFGNode *, IntervalValue&gt;</a> gep_offsets;</div>
581
+ <div class="line"><a name="l00517"></a><span class="lineno"> 517</span>&#160; <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a> total_bytes = len.<a class="code" href="structSVF_1_1AbstractValue.html#acbcec6f55d23e6cd278fe8572a68f393">getInterval</a>();</div>
582
+ <div class="line"><a name="l00518"></a><span class="lineno"> 518</span>&#160; worklist.<a class="code" href="classSVF_1_1FILOWorkList.html#afcf3fcda18e8d3e2bad70a51376c0ce1">push</a>(value);</div>
583
+ <div class="line"><a name="l00519"></a><span class="lineno"> 519</span>&#160; std::vector&lt;const CallICFGNode *&gt; callstack = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9885b50cf28b65bebb488442085fab26">_callSiteStack</a>;</div>
584
+ <div class="line"><a name="l00520"></a><span class="lineno"> 520</span>&#160; <span class="keywordflow">while</span> (!worklist.<a class="code" href="classSVF_1_1FILOWorkList.html#a071a624c91def82a4bbbf3806c7b7eea">empty</a>())</div>
585
+ <div class="line"><a name="l00521"></a><span class="lineno"> 521</span>&#160; {</div>
586
+ <div class="line"><a name="l00522"></a><span class="lineno"> 522</span>&#160; value = worklist.<a class="code" href="classSVF_1_1FILOWorkList.html#a3fd9acb6d09fd142bfd402fdf8cac93b">pop</a>();</div>
587
+ <div class="line"><a name="l00523"></a><span class="lineno"> 523</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFInstruction.html">SVFInstruction</a> *ins = SVFUtil::dyn_cast&lt;SVFInstruction&gt;(value))</div>
588
+ <div class="line"><a name="l00524"></a><span class="lineno"> 524</span>&#160; {</div>
589
+ <div class="line"><a name="l00525"></a><span class="lineno"> 525</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1ICFGNode.html">ICFGNode</a> *node = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(ins);</div>
590
+ <div class="line"><a name="l00526"></a><span class="lineno"> 526</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a> *callnode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(node))</div>
591
+ <div class="line"><a name="l00527"></a><span class="lineno"> 527</span>&#160; {</div>
592
+ <div class="line"><a name="l00528"></a><span class="lineno"> 528</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a29fe7c63c61a7aec8ae1477a061f5bf2">AccessMemoryViaRetNode</a>(callnode, worklist, visited);</div>
593
+ <div class="line"><a name="l00529"></a><span class="lineno"> 529</span>&#160; }</div>
594
+ <div class="line"><a name="l00530"></a><span class="lineno"> 530</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFStmt.html">SVFStmt</a> *stmt: node-&gt;<a class="code" href="classSVF_1_1ICFGNode.html#a6c68f52dd90728073fb79141df9b0661">getSVFStmts</a>())</div>
595
+ <div class="line"><a name="l00531"></a><span class="lineno"> 531</span>&#160; {</div>
596
+ <div class="line"><a name="l00532"></a><span class="lineno"> 532</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1CopyStmt.html">CopyStmt</a> *<a class="code" href="cJSON_8cpp.html#a7669ee67a0563250c1efaa24d130e1ac">copy</a> = SVFUtil::dyn_cast&lt;CopyStmt&gt;(stmt))</div>
597
+ <div class="line"><a name="l00533"></a><span class="lineno"> 533</span>&#160; {</div>
598
+ <div class="line"><a name="l00534"></a><span class="lineno"> 534</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a550c12360c2149ba0e55bdf4cf7b8dd0">AccessMemoryViaCopyStmt</a>(<a class="code" href="cJSON_8cpp.html#a7669ee67a0563250c1efaa24d130e1ac">copy</a>, worklist, visited);</div>
599
+ <div class="line"><a name="l00535"></a><span class="lineno"> 535</span>&#160; }</div>
600
+ <div class="line"><a name="l00536"></a><span class="lineno"> 536</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1LoadStmt.html">LoadStmt</a> *load = SVFUtil::dyn_cast&lt;LoadStmt&gt;(stmt))</div>
601
+ <div class="line"><a name="l00537"></a><span class="lineno"> 537</span>&#160; {</div>
602
+ <div class="line"><a name="l00538"></a><span class="lineno"> 538</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a37e8e190a8a29d550752d012b9f6e890">AccessMemoryViaLoadStmt</a>(es, load, worklist, visited);</div>
603
+ <div class="line"><a name="l00539"></a><span class="lineno"> 539</span>&#160; }</div>
604
+ <div class="line"><a name="l00540"></a><span class="lineno"> 540</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1GepStmt.html">GepStmt</a> *gep = SVFUtil::dyn_cast&lt;GepStmt&gt;(stmt))</div>
605
+ <div class="line"><a name="l00541"></a><span class="lineno"> 541</span>&#160; {</div>
606
+ <div class="line"><a name="l00542"></a><span class="lineno"> 542</span>&#160; <span class="comment">// there are 3 type of gepStmt</span></div>
607
+ <div class="line"><a name="l00543"></a><span class="lineno"> 543</span>&#160; <span class="comment">// 1. ptr get offset</span></div>
608
+ <div class="line"><a name="l00544"></a><span class="lineno"> 544</span>&#160; <span class="comment">// 2. struct get field</span></div>
609
+ <div class="line"><a name="l00545"></a><span class="lineno"> 545</span>&#160; <span class="comment">// 3. array get element</span></div>
610
+ <div class="line"><a name="l00546"></a><span class="lineno"> 546</span>&#160; <span class="comment">// for array gep, there are two kind of overflow checking</span></div>
611
+ <div class="line"><a name="l00547"></a><span class="lineno"> 547</span>&#160; <span class="comment">// Arr [Struct.C * 10] arr, Struct.C {i32 a, i32 b}</span></div>
612
+ <div class="line"><a name="l00548"></a><span class="lineno"> 548</span>&#160; <span class="comment">// arr[11].a = **, it is &quot;lhs = gep *arr, 0 (ptr), 11 (arrIdx), 0 (ptr), 0(struct field)&quot;</span></div>
613
+ <div class="line"><a name="l00549"></a><span class="lineno"> 549</span>&#160; <span class="comment">// 1) in this case arrIdx 11 is overflow.</span></div>
614
+ <div class="line"><a name="l00550"></a><span class="lineno"> 550</span>&#160; <span class="comment">// Other case,</span></div>
615
+ <div class="line"><a name="l00551"></a><span class="lineno"> 551</span>&#160; <span class="comment">// Struct.C {i32 a, [i32*10] b, i32 c}, C.b[11] = 1</span></div>
616
+ <div class="line"><a name="l00552"></a><span class="lineno"> 552</span>&#160; <span class="comment">// it is &quot;lhs - gep *C, 0(ptr), 1(struct field), 0(ptr), 11(arrIdx)&quot;</span></div>
617
+ <div class="line"><a name="l00553"></a><span class="lineno"> 553</span>&#160; <span class="comment">// 2) in this case arrIdx 11 is larger than its getOffsetVar.Type Array([i32*10])</span></div>
618
+ <div class="line"><a name="l00554"></a><span class="lineno"> 554</span>&#160; </div>
619
+ <div class="line"><a name="l00555"></a><span class="lineno"> 555</span>&#160; <span class="comment">// therefore, if last getOffsetVar.Type is not the Array, just check the overall offset and its</span></div>
620
+ <div class="line"><a name="l00556"></a><span class="lineno"> 556</span>&#160; <span class="comment">// gep source type size (together with totalOffset along the value flow).</span></div>
621
+ <div class="line"><a name="l00557"></a><span class="lineno"> 557</span>&#160; <span class="comment">// so if curgepOffset + totalOffset &gt;= gepSrc (overflow)</span></div>
622
+ <div class="line"><a name="l00558"></a><span class="lineno"> 558</span>&#160; <span class="comment">// else totalOffset += curgepOffset</span></div>
623
+ <div class="line"><a name="l00559"></a><span class="lineno"> 559</span>&#160; </div>
624
+ <div class="line"><a name="l00560"></a><span class="lineno"> 560</span>&#160; <span class="comment">// otherwise, if last getOffsetVar.Type is the Array, check the last idx and array. (just offset,</span></div>
625
+ <div class="line"><a name="l00561"></a><span class="lineno"> 561</span>&#160; <span class="comment">// not with totalOffset during check)</span></div>
626
+ <div class="line"><a name="l00562"></a><span class="lineno"> 562</span>&#160; <span class="comment">// so if getOffsetVarVal &gt; getOffsetVar.TypeSize (overflow)</span></div>
627
+ <div class="line"><a name="l00563"></a><span class="lineno"> 563</span>&#160; <span class="comment">// else safe and return.</span></div>
628
+ <div class="line"><a name="l00564"></a><span class="lineno"> 564</span>&#160; <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a> byteOffset;</div>
629
+ <div class="line"><a name="l00565"></a><span class="lineno"> 565</span>&#160; <span class="keywordflow">if</span> (gep-&gt;isConstantOffset())</div>
630
+ <div class="line"><a name="l00566"></a><span class="lineno"> 566</span>&#160; {</div>
631
+ <div class="line"><a name="l00567"></a><span class="lineno"> 567</span>&#160; byteOffset = <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(gep-&gt;accumulateConstantByteOffset());</div>
632
+ <div class="line"><a name="l00568"></a><span class="lineno"> 568</span>&#160; }</div>
633
+ <div class="line"><a name="l00569"></a><span class="lineno"> 569</span>&#160; <span class="keywordflow">else</span></div>
634
+ <div class="line"><a name="l00570"></a><span class="lineno"> 570</span>&#160; {</div>
635
+ <div class="line"><a name="l00571"></a><span class="lineno"> 571</span>&#160; byteOffset =</div>
636
+ <div class="line"><a name="l00572"></a><span class="lineno"> 572</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#aec9a351850857fa3c6fb23c58317cb0d">getByteOffset</a>(es, gep).<a class="code" href="structSVF_1_1AbstractValue.html#acbcec6f55d23e6cd278fe8572a68f393">getInterval</a>();</div>
637
+ <div class="line"><a name="l00573"></a><span class="lineno"> 573</span>&#160; }</div>
638
+ <div class="line"><a name="l00574"></a><span class="lineno"> 574</span>&#160; <span class="comment">// for variable offset, join with accumulate gep offset</span></div>
639
+ <div class="line"><a name="l00575"></a><span class="lineno"> 575</span>&#160; gep_offsets[gep-&gt;getICFGNode()] = byteOffset;</div>
640
+ <div class="line"><a name="l00576"></a><span class="lineno"> 576</span>&#160; <span class="keywordflow">if</span> (byteOffset.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &gt;= <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>() &amp;&amp; <a class="code" href="classSVF_1_1Options.html#a6450b984f67d3cfa3f44892e8eea555e">Options::GepUnknownIdx</a>())</div>
641
+ <div class="line"><a name="l00577"></a><span class="lineno"> 577</span>&#160; {</div>
642
+ <div class="line"><a name="l00578"></a><span class="lineno"> 578</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
643
+ <div class="line"><a name="l00579"></a><span class="lineno"> 579</span>&#160; }</div>
644
+ <div class="line"><a name="l00580"></a><span class="lineno"> 580</span>&#160; </div>
645
+ <div class="line"><a name="l00581"></a><span class="lineno"> 581</span>&#160; <span class="keywordflow">if</span> (gep-&gt;getOffsetVarAndGepTypePairVec().size() &gt; 0)</div>
646
+ <div class="line"><a name="l00582"></a><span class="lineno"> 582</span>&#160; {</div>
647
+ <div class="line"><a name="l00583"></a><span class="lineno"> 583</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFVar.html">SVFVar</a> *gepVal = gep-&gt;getOffsetVarAndGepTypePairVec().back().first;</div>
648
+ <div class="line"><a name="l00584"></a><span class="lineno"> 584</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFType.html">SVFType</a> *gepType = gep-&gt;getOffsetVarAndGepTypePairVec().back().second;</div>
649
+ <div class="line"><a name="l00585"></a><span class="lineno"> 585</span>&#160; </div>
650
+ <div class="line"><a name="l00586"></a><span class="lineno"> 586</span>&#160; <span class="keywordflow">if</span> (gepType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a330084f9a3deb6e5acb52a8ee3eb7fe4">isArrayTy</a>())</div>
651
+ <div class="line"><a name="l00587"></a><span class="lineno"> 587</span>&#160; {</div>
652
+ <div class="line"><a name="l00588"></a><span class="lineno"> 588</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFArrayType.html">SVFArrayType</a> *gepArrType = SVFUtil::dyn_cast&lt;SVFArrayType&gt;(gepType);</div>
653
+ <div class="line"><a name="l00589"></a><span class="lineno"> 589</span>&#160; <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a> gepArrTotalByte(0);</div>
654
+ <div class="line"><a name="l00590"></a><span class="lineno"> 590</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a> *idxValue = gepVal-&gt;<a class="code" href="classSVF_1_1SVFVar.html#ac2db6304ea5526fb446ae882983beeb0">getValue</a>();</div>
655
+ <div class="line"><a name="l00591"></a><span class="lineno"> 591</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> arrElemSize = gepArrType-&gt;<a class="code" href="classSVF_1_1SVFArrayType.html#a28da1169748e38b891133b76568a2759">getTypeOfElement</a>()-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
656
+ <div class="line"><a name="l00592"></a><span class="lineno"> 592</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFConstantInt.html">SVFConstantInt</a> *op = SVFUtil::dyn_cast&lt;SVFConstantInt&gt;(idxValue))</div>
657
+ <div class="line"><a name="l00593"></a><span class="lineno"> 593</span>&#160; {</div>
658
+ <div class="line"><a name="l00594"></a><span class="lineno"> 594</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> lb = (double) <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>() / arrElemSize &gt;= op-&gt;getSExtValue() ?</div>
659
+ <div class="line"><a name="l00595"></a><span class="lineno"> 595</span>&#160; op-&gt;getSExtValue() * arrElemSize : <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>();</div>
660
+ <div class="line"><a name="l00596"></a><span class="lineno"> 596</span>&#160; gepArrTotalByte = gepArrTotalByte + <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(lb, lb);</div>
661
+ <div class="line"><a name="l00597"></a><span class="lineno"> 597</span>&#160; }</div>
662
+ <div class="line"><a name="l00598"></a><span class="lineno"> 598</span>&#160; <span class="keywordflow">else</span></div>
663
+ <div class="line"><a name="l00599"></a><span class="lineno"> 599</span>&#160; {</div>
664
+ <div class="line"><a name="l00600"></a><span class="lineno"> 600</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> idx = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(idxValue);</div>
665
+ <div class="line"><a name="l00601"></a><span class="lineno"> 601</span>&#160; <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a> idxVal = es[idx].getInterval();</div>
666
+ <div class="line"><a name="l00602"></a><span class="lineno"> 602</span>&#160; <span class="keywordflow">if</span> (idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#a674f9bb98053f8658e246863d6561072">isBottom</a>())</div>
667
+ <div class="line"><a name="l00603"></a><span class="lineno"> 603</span>&#160; {</div>
668
+ <div class="line"><a name="l00604"></a><span class="lineno"> 604</span>&#160; gepArrTotalByte = gepArrTotalByte + <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(0, 0);</div>
669
+ <div class="line"><a name="l00605"></a><span class="lineno"> 605</span>&#160; }</div>
670
+ <div class="line"><a name="l00606"></a><span class="lineno"> 606</span>&#160; <span class="keywordflow">else</span></div>
671
+ <div class="line"><a name="l00607"></a><span class="lineno"> 607</span>&#160; {</div>
672
+ <div class="line"><a name="l00608"></a><span class="lineno"> 608</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> ub = (idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &lt; 0) ? 0 :</div>
673
+ <div class="line"><a name="l00609"></a><span class="lineno"> 609</span>&#160; (<span class="keywordtype">double</span>) <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>() / arrElemSize &gt;=</div>
674
+ <div class="line"><a name="l00610"></a><span class="lineno"> 610</span>&#160; idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() ?</div>
675
+ <div class="line"><a name="l00611"></a><span class="lineno"> 611</span>&#160; arrElemSize * idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() : <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>();</div>
676
+ <div class="line"><a name="l00612"></a><span class="lineno"> 612</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> lb = (idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &lt; 0) ? 0 :</div>
677
+ <div class="line"><a name="l00613"></a><span class="lineno"> 613</span>&#160; ((<span class="keywordtype">double</span>) <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>() / arrElemSize &gt;=</div>
678
+ <div class="line"><a name="l00614"></a><span class="lineno"> 614</span>&#160; idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>()) ?</div>
679
+ <div class="line"><a name="l00615"></a><span class="lineno"> 615</span>&#160; arrElemSize * idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() : <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>();</div>
680
+ <div class="line"><a name="l00616"></a><span class="lineno"> 616</span>&#160; gepArrTotalByte = gepArrTotalByte + <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(lb, ub);</div>
681
+ <div class="line"><a name="l00617"></a><span class="lineno"> 617</span>&#160; }</div>
682
+ <div class="line"><a name="l00618"></a><span class="lineno"> 618</span>&#160; }</div>
683
+ <div class="line"><a name="l00619"></a><span class="lineno"> 619</span>&#160; total_bytes = total_bytes + gepArrTotalByte;</div>
684
+ <div class="line"><a name="l00620"></a><span class="lineno"> 620</span>&#160; <span class="keywordflow">if</span> (total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &gt;= gepArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>())</div>
685
+ <div class="line"><a name="l00621"></a><span class="lineno"> 621</span>&#160; {</div>
686
+ <div class="line"><a name="l00622"></a><span class="lineno"> 622</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> msg =</div>
687
+ <div class="line"><a name="l00623"></a><span class="lineno"> 623</span>&#160; <span class="stringliteral">&quot;Buffer overflow!! Accessing buffer range: &quot;</span> +</div>
688
+ <div class="line"><a name="l00624"></a><span class="lineno"> 624</span>&#160; <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(total_bytes) +</div>
689
+ <div class="line"><a name="l00625"></a><span class="lineno"> 625</span>&#160; <span class="stringliteral">&quot;\nAllocated Gep buffer size: &quot;</span> +</div>
690
+ <div class="line"><a name="l00626"></a><span class="lineno"> 626</span>&#160; std::to_string(gepArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>()) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
691
+ <div class="line"><a name="l00627"></a><span class="lineno"> 627</span>&#160; msg += <span class="stringliteral">&quot;Position: &quot;</span> + firstValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a4a0cfe3a8f37d33ffcdca3d66026dcc3">toString</a>() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
692
+ <div class="line"><a name="l00628"></a><span class="lineno"> 628</span>&#160; msg += <span class="stringliteral">&quot; The following is the value flow. [[\n&quot;</span>;</div>
693
+ <div class="line"><a name="l00629"></a><span class="lineno"> 629</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> it = gep_offsets.begin(); it != gep_offsets.end(); ++it)</div>
694
+ <div class="line"><a name="l00630"></a><span class="lineno"> 630</span>&#160; {</div>
695
+ <div class="line"><a name="l00631"></a><span class="lineno"> 631</span>&#160; msg += it-&gt;first-&gt;toString() + <span class="stringliteral">&quot;, Offset: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(it-&gt;second) +</div>
696
+ <div class="line"><a name="l00632"></a><span class="lineno"> 632</span>&#160; <span class="stringliteral">&quot;\n&quot;</span>;</div>
697
+ <div class="line"><a name="l00633"></a><span class="lineno"> 633</span>&#160; }</div>
698
+ <div class="line"><a name="l00634"></a><span class="lineno"> 634</span>&#160; msg += <span class="stringliteral">&quot;]].\nAlloc Site: &quot;</span> + gep-&gt;toString() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
699
+ <div class="line"><a name="l00635"></a><span class="lineno"> 635</span>&#160; </div>
700
+ <div class="line"><a name="l00636"></a><span class="lineno"> 636</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<a class="code" href="namespaceSVF_1_1SVFUtil.html#a7655b13bbfe720ca2b8a25e0a72528e6">SVFUtil::errMsg</a>(msg), gepArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>(),</div>
701
+ <div class="line"><a name="l00637"></a><span class="lineno"> 637</span>&#160; gepArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>(),</div>
702
+ <div class="line"><a name="l00638"></a><span class="lineno"> 638</span>&#160; total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(), total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(),</div>
703
+ <div class="line"><a name="l00639"></a><span class="lineno"> 639</span>&#160; firstValue);</div>
704
+ <div class="line"><a name="l00640"></a><span class="lineno"> 640</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, curNode);</div>
705
+ <div class="line"><a name="l00641"></a><span class="lineno"> 641</span>&#160; <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
706
+ <div class="line"><a name="l00642"></a><span class="lineno"> 642</span>&#160; }</div>
707
+ <div class="line"><a name="l00643"></a><span class="lineno"> 643</span>&#160; <span class="keywordflow">else</span></div>
708
+ <div class="line"><a name="l00644"></a><span class="lineno"> 644</span>&#160; {</div>
709
+ <div class="line"><a name="l00645"></a><span class="lineno"> 645</span>&#160; <span class="comment">// for gep last index&#39;s type is arr, stop here.</span></div>
710
+ <div class="line"><a name="l00646"></a><span class="lineno"> 646</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
711
+ <div class="line"><a name="l00647"></a><span class="lineno"> 647</span>&#160; }</div>
712
+ <div class="line"><a name="l00648"></a><span class="lineno"> 648</span>&#160; }</div>
713
+ <div class="line"><a name="l00649"></a><span class="lineno"> 649</span>&#160; <span class="keywordflow">else</span></div>
714
+ <div class="line"><a name="l00650"></a><span class="lineno"> 650</span>&#160; {</div>
715
+ <div class="line"><a name="l00651"></a><span class="lineno"> 651</span>&#160; total_bytes = total_bytes + byteOffset;</div>
716
+ <div class="line"><a name="l00652"></a><span class="lineno"> 652</span>&#160; }</div>
717
+ <div class="line"><a name="l00653"></a><span class="lineno"> 653</span>&#160; </div>
718
+ <div class="line"><a name="l00654"></a><span class="lineno"> 654</span>&#160; }</div>
719
+ <div class="line"><a name="l00655"></a><span class="lineno"> 655</span>&#160; <span class="keywordflow">if</span> (!visited.count(gep-&gt;getRHSVar()-&gt;getValue()))</div>
720
+ <div class="line"><a name="l00656"></a><span class="lineno"> 656</span>&#160; {</div>
721
+ <div class="line"><a name="l00657"></a><span class="lineno"> 657</span>&#160; visited.insert(gep-&gt;getRHSVar()-&gt;getValue());</div>
722
+ <div class="line"><a name="l00658"></a><span class="lineno"> 658</span>&#160; worklist.<a class="code" href="classSVF_1_1FILOWorkList.html#afcf3fcda18e8d3e2bad70a51376c0ce1">push</a>(gep-&gt;getRHSVar()-&gt;getValue());</div>
723
+ <div class="line"><a name="l00659"></a><span class="lineno"> 659</span>&#160; }</div>
724
+ <div class="line"><a name="l00660"></a><span class="lineno"> 660</span>&#160; }</div>
725
+ <div class="line"><a name="l00661"></a><span class="lineno"> 661</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1AddrStmt.html">AddrStmt</a> *addr = SVFUtil::dyn_cast&lt;AddrStmt&gt;(stmt))</div>
726
+ <div class="line"><a name="l00662"></a><span class="lineno"> 662</span>&#160; {</div>
727
+ <div class="line"><a name="l00663"></a><span class="lineno"> 663</span>&#160; <span class="comment">// addrStmt is source node.</span></div>
728
+ <div class="line"><a name="l00664"></a><span class="lineno"> 664</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> arr_type_size = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2ee740506a2ad50e1ee8dbb345fe0ff5">getAllocaInstByteSize</a>(es, addr);</div>
729
+ <div class="line"><a name="l00665"></a><span class="lineno"> 665</span>&#160; <span class="keywordflow">if</span> (total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &gt;= arr_type_size ||</div>
730
+ <div class="line"><a name="l00666"></a><span class="lineno"> 666</span>&#160; total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &lt; 0)</div>
731
+ <div class="line"><a name="l00667"></a><span class="lineno"> 667</span>&#160; {</div>
732
+ <div class="line"><a name="l00668"></a><span class="lineno"> 668</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> msg =</div>
733
+ <div class="line"><a name="l00669"></a><span class="lineno"> 669</span>&#160; <span class="stringliteral">&quot;Buffer overflow!! Accessing buffer range: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(total_bytes) +</div>
734
+ <div class="line"><a name="l00670"></a><span class="lineno"> 670</span>&#160; <span class="stringliteral">&quot;\nAllocated buffer size: &quot;</span> + std::to_string(arr_type_size) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
735
+ <div class="line"><a name="l00671"></a><span class="lineno"> 671</span>&#160; msg += <span class="stringliteral">&quot;Position: &quot;</span> + firstValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a4a0cfe3a8f37d33ffcdca3d66026dcc3">toString</a>() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
736
+ <div class="line"><a name="l00672"></a><span class="lineno"> 672</span>&#160; msg += <span class="stringliteral">&quot; The following is the value flow. [[\n&quot;</span>;</div>
737
+ <div class="line"><a name="l00673"></a><span class="lineno"> 673</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> it = gep_offsets.begin(); it != gep_offsets.end(); ++it)</div>
738
+ <div class="line"><a name="l00674"></a><span class="lineno"> 674</span>&#160; {</div>
739
+ <div class="line"><a name="l00675"></a><span class="lineno"> 675</span>&#160; msg += it-&gt;first-&gt;toString() + <span class="stringliteral">&quot;, Offset: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(it-&gt;second) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
740
+ <div class="line"><a name="l00676"></a><span class="lineno"> 676</span>&#160; }</div>
741
+ <div class="line"><a name="l00677"></a><span class="lineno"> 677</span>&#160; msg += <span class="stringliteral">&quot;]].\n Alloc Site: &quot;</span> + addr-&gt;toString() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
742
+ <div class="line"><a name="l00678"></a><span class="lineno"> 678</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<a class="code" href="namespaceSVF_1_1SVFUtil.html#ac71522e8c55f84cfc6c13a0ddff18436">SVFUtil::wrnMsg</a>(msg), arr_type_size, arr_type_size,</div>
743
+ <div class="line"><a name="l00679"></a><span class="lineno"> 679</span>&#160; total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(), total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(),</div>
744
+ <div class="line"><a name="l00680"></a><span class="lineno"> 680</span>&#160; firstValue);</div>
745
+ <div class="line"><a name="l00681"></a><span class="lineno"> 681</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, curNode);</div>
746
+ <div class="line"><a name="l00682"></a><span class="lineno"> 682</span>&#160; <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
747
+ <div class="line"><a name="l00683"></a><span class="lineno"> 683</span>&#160; }</div>
748
+ <div class="line"><a name="l00684"></a><span class="lineno"> 684</span>&#160; <span class="keywordflow">else</span></div>
749
+ <div class="line"><a name="l00685"></a><span class="lineno"> 685</span>&#160; {</div>
750
+ <div class="line"><a name="l00686"></a><span class="lineno"> 686</span>&#160; </div>
751
+ <div class="line"><a name="l00687"></a><span class="lineno"> 687</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
752
+ <div class="line"><a name="l00688"></a><span class="lineno"> 688</span>&#160; }</div>
753
+ <div class="line"><a name="l00689"></a><span class="lineno"> 689</span>&#160; }</div>
754
+ <div class="line"><a name="l00690"></a><span class="lineno"> 690</span>&#160; }</div>
755
+ <div class="line"><a name="l00691"></a><span class="lineno"> 691</span>&#160; }</div>
756
+ <div class="line"><a name="l00692"></a><span class="lineno"> 692</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFGlobalValue.html">SVF::SVFGlobalValue</a> *gvalue = SVFUtil::dyn_cast&lt;SVF::SVFGlobalValue&gt;(value))</div>
757
+ <div class="line"><a name="l00693"></a><span class="lineno"> 693</span>&#160; {</div>
758
+ <div class="line"><a name="l00694"></a><span class="lineno"> 694</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> arr_type_size = 0;</div>
759
+ <div class="line"><a name="l00695"></a><span class="lineno"> 695</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFType.html">SVFType</a> *svftype = gvalue-&gt;getType();</div>
760
+ <div class="line"><a name="l00696"></a><span class="lineno"> 696</span>&#160; <span class="keywordflow">if</span> (SVFUtil::isa&lt;SVFPointerType&gt;(svftype))</div>
761
+ <div class="line"><a name="l00697"></a><span class="lineno"> 697</span>&#160; {</div>
762
+ <div class="line"><a name="l00698"></a><span class="lineno"> 698</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFArrayType.html">SVFArrayType</a> *ptrArrType = SVFUtil::dyn_cast&lt;SVFArrayType&gt;(</div>
763
+ <div class="line"><a name="l00699"></a><span class="lineno"> 699</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a319cdab5339e6fe56fec8ade68f9da92">getPointeeElement</a>(es, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(gvalue))))</div>
764
+ <div class="line"><a name="l00700"></a><span class="lineno"> 700</span>&#160; arr_type_size = ptrArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
765
+ <div class="line"><a name="l00701"></a><span class="lineno"> 701</span>&#160; <span class="keywordflow">else</span></div>
766
+ <div class="line"><a name="l00702"></a><span class="lineno"> 702</span>&#160; arr_type_size = svftype-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
767
+ <div class="line"><a name="l00703"></a><span class="lineno"> 703</span>&#160; }</div>
768
+ <div class="line"><a name="l00704"></a><span class="lineno"> 704</span>&#160; <span class="keywordflow">else</span></div>
769
+ <div class="line"><a name="l00705"></a><span class="lineno"> 705</span>&#160; arr_type_size = svftype-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
770
+ <div class="line"><a name="l00706"></a><span class="lineno"> 706</span>&#160; </div>
771
+ <div class="line"><a name="l00707"></a><span class="lineno"> 707</span>&#160; <span class="keywordflow">if</span> (total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &gt;= arr_type_size || total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &lt; 0)</div>
772
+ <div class="line"><a name="l00708"></a><span class="lineno"> 708</span>&#160; {</div>
773
+ <div class="line"><a name="l00709"></a><span class="lineno"> 709</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> msg = <span class="stringliteral">&quot;Buffer overflow!! Accessing buffer range: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(total_bytes) +</div>
774
+ <div class="line"><a name="l00710"></a><span class="lineno"> 710</span>&#160; <span class="stringliteral">&quot;\nAllocated buffer size: &quot;</span> + std::to_string(arr_type_size) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
775
+ <div class="line"><a name="l00711"></a><span class="lineno"> 711</span>&#160; msg += <span class="stringliteral">&quot;Position: &quot;</span> + firstValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a4a0cfe3a8f37d33ffcdca3d66026dcc3">toString</a>() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
776
+ <div class="line"><a name="l00712"></a><span class="lineno"> 712</span>&#160; msg += <span class="stringliteral">&quot; The following is the value flow.\n[[&quot;</span>;</div>
777
+ <div class="line"><a name="l00713"></a><span class="lineno"> 713</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> it = gep_offsets.begin(); it != gep_offsets.end(); ++it)</div>
778
+ <div class="line"><a name="l00714"></a><span class="lineno"> 714</span>&#160; {</div>
779
+ <div class="line"><a name="l00715"></a><span class="lineno"> 715</span>&#160; msg += it-&gt;first-&gt;toString() + <span class="stringliteral">&quot;, Offset: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(it-&gt;second) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
780
+ <div class="line"><a name="l00716"></a><span class="lineno"> 716</span>&#160; }</div>
781
+ <div class="line"><a name="l00717"></a><span class="lineno"> 717</span>&#160; msg += <span class="stringliteral">&quot;]]. \nAlloc Site: &quot;</span> + gvalue-&gt;toString() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
782
+ <div class="line"><a name="l00718"></a><span class="lineno"> 718</span>&#160; </div>
783
+ <div class="line"><a name="l00719"></a><span class="lineno"> 719</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<a class="code" href="namespaceSVF_1_1SVFUtil.html#ac71522e8c55f84cfc6c13a0ddff18436">SVFUtil::wrnMsg</a>(msg), arr_type_size, arr_type_size,</div>
784
+ <div class="line"><a name="l00720"></a><span class="lineno"> 720</span>&#160; total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(), total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(), firstValue);</div>
785
+ <div class="line"><a name="l00721"></a><span class="lineno"> 721</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, curNode);</div>
786
+ <div class="line"><a name="l00722"></a><span class="lineno"> 722</span>&#160; <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
787
+ <div class="line"><a name="l00723"></a><span class="lineno"> 723</span>&#160; }</div>
788
+ <div class="line"><a name="l00724"></a><span class="lineno"> 724</span>&#160; <span class="keywordflow">else</span></div>
789
+ <div class="line"><a name="l00725"></a><span class="lineno"> 725</span>&#160; {</div>
790
+ <div class="line"><a name="l00726"></a><span class="lineno"> 726</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
791
+ <div class="line"><a name="l00727"></a><span class="lineno"> 727</span>&#160; }</div>
792
+ <div class="line"><a name="l00728"></a><span class="lineno"> 728</span>&#160; }</div>
793
+ <div class="line"><a name="l00729"></a><span class="lineno"> 729</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFArgument.html">SVF::SVFArgument</a> *arg = SVFUtil::dyn_cast&lt;SVF::SVFArgument&gt;(value))</div>
794
+ <div class="line"><a name="l00730"></a><span class="lineno"> 730</span>&#160; {</div>
795
+ <div class="line"><a name="l00731"></a><span class="lineno"> 731</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a048e203517ac727e6fe0653e1f24052c">AccessMemoryViaCallArgs</a>(arg, worklist, visited);</div>
796
+ <div class="line"><a name="l00732"></a><span class="lineno"> 732</span>&#160; }</div>
797
+ <div class="line"><a name="l00733"></a><span class="lineno"> 733</span>&#160; <span class="keywordflow">else</span></div>
798
+ <div class="line"><a name="l00734"></a><span class="lineno"> 734</span>&#160; {</div>
799
+ <div class="line"><a name="l00735"></a><span class="lineno"> 735</span>&#160; <span class="comment">// maybe SVFConstant</span></div>
800
+ <div class="line"><a name="l00736"></a><span class="lineno"> 736</span>&#160; <span class="comment">// it may be cannot find the source, maybe we start from non-main function,</span></div>
801
+ <div class="line"><a name="l00737"></a><span class="lineno"> 737</span>&#160; <span class="comment">// therefore it loses the value flow track</span></div>
802
+ <div class="line"><a name="l00738"></a><span class="lineno"> 738</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
803
+ <div class="line"><a name="l00739"></a><span class="lineno"> 739</span>&#160; }</div>
804
+ <div class="line"><a name="l00740"></a><span class="lineno"> 740</span>&#160; }</div>
805
+ <div class="line"><a name="l00741"></a><span class="lineno"> 741</span>&#160; <span class="comment">// it may be cannot find the source, maybe we start from non-main function,</span></div>
806
+ <div class="line"><a name="l00742"></a><span class="lineno"> 742</span>&#160; <span class="comment">// therefore it loses the value flow track</span></div>
807
+ <div class="line"><a name="l00743"></a><span class="lineno"> 743</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
808
+ <div class="line"><a name="l00744"></a><span class="lineno"> 744</span>&#160;}</div>
809
+ <div class="line"><a name="l00745"></a><span class="lineno"> 745</span>&#160; </div>
810
+ <div class="line"><a name="l00746"></a><span class="lineno"> 746</span>&#160; </div>
811
+ <div class="line"><a name="l00747"></a><span class="lineno"> 747</span>&#160; </div>
812
+ <div class="line"><a name="l00748"></a><span class="lineno"> 748</span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#afa6b30220b0b3261205a909def9ca44e">BufOverflowChecker::handleICFGNode</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1ICFGNode.html">SVF::ICFGNode</a> *node)</div>
813
+ <div class="line"><a name="l00749"></a><span class="lineno"> 749</span>&#160;{</div>
814
+ <div class="line"><a name="l00750"></a><span class="lineno"> 750</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9b179466955023f275b6692b59048846">AbstractInterpretation::handleICFGNode</a>(node);</div>
815
+ <div class="line"><a name="l00751"></a><span class="lineno"> 751</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a52de7d619e8746a70718719306d7c5a1">detectBufOverflow</a>(node);</div>
816
+ <div class="line"><a name="l00752"></a><span class="lineno"> 752</span>&#160;}</div>
817
+ <div class="line"><a name="l00753"></a><span class="lineno"> 753</span>&#160; </div>
818
+ <div class="line"><a name="l00754"></a><span class="lineno"> 754</span>&#160;<span class="comment">//</span></div>
819
+ <div class="line"><a name="l00755"></a><span class="lineno"> 755</span>&#160;<span class="keywordtype">bool</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#a52de7d619e8746a70718719306d7c5a1">BufOverflowChecker::detectBufOverflow</a>(<span class="keyword">const</span> ICFGNode *node)</div>
820
+ <div class="line"><a name="l00756"></a><span class="lineno"> 756</span>&#160;{</div>
821
+ <div class="line"><a name="l00757"></a><span class="lineno"> 757</span>&#160; AbstractState &amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a11ceda75dbe328bcabdc6ff6919f9526">getState</a>(node);</div>
822
+ <div class="line"><a name="l00758"></a><span class="lineno"> 758</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span>* stmt: node-&gt;getSVFStmts())</div>
823
+ <div class="line"><a name="l00759"></a><span class="lineno"> 759</span>&#160; {</div>
824
+ <div class="line"><a name="l00760"></a><span class="lineno"> 760</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> GepStmt *gep = SVFUtil::dyn_cast&lt;GepStmt&gt;(stmt))</div>
825
+ <div class="line"><a name="l00761"></a><span class="lineno"> 761</span>&#160; {</div>
826
+ <div class="line"><a name="l00762"></a><span class="lineno"> 762</span>&#160; <span class="keyword">const</span> SVFVar* gepRhs = gep-&gt;getRHSVar();</div>
827
+ <div class="line"><a name="l00763"></a><span class="lineno"> 763</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> SVFInstruction* inst = SVFUtil::dyn_cast&lt;SVFInstruction&gt;(gepRhs-&gt;getValue()))</div>
828
+ <div class="line"><a name="l00764"></a><span class="lineno"> 764</span>&#160; {</div>
829
+ <div class="line"><a name="l00765"></a><span class="lineno"> 765</span>&#160; <span class="keyword">const</span> ICFGNode* icfgNode = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(inst);</div>
830
+ <div class="line"><a name="l00766"></a><span class="lineno"> 766</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">const</span> SVFStmt* stmt2: icfgNode-&gt;getSVFStmts())</div>
831
+ <div class="line"><a name="l00767"></a><span class="lineno"> 767</span>&#160; {</div>
832
+ <div class="line"><a name="l00768"></a><span class="lineno"> 768</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> GepStmt *gep2 = SVFUtil::dyn_cast&lt;GepStmt&gt;(stmt2))</div>
833
+ <div class="line"><a name="l00769"></a><span class="lineno"> 769</span>&#160; {</div>
834
+ <div class="line"><a name="l00770"></a><span class="lineno"> 770</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(gep2-&gt;getLHSVar()-&gt;getValue(), IntervalValue(0, 0), node);</div>
835
+ <div class="line"><a name="l00771"></a><span class="lineno"> 771</span>&#160; }</div>
836
+ <div class="line"><a name="l00772"></a><span class="lineno"> 772</span>&#160; }</div>
837
+ <div class="line"><a name="l00773"></a><span class="lineno"> 773</span>&#160; }</div>
838
+ <div class="line"><a name="l00774"></a><span class="lineno"> 774</span>&#160; }</div>
839
+ <div class="line"><a name="l00775"></a><span class="lineno"> 775</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> LoadStmt* load = SVFUtil::dyn_cast&lt;LoadStmt&gt;(stmt))</div>
840
+ <div class="line"><a name="l00776"></a><span class="lineno"> 776</span>&#160; {</div>
841
+ <div class="line"><a name="l00777"></a><span class="lineno"> 777</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#ad42ca3cab47612c78a5d99cedea2f4ba">inVarToAddrsTable</a>(es, load-&gt;getRHSVarID()))</div>
842
+ <div class="line"><a name="l00778"></a><span class="lineno"> 778</span>&#160; {</div>
843
+ <div class="line"><a name="l00779"></a><span class="lineno"> 779</span>&#160; AbstractValue Addrs =</div>
844
+ <div class="line"><a name="l00780"></a><span class="lineno"> 780</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a611ac228efd661b301ea1dd675cd1c0c">getAddrs</a>(es, load-&gt;getRHSVarID());</div>
845
+ <div class="line"><a name="l00781"></a><span class="lineno"> 781</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> vaddr: Addrs.getAddrs())</div>
846
+ <div class="line"><a name="l00782"></a><span class="lineno"> 782</span>&#160; {</div>
847
+ <div class="line"><a name="l00783"></a><span class="lineno"> 783</span>&#160; <a class="code" href="CommandLine_8h.html#a2429346d37bd4c40889bd7c6d319d9da">u32_t</a> objId = <a class="code" href="classSVF_1_1AbstractState.html#aaabe5850dbf1620c6058f5ac6cb169b6">AbstractState::getInternalID</a>(vaddr);</div>
848
+ <div class="line"><a name="l00784"></a><span class="lineno"> 784</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.find(objId) != <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.end())</div>
849
+ <div class="line"><a name="l00785"></a><span class="lineno"> 785</span>&#160; {</div>
850
+ <div class="line"><a name="l00786"></a><span class="lineno"> 786</span>&#160; <span class="keyword">const</span> GepStmt* gep = <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.at(objId);</div>
851
+ <div class="line"><a name="l00787"></a><span class="lineno"> 787</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(gep-&gt;getLHSVar()-&gt;getValue(), IntervalValue(0, 0), node);</div>
852
+ <div class="line"><a name="l00788"></a><span class="lineno"> 788</span>&#160; }</div>
853
+ <div class="line"><a name="l00789"></a><span class="lineno"> 789</span>&#160; }</div>
854
+ <div class="line"><a name="l00790"></a><span class="lineno"> 790</span>&#160; }</div>
855
+ <div class="line"><a name="l00791"></a><span class="lineno"> 791</span>&#160; }</div>
856
+ <div class="line"><a name="l00792"></a><span class="lineno"> 792</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> StoreStmt* store = SVFUtil::dyn_cast&lt;StoreStmt&gt;(stmt))</div>
857
+ <div class="line"><a name="l00793"></a><span class="lineno"> 793</span>&#160; {</div>
858
+ <div class="line"><a name="l00794"></a><span class="lineno"> 794</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#ad42ca3cab47612c78a5d99cedea2f4ba">inVarToAddrsTable</a>(es, store-&gt;getLHSVarID()))</div>
859
+ <div class="line"><a name="l00795"></a><span class="lineno"> 795</span>&#160; {</div>
860
+ <div class="line"><a name="l00796"></a><span class="lineno"> 796</span>&#160; AbstractValue Addrs =</div>
861
+ <div class="line"><a name="l00797"></a><span class="lineno"> 797</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a611ac228efd661b301ea1dd675cd1c0c">getAddrs</a>(es, store-&gt;getLHSVarID());</div>
862
+ <div class="line"><a name="l00798"></a><span class="lineno"> 798</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> vaddr: Addrs.getAddrs())</div>
863
+ <div class="line"><a name="l00799"></a><span class="lineno"> 799</span>&#160; {</div>
864
+ <div class="line"><a name="l00800"></a><span class="lineno"> 800</span>&#160; <a class="code" href="CommandLine_8h.html#a2429346d37bd4c40889bd7c6d319d9da">u32_t</a> objId = <a class="code" href="classSVF_1_1AbstractState.html#aaabe5850dbf1620c6058f5ac6cb169b6">AbstractState::getInternalID</a>(vaddr);</div>
865
+ <div class="line"><a name="l00801"></a><span class="lineno"> 801</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.find(objId) != <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.end())</div>
866
+ <div class="line"><a name="l00802"></a><span class="lineno"> 802</span>&#160; {</div>
867
+ <div class="line"><a name="l00803"></a><span class="lineno"> 803</span>&#160; <span class="keyword">const</span> GepStmt* gep = <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.at(objId);</div>
868
+ <div class="line"><a name="l00804"></a><span class="lineno"> 804</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(gep-&gt;getLHSVar()-&gt;getValue(), IntervalValue(0, 0), node);</div>
869
+ <div class="line"><a name="l00805"></a><span class="lineno"> 805</span>&#160; }</div>
870
+ <div class="line"><a name="l00806"></a><span class="lineno"> 806</span>&#160; }</div>
871
+ <div class="line"><a name="l00807"></a><span class="lineno"> 807</span>&#160; }</div>
872
+ <div class="line"><a name="l00808"></a><span class="lineno"> 808</span>&#160; }</div>
873
873
  <div class="line"><a name="l00809"></a><span class="lineno"> 809</span>&#160; }</div>
874
- <div class="line"><a name="l00810"></a><span class="lineno"> 810</span>&#160; <span class="keywordflow">else</span></div>
875
- <div class="line"><a name="l00811"></a><span class="lineno"> 811</span>&#160; {</div>
876
- <div class="line"><a name="l00812"></a><span class="lineno"> 812</span>&#160; inst = node-&gt;getSVFStmts().back()-&gt;getInst();</div>
877
- <div class="line"><a name="l00813"></a><span class="lineno"> 813</span>&#160; }</div>
878
- <div class="line"><a name="l00814"></a><span class="lineno"> 814</span>&#160; <a class="code" href="classSVF_1_1GenericBug.html#acc65b033bfd61257d5b6fdbf932dfafe">GenericBug::EventStack</a> eventStack;</div>
879
- <div class="line"><a name="l00815"></a><span class="lineno"> 815</span>&#160; SVFBugEvent sourceInstEvent(SVFBugEvent::EventType::SourceInst, inst);</div>
880
- <div class="line"><a name="l00816"></a><span class="lineno"> 816</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">const</span> <span class="keyword">auto</span> &amp;callsite: <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9885b50cf28b65bebb488442085fab26">_callSiteStack</a>)</div>
874
+ <div class="line"><a name="l00810"></a><span class="lineno"> 810</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
875
+ <div class="line"><a name="l00811"></a><span class="lineno"> 811</span>&#160;}</div>
876
+ <div class="line"><a name="l00812"></a><span class="lineno"> 812</span>&#160; </div>
877
+ <div class="line"><a name="l00813"></a><span class="lineno"> 813</span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">BufOverflowChecker::addBugToRecoder</a>(<span class="keyword">const</span> BufOverflowException&amp; e, <span class="keyword">const</span> ICFGNode* node)</div>
878
+ <div class="line"><a name="l00814"></a><span class="lineno"> 814</span>&#160;{</div>
879
+ <div class="line"><a name="l00815"></a><span class="lineno"> 815</span>&#160; <span class="keyword">const</span> SVFInstruction* inst = <span class="keyword">nullptr</span>;</div>
880
+ <div class="line"><a name="l00816"></a><span class="lineno"> 816</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> CallICFGNode* call = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(node))</div>
881
881
  <div class="line"><a name="l00817"></a><span class="lineno"> 817</span>&#160; {</div>
882
- <div class="line"><a name="l00818"></a><span class="lineno"> 818</span>&#160; SVFBugEvent callSiteEvent(SVFBugEvent::EventType::CallSite, callsite-&gt;getCallSite());</div>
883
- <div class="line"><a name="l00819"></a><span class="lineno"> 819</span>&#160; eventStack.push_back(callSiteEvent);</div>
884
- <div class="line"><a name="l00820"></a><span class="lineno"> 820</span>&#160; }</div>
885
- <div class="line"><a name="l00821"></a><span class="lineno"> 821</span>&#160; eventStack.push_back(sourceInstEvent);</div>
886
- <div class="line"><a name="l00822"></a><span class="lineno"> 822</span>&#160; <span class="keywordflow">if</span> (eventStack.size() == 0) <span class="keywordflow">return</span>;</div>
887
- <div class="line"><a name="l00823"></a><span class="lineno"> 823</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> loc = eventStack.back().getEventLoc();</div>
888
- <div class="line"><a name="l00824"></a><span class="lineno"> 824</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a5e0a88ebef4ae740983726e7f1b5eb">_bugLoc</a>.find(loc) != <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a5e0a88ebef4ae740983726e7f1b5eb">_bugLoc</a>.end())</div>
889
- <div class="line"><a name="l00825"></a><span class="lineno"> 825</span>&#160; {</div>
890
- <div class="line"><a name="l00826"></a><span class="lineno"> 826</span>&#160; <span class="keywordflow">return</span>;</div>
891
- <div class="line"><a name="l00827"></a><span class="lineno"> 827</span>&#160; }</div>
892
- <div class="line"><a name="l00828"></a><span class="lineno"> 828</span>&#160; <span class="keywordflow">else</span></div>
893
- <div class="line"><a name="l00829"></a><span class="lineno"> 829</span>&#160; {</div>
894
- <div class="line"><a name="l00830"></a><span class="lineno"> 830</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a5e0a88ebef4ae740983726e7f1b5eb">_bugLoc</a>.insert(loc);</div>
895
- <div class="line"><a name="l00831"></a><span class="lineno"> 831</span>&#160; }</div>
896
- <div class="line"><a name="l00832"></a><span class="lineno"> 832</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a8e4f0c5f527e321369a19a0b37124079">_recoder</a>.<a class="code" href="classSVF_1_1SVFBugReport.html#a05f395eff23619ed10c31c0acda949e2">addAbsExecBug</a>(<a class="code" href="classSVF_1_1GenericBug.html#a7aeeb33097bca5f7fe6747f90f5cecacac88ddac03bb8ae09a72058e4ad7af747">GenericBug::FULLBUFOVERFLOW</a>, eventStack, e.getAllocLb(), e.getAllocUb(), e.getAccessLb(),</div>
897
- <div class="line"><a name="l00833"></a><span class="lineno"> 833</span>&#160; e.getAccessUb());</div>
898
- <div class="line"><a name="l00834"></a><span class="lineno"> 834</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a09aa739395388f64fcb3d539d58d2041">_nodeToBugInfo</a>[node] = e.what();</div>
899
- <div class="line"><a name="l00835"></a><span class="lineno"> 835</span>&#160;}</div>
900
- <div class="line"><a name="l00836"></a><span class="lineno"> 836</span>&#160; </div>
901
- <div class="line"><a name="l00837"></a><span class="lineno"> 837</span>&#160;}</div>
882
+ <div class="line"><a name="l00818"></a><span class="lineno"> 818</span>&#160; inst = call-&gt;getCallSite();</div>
883
+ <div class="line"><a name="l00819"></a><span class="lineno"> 819</span>&#160; }</div>
884
+ <div class="line"><a name="l00820"></a><span class="lineno"> 820</span>&#160; <span class="keywordflow">else</span></div>
885
+ <div class="line"><a name="l00821"></a><span class="lineno"> 821</span>&#160; {</div>
886
+ <div class="line"><a name="l00822"></a><span class="lineno"> 822</span>&#160; inst = node-&gt;getSVFStmts().back()-&gt;getInst();</div>
887
+ <div class="line"><a name="l00823"></a><span class="lineno"> 823</span>&#160; }</div>
888
+ <div class="line"><a name="l00824"></a><span class="lineno"> 824</span>&#160; <a class="code" href="classSVF_1_1GenericBug.html#acc65b033bfd61257d5b6fdbf932dfafe">GenericBug::EventStack</a> eventStack;</div>
889
+ <div class="line"><a name="l00825"></a><span class="lineno"> 825</span>&#160; SVFBugEvent sourceInstEvent(SVFBugEvent::EventType::SourceInst, inst);</div>
890
+ <div class="line"><a name="l00826"></a><span class="lineno"> 826</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">const</span> <span class="keyword">auto</span> &amp;callsite: <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9885b50cf28b65bebb488442085fab26">_callSiteStack</a>)</div>
891
+ <div class="line"><a name="l00827"></a><span class="lineno"> 827</span>&#160; {</div>
892
+ <div class="line"><a name="l00828"></a><span class="lineno"> 828</span>&#160; SVFBugEvent callSiteEvent(SVFBugEvent::EventType::CallSite, callsite-&gt;getCallSite());</div>
893
+ <div class="line"><a name="l00829"></a><span class="lineno"> 829</span>&#160; eventStack.push_back(callSiteEvent);</div>
894
+ <div class="line"><a name="l00830"></a><span class="lineno"> 830</span>&#160; }</div>
895
+ <div class="line"><a name="l00831"></a><span class="lineno"> 831</span>&#160; eventStack.push_back(sourceInstEvent);</div>
896
+ <div class="line"><a name="l00832"></a><span class="lineno"> 832</span>&#160; <span class="keywordflow">if</span> (eventStack.size() == 0) <span class="keywordflow">return</span>;</div>
897
+ <div class="line"><a name="l00833"></a><span class="lineno"> 833</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> loc = eventStack.back().getEventLoc();</div>
898
+ <div class="line"><a name="l00834"></a><span class="lineno"> 834</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a5e0a88ebef4ae740983726e7f1b5eb">_bugLoc</a>.find(loc) != <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a5e0a88ebef4ae740983726e7f1b5eb">_bugLoc</a>.end())</div>
899
+ <div class="line"><a name="l00835"></a><span class="lineno"> 835</span>&#160; {</div>
900
+ <div class="line"><a name="l00836"></a><span class="lineno"> 836</span>&#160; <span class="keywordflow">return</span>;</div>
901
+ <div class="line"><a name="l00837"></a><span class="lineno"> 837</span>&#160; }</div>
902
+ <div class="line"><a name="l00838"></a><span class="lineno"> 838</span>&#160; <span class="keywordflow">else</span></div>
903
+ <div class="line"><a name="l00839"></a><span class="lineno"> 839</span>&#160; {</div>
904
+ <div class="line"><a name="l00840"></a><span class="lineno"> 840</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a5e0a88ebef4ae740983726e7f1b5eb">_bugLoc</a>.insert(loc);</div>
905
+ <div class="line"><a name="l00841"></a><span class="lineno"> 841</span>&#160; }</div>
906
+ <div class="line"><a name="l00842"></a><span class="lineno"> 842</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a8e4f0c5f527e321369a19a0b37124079">_recoder</a>.<a class="code" href="classSVF_1_1SVFBugReport.html#a05f395eff23619ed10c31c0acda949e2">addAbsExecBug</a>(<a class="code" href="classSVF_1_1GenericBug.html#a7aeeb33097bca5f7fe6747f90f5cecacac88ddac03bb8ae09a72058e4ad7af747">GenericBug::FULLBUFOVERFLOW</a>, eventStack, e.getAllocLb(), e.getAllocUb(), e.getAccessLb(),</div>
907
+ <div class="line"><a name="l00843"></a><span class="lineno"> 843</span>&#160; e.getAccessUb());</div>
908
+ <div class="line"><a name="l00844"></a><span class="lineno"> 844</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a09aa739395388f64fcb3d539d58d2041">_nodeToBugInfo</a>[node] = e.what();</div>
909
+ <div class="line"><a name="l00845"></a><span class="lineno"> 845</span>&#160;}</div>
910
+ <div class="line"><a name="l00846"></a><span class="lineno"> 846</span>&#160; </div>
911
+ <div class="line"><a name="l00847"></a><span class="lineno"> 847</span>&#160;}</div>
902
912
  </div><!-- fragment --></div><!-- contents -->
903
913
  <div class="ttc" id="aclassSVF_1_1SVFBugReport_html_a05f395eff23619ed10c31c0acda949e2"><div class="ttname"><a href="classSVF_1_1SVFBugReport.html#a05f395eff23619ed10c31c0acda949e2">SVF::SVFBugReport::addAbsExecBug</a></div><div class="ttdeci">void addAbsExecBug(GenericBug::BugType bugType, const GenericBug::EventStack &amp;eventStack, s64_t allocLowerBound, s64_t allocUpperBound, s64_t accessLowerBound, s64_t accessUpperBound)</div><div class="ttdef"><b>Definition:</b> <a href="SVFBugReport_8h_source.html#l00367">SVFBugReport.h:367</a></div></div>
914
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a319cdab5339e6fe56fec8ade68f9da92"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a319cdab5339e6fe56fec8ade68f9da92">SVF::AbstractInterpretation::getPointeeElement</a></div><div class="ttdeci">const SVFType * getPointeeElement(AbstractState &amp;es, NodeID id)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01605">AbstractInterpretation.cpp:1605</a></div></div>
904
915
  <div class="ttc" id="aclassSVF_1_1SVFValue_html_a2401b022638769f59f86ab424a189b6e"><div class="ttname"><a href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">SVF::SVFValue::getName</a></div><div class="ttdeci">const std::string &amp; getName() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFValue_8h_source.html#l00243">SVFValue.h:243</a></div></div>
905
916
  <div class="ttc" id="aclassSVF_1_1CopyStmt_html"><div class="ttname"><a href="classSVF_1_1CopyStmt.html">SVF::CopyStmt</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFStatements_8h_source.html#l00364">SVFStatements.h:364</a></div></div>
906
917
  <div class="ttc" id="aclassSVF_1_1SVFType_html_a95b8031f1e15d49c7d68628be1d05aae"><div class="ttname"><a href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">SVF::SVFType::getByteSize</a></div><div class="ttdeci">u32_t getByteSize() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFType_8h_source.html#l00244">SVFType.h:244</a></div></div>
907
- <div class="ttc" id="aclassSVF_1_1SVFIR2AbsState_html_a62baa9403069a9b1e010eaeb2f6b9b34"><div class="ttname"><a href="classSVF_1_1SVFIR2AbsState.html#a62baa9403069a9b1e010eaeb2f6b9b34">SVF::SVFIR2AbsState::inVarToAddrsTable</a></div><div class="ttdeci">bool inVarToAddrsTable(u32_t id) const</div><div class="ttdoc">whether the variable is in varToAddrs table</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR2AbsState_8h_source.html#l00129">SVFIR2AbsState.h:129</a></div></div>
908
918
  <div class="ttc" id="anamespaceSVF_1_1SVFUtil_html_a7655b13bbfe720ca2b8a25e0a72528e6"><div class="ttname"><a href="namespaceSVF_1_1SVFUtil.html#a7655b13bbfe720ca2b8a25e0a72528e6">SVF::SVFUtil::errMsg</a></div><div class="ttdeci">std::string errMsg(const std::string &amp;msg)</div><div class="ttdoc">Print error message by converting a string into red string output.</div><div class="ttdef"><b>Definition:</b> <a href="SVFUtil_8cpp_source.html#l00076">SVFUtil.cpp:76</a></div></div>
919
+ <div class="ttc" id="aclassSVF_1_1SVFStmt_html_aa809a57c8cdaaa35dfc3cc0f3b33b52b"><div class="ttname"><a href="classSVF_1_1SVFStmt.html#aa809a57c8cdaaa35dfc3cc0f3b33b52b">SVF::SVFStmt::getICFGNode</a></div><div class="ttdeci">ICFGNode * getICFGNode() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFStatements_8h_source.html#l00163">SVFStatements.h:163</a></div></div>
909
920
  <div class="ttc" id="aCommandLine_8h_html_a2429346d37bd4c40889bd7c6d319d9da"><div class="ttname"><a href="CommandLine_8h.html#a2429346d37bd4c40889bd7c6d319d9da">u32_t</a></div><div class="ttdeci">unsigned u32_t</div><div class="ttdef"><b>Definition:</b> <a href="CommandLine_8h_source.html#l00018">CommandLine.h:18</a></div></div>
910
921
  <div class="ttc" id="aclassSVF_1_1AddrStmt_html"><div class="ttname"><a href="classSVF_1_1AddrStmt.html">SVF::AddrStmt</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFStatements_8h_source.html#l00313">SVFStatements.h:313</a></div></div>
911
922
  <div class="ttc" id="astructSVF_1_1AbstractValue_html_ab1fe6a57f784971b3bc603dbfda746e8"><div class="ttname"><a href="structSVF_1_1AbstractValue.html#ab1fe6a57f784971b3bc603dbfda746e8">SVF::AbstractValue::getAddrs</a></div><div class="ttdeci">AddressValue &amp; getAddrs()</div><div class="ttdef"><b>Definition:</b> <a href="AbstractValue_8h_source.html#l00171">AbstractValue.h:171</a></div></div>
912
923
  <div class="ttc" id="aBufOverflowChecker_8h_html"><div class="ttname"><a href="BufOverflowChecker_8h.html">BufOverflowChecker.h</a></div></div>
913
- <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_ad68fa02efad8b628e4542dc9ab6c58bf"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">SVF::BufOverflowChecker::canSafelyAccessMemory</a></div><div class="ttdeci">bool canSafelyAccessMemory(const SVFValue *value, const AbstractValue &amp;len, const ICFGNode *curNode)</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00492">BufOverflowChecker.cpp:492</a></div></div>
924
+ <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_ad68fa02efad8b628e4542dc9ab6c58bf"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">SVF::BufOverflowChecker::canSafelyAccessMemory</a></div><div class="ttdeci">bool canSafelyAccessMemory(const SVFValue *value, const AbstractValue &amp;len, const ICFGNode *curNode)</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00501">BufOverflowChecker.cpp:501</a></div></div>
914
925
  <div class="ttc" id="aclassSVF_1_1IRGraph_html_a43514023a4f4d0c32f536f51443b0efc"><div class="ttname"><a href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">SVF::IRGraph::getValueNode</a></div><div class="ttdeci">NodeID getValueNode(const SVFValue *V)</div><div class="ttdef"><b>Definition:</b> <a href="IRGraph_8h_source.html#l00137">IRGraph.h:137</a></div></div>
915
926
  <div class="ttc" id="anamespaceSVF_html_af739db846e47ba6b2fd15eaad31ab7fb"><div class="ttname"><a href="namespaceSVF.html#af739db846e47ba6b2fd15eaad31ab7fb">SVF::Set</a></div><div class="ttdeci">std::unordered_set&lt; Key, Hash, KeyEqual, Allocator &gt; Set</div><div class="ttdef"><b>Definition:</b> <a href="GeneralType_8h_source.html#l00096">GeneralType.h:96</a></div></div>
916
927
  <div class="ttc" id="aclassSVF_1_1CallICFGNode_html_a90fd0b8e44fba1a7eb76d15bce085d66"><div class="ttname"><a href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">SVF::CallICFGNode::getCallSite</a></div><div class="ttdeci">const SVFInstruction * getCallSite() const</div><div class="ttdoc">Return callsite.</div><div class="ttdef"><b>Definition:</b> <a href="ICFGNode_8h_source.html#l00409">ICFGNode.h:409</a></div></div>
917
928
  <div class="ttc" id="aclassSVF_1_1IntervalValue_html_a0df07a2659cbf3a918de5b0d7c407264"><div class="ttname"><a href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">SVF::IntervalValue::lb</a></div><div class="ttdeci">const NumericLiteral &amp; lb() const</div><div class="ttdoc">Return the lower bound.</div><div class="ttdef"><b>Definition:</b> <a href="IntervalValue_8h_source.html#l00206">IntervalValue.h:206</a></div></div>
918
929
  <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_afa6b30220b0b3261205a909def9ca44e"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#afa6b30220b0b3261205a909def9ca44e">SVF::BufOverflowChecker::handleICFGNode</a></div><div class="ttdeci">virtual void handleICFGNode(const SVF::ICFGNode *node) override</div></div>
919
930
  <div class="ttc" id="anamespaceSVF_html"><div class="ttname"><a href="namespaceSVF.html">SVF</a></div><div class="ttdoc">for isBitcode</div><div class="ttdef"><b>Definition:</b> <a href="BasicTypes_8h_source.html#l00067">BasicTypes.h:67</a></div></div>
920
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a5bba3c0570d73acc743742a30af1b0b4"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a5bba3c0570d73acc743742a30af1b0b4">SVF::AbstractInterpretation::getStrlen</a></div><div class="ttdeci">AbstractValue getStrlen(const SVF::SVFValue *strValue)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01464">AbstractInterpretation.cpp:1464</a></div></div>
921
931
  <div class="ttc" id="anamespaceSVF_1_1SVFUtil_html_a9815a5b31ac7dc21239d08e5b9f61106"><div class="ttname"><a href="namespaceSVF_1_1SVFUtil.html#a9815a5b31ac7dc21239d08e5b9f61106">SVF::SVFUtil::getSVFCallSite</a></div><div class="ttdeci">CallSite getSVFCallSite(const SVFInstruction *inst)</div><div class="ttdoc">Return LLVM callsite given an instruction.</div><div class="ttdef"><b>Definition:</b> <a href="SVFUtil_8h_source.html#l00196">SVFUtil.h:196</a></div></div>
922
932
  <div class="ttc" id="aclassSVF_1_1ICFGNode_html_a6c68f52dd90728073fb79141df9b0661"><div class="ttname"><a href="classSVF_1_1ICFGNode.html#a6c68f52dd90728073fb79141df9b0661">SVF::ICFGNode::getSVFStmts</a></div><div class="ttdeci">const SVFStmtList &amp; getSVFStmts() const</div><div class="ttdef"><b>Definition:</b> <a href="ICFGNode_8h_source.html#l00127">ICFGNode.h:127</a></div></div>
923
933
  <div class="ttc" id="astructSVF_1_1BufOverflowException_html"><div class="ttname"><a href="structSVF_1_1BufOverflowException.html">SVF::BufOverflowException</a></div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8h_source.html#l00036">BufOverflowChecker.h:36</a></div></div>
924
934
  <div class="ttc" id="anamespaceSVF_1_1SVFUtil_html_ac71522e8c55f84cfc6c13a0ddff18436"><div class="ttname"><a href="namespaceSVF_1_1SVFUtil.html#ac71522e8c55f84cfc6c13a0ddff18436">SVF::SVFUtil::wrnMsg</a></div><div class="ttdeci">std::string wrnMsg(const std::string &amp;msg)</div><div class="ttdoc">Returns warning message by converting a string into yellow string output.</div><div class="ttdef"><b>Definition:</b> <a href="SVFUtil_8cpp_source.html#l00061">SVFUtil.cpp:61</a></div></div>
925
935
  <div class="ttc" id="aclassSVF_1_1SVFValue_html_a11f2d9b6e969ede6fca2c204cc15b821"><div class="ttname"><a href="classSVF_1_1SVFValue.html#a11f2d9b6e969ede6fca2c204cc15b821">SVF::SVFValue::getType</a></div><div class="ttdeci">virtual const SVFType * getType() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFValue_8h_source.html#l00256">SVFValue.h:256</a></div></div>
926
- <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_ad8b2f2fa6f22b9d1655135c819cbad8a"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#ad8b2f2fa6f22b9d1655135c819cbad8a">SVF::BufOverflowChecker::detectStrcpy</a></div><div class="ttdeci">bool detectStrcpy(const CallICFGNode *call)</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00124">BufOverflowChecker.cpp:124</a></div></div>
936
+ <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_ad8b2f2fa6f22b9d1655135c819cbad8a"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#ad8b2f2fa6f22b9d1655135c819cbad8a">SVF::BufOverflowChecker::detectStrcpy</a></div><div class="ttdeci">bool detectStrcpy(const CallICFGNode *call)</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00125">BufOverflowChecker.cpp:125</a></div></div>
927
937
  <div class="ttc" id="aclassSVF_1_1SVFVar_html_ac2db6304ea5526fb446ae882983beeb0"><div class="ttname"><a href="classSVF_1_1SVFVar.html#ac2db6304ea5526fb446ae882983beeb0">SVF::SVFVar::getValue</a></div><div class="ttdeci">const SVFValue * getValue() const</div><div class="ttdoc">Get/has methods of the components.</div><div class="ttdef"><b>Definition:</b> <a href="SVFVariables_8h_source.html#l00094">SVFVariables.h:94</a></div></div>
928
938
  <div class="ttc" id="aclassSVF_1_1GenericBug_html_acc65b033bfd61257d5b6fdbf932dfafe"><div class="ttname"><a href="classSVF_1_1GenericBug.html#acc65b033bfd61257d5b6fdbf932dfafe">SVF::GenericBug::EventStack</a></div><div class="ttdeci">std::vector&lt; SVFBugEvent &gt; EventStack</div><div class="ttdef"><b>Definition:</b> <a href="SVFBugReport_8h_source.html#l00083">SVFBugReport.h:83</a></div></div>
929
939
  <div class="ttc" id="aclassSVF_1_1ICFGNode_html"><div class="ttname"><a href="classSVF_1_1ICFGNode.html">SVF::ICFGNode</a></div><div class="ttdef"><b>Definition:</b> <a href="ICFGNode_8h_source.html#l00054">ICFGNode.h:54</a></div></div>
930
940
  <div class="ttc" id="aclassSVF_1_1SVFType_html_a330084f9a3deb6e5acb52a8ee3eb7fe4"><div class="ttname"><a href="classSVF_1_1SVFType.html#a330084f9a3deb6e5acb52a8ee3eb7fe4">SVF::SVFType::isArrayTy</a></div><div class="ttdeci">bool isArrayTy() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFType_8h_source.html#l00254">SVFType.h:254</a></div></div>
941
+ <div class="ttc" id="aclassSVF_1_1SVFIR2AbsState_html_a611ac228efd661b301ea1dd675cd1c0c"><div class="ttname"><a href="classSVF_1_1SVFIR2AbsState.html#a611ac228efd661b301ea1dd675cd1c0c">SVF::SVFIR2AbsState::getAddrs</a></div><div class="ttdeci">AbstractValue &amp; getAddrs(AbstractState &amp;es, u32_t id)</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR2AbsState_8h_source.html#l00104">SVFIR2AbsState.h:104</a></div></div>
931
942
  <div class="ttc" id="aclassSVF_1_1IntervalValue_html_a5d73cc2aa0a6ed49e8301fa7b0cd5045"><div class="ttname"><a href="classSVF_1_1IntervalValue.html#a5d73cc2aa0a6ed49e8301fa7b0cd5045">SVF::IntervalValue::toString</a></div><div class="ttdeci">const std::string toString() const</div><div class="ttdef"><b>Definition:</b> <a href="IntervalValue_8h_source.html#l00479">IntervalValue.h:479</a></div></div>
932
943
  <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a13fdb4a6a6d09e3504fdad16b88616daad20658cd0f68b92583461b0b1f68d543"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daad20658cd0f68b92583461b0b1f68d543">SVF::AbstractInterpretation::UNCLASSIFIED</a></div><div class="ttdeci">@ UNCLASSIFIED</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00113">AbstractInterpretation.h:113</a></div></div>
933
944
  <div class="ttc" id="aclassSVF_1_1AbstractState_html_aa34516a95191c5ec56ce44a117e8b018"><div class="ttname"><a href="classSVF_1_1AbstractState.html#aa34516a95191c5ec56ce44a117e8b018">SVF::AbstractState::inVarToAddrsTable</a></div><div class="ttdeci">bool inVarToAddrsTable(u32_t id) const</div><div class="ttdoc">whether the variable is in varToAddrs table</div><div class="ttdef"><b>Definition:</b> <a href="AbstractState_8h_source.html#l00201">AbstractState.h:201</a></div></div>
@@ -935,15 +946,14 @@ $(function() {
935
946
  <div class="ttc" id="aclassSVF_1_1SVFIR2AbsState_html_a4e032a5e0898f0e349927d5a86c8477c"><div class="ttname"><a href="classSVF_1_1SVFIR2AbsState.html#a4e032a5e0898f0e349927d5a86c8477c">SVF::SVFIR2AbsState::getRangeLimitFromType</a></div><div class="ttdeci">AbstractValue getRangeLimitFromType(const SVFType *type)</div><div class="ttdoc">Return the value range of Integer SVF Type, e.g. unsigned i8 Type-&gt;[0, 255], signed i8 Type-&gt;[-128,...</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR2AbsState_8cpp_source.html#l00049">SVFIR2AbsState.cpp:49</a></div></div>
936
947
  <div class="ttc" id="aclassSVF_1_1IntervalValue_html_a3dba35c84607bd3ed4e62a90ae2799cf"><div class="ttname"><a href="classSVF_1_1IntervalValue.html#a3dba35c84607bd3ed4e62a90ae2799cf">SVF::IntervalValue::is_infinite</a></div><div class="ttdeci">static bool is_infinite(const NumericLiteral &amp;e)</div><div class="ttdef"><b>Definition:</b> <a href="IntervalValue_8h_source.html#l00077">IntervalValue.h:77</a></div></div>
937
948
  <div class="ttc" id="aclassSVF_1_1Options_html_a6450b984f67d3cfa3f44892e8eea555e"><div class="ttname"><a href="classSVF_1_1Options.html#a6450b984f67d3cfa3f44892e8eea555e">SVF::Options::GepUnknownIdx</a></div><div class="ttdeci">static const Option&lt; bool &gt; GepUnknownIdx</div><div class="ttdoc">if the access index of gepstmt is unknown, skip it, Default: false</div><div class="ttdef"><b>Definition:</b> <a href="Options_8h_source.html#l00281">Options.h:281</a></div></div>
938
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a09aa739395388f64fcb3d539d58d2041"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a09aa739395388f64fcb3d539d58d2041">SVF::AbstractInterpretation::_nodeToBugInfo</a></div><div class="ttdeci">Map&lt; const ICFGNode *, std::string &gt; _nodeToBugInfo</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00355">AbstractInterpretation.h:355</a></div></div>
939
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a618fc324a6c205d7e1b471bd850377a9"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">SVF::AbstractInterpretation::_svfir</a></div><div class="ttdeci">SVFIR * _svfir</div><div class="ttdoc">protected data members, also used in subclasses</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00342">AbstractInterpretation.h:342</a></div></div>
940
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a2a1e1b72ed740cef4c3e57e3e32c3f75"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a2a1e1b72ed740cef4c3e57e3e32c3f75">SVF::AbstractInterpretation::_checkpoint_names</a></div><div class="ttdeci">Set&lt; std::string &gt; _checkpoint_names</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00382">AbstractInterpretation.h:382</a></div></div>
941
- <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_aed959fce840cbea32d3567ee1ac01e82"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#aed959fce840cbea32d3567ee1ac01e82">SVF::BufOverflowChecker::initExtAPIBufOverflowCheckRules</a></div><div class="ttdeci">void initExtAPIBufOverflowCheckRules()</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00077">BufOverflowChecker.cpp:77</a></div></div>
949
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a09aa739395388f64fcb3d539d58d2041"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a09aa739395388f64fcb3d539d58d2041">SVF::AbstractInterpretation::_nodeToBugInfo</a></div><div class="ttdeci">Map&lt; const ICFGNode *, std::string &gt; _nodeToBugInfo</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00349">AbstractInterpretation.h:349</a></div></div>
950
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a618fc324a6c205d7e1b471bd850377a9"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">SVF::AbstractInterpretation::_svfir</a></div><div class="ttdeci">SVFIR * _svfir</div><div class="ttdoc">protected data members, also used in subclasses</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00336">AbstractInterpretation.h:336</a></div></div>
951
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a2a1e1b72ed740cef4c3e57e3e32c3f75"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a2a1e1b72ed740cef4c3e57e3e32c3f75">SVF::AbstractInterpretation::_checkpoint_names</a></div><div class="ttdeci">Set&lt; std::string &gt; _checkpoint_names</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00389">AbstractInterpretation.h:389</a></div></div>
952
+ <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_aed959fce840cbea32d3567ee1ac01e82"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#aed959fce840cbea32d3567ee1ac01e82">SVF::BufOverflowChecker::initExtAPIBufOverflowCheckRules</a></div><div class="ttdeci">void initExtAPIBufOverflowCheckRules()</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00078">BufOverflowChecker.cpp:78</a></div></div>
942
953
  <div class="ttc" id="aOptions_8h_html"><div class="ttname"><a href="Options_8h.html">Options.h</a></div></div>
943
954
  <div class="ttc" id="aclassSVF_1_1GenericBug_html_a7aeeb33097bca5f7fe6747f90f5cecacac88ddac03bb8ae09a72058e4ad7af747"><div class="ttname"><a href="classSVF_1_1GenericBug.html#a7aeeb33097bca5f7fe6747f90f5cecacac88ddac03bb8ae09a72058e4ad7af747">SVF::GenericBug::FULLBUFOVERFLOW</a></div><div class="ttdeci">@ FULLBUFOVERFLOW</div><div class="ttdef"><b>Definition:</b> <a href="SVFBugReport_8h_source.html#l00086">SVFBugReport.h:86</a></div></div>
944
955
  <div class="ttc" id="aclassSVF_1_1SVFFunction_html_a067bd6dbaf74a028d546fa56b095791b"><div class="ttname"><a href="classSVF_1_1SVFFunction.html#a067bd6dbaf74a028d546fa56b095791b">SVF::SVFFunction::getAnnotations</a></div><div class="ttdeci">const std::vector&lt; std::string &gt; &amp; getAnnotations() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFValue_8h_source.html#l00466">SVFValue.h:466</a></div></div>
945
- <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_aa68f8aef09481d7c07dc59d7dfb83822"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#aa68f8aef09481d7c07dc59d7dfb83822">SVF::BufOverflowChecker::detectStrcat</a></div><div class="ttdeci">bool detectStrcat(const CallICFGNode *call)</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00376">BufOverflowChecker.cpp:376</a></div></div>
946
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a0e8b546f608417e218c2fab5a5893135"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a0e8b546f608417e218c2fab5a5893135">SVF::AbstractInterpretation::getAllocaInstByteSize</a></div><div class="ttdeci">u32_t getAllocaInstByteSize(const AddrStmt *addr)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01296">AbstractInterpretation.cpp:1296</a></div></div>
956
+ <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_aa68f8aef09481d7c07dc59d7dfb83822"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#aa68f8aef09481d7c07dc59d7dfb83822">SVF::BufOverflowChecker::detectStrcat</a></div><div class="ttdeci">bool detectStrcat(const CallICFGNode *call)</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00386">BufOverflowChecker.cpp:386</a></div></div>
947
957
  <div class="ttc" id="anamespaceSVF_1_1SVFUtil_html_a145abbd2958629718fbca41d25c3124d"><div class="ttname"><a href="namespaceSVF_1_1SVFUtil.html#a145abbd2958629718fbca41d25c3124d">SVF::SVFUtil::getCallee</a></div><div class="ttdeci">const SVFFunction * getCallee(const CallSite cs)</div><div class="ttdoc">Return callee of a callsite. Return null if this is an indirect call.</div><div class="ttdef"><b>Definition:</b> <a href="SVFUtil_8h_source.html#l00241">SVFUtil.h:241</a></div></div>
948
958
  <div class="ttc" id="aSVFType_8h_html"><div class="ttname"><a href="SVFType_8h.html">SVFType.h</a></div></div>
949
959
  <div class="ttc" id="aclassSVF_1_1NumericLiteral_html_a4181e5e15e10304ea524e5f8b2a3f576"><div class="ttname"><a href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">SVF::NumericLiteral::getNumeral</a></div><div class="ttdeci">s64_t getNumeral() const</div><div class="ttdoc">Return Numeral, default type is double in case to support both int and float.</div><div class="ttdef"><b>Definition:</b> <a href="NumericLiteral_8h_source.html#l00132">NumericLiteral.h:132</a></div></div>
@@ -953,16 +963,18 @@ $(function() {
953
963
  <div class="ttc" id="aclassSVF_1_1AbstractState_html_a1f935ea8ab16b04699284bf92bbbb23c"><div class="ttname"><a href="classSVF_1_1AbstractState.html#a1f935ea8ab16b04699284bf92bbbb23c">SVF::AbstractState::store</a></div><div class="ttdeci">void store(u32_t addr, const AbstractValue &amp;val)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractState_8h_source.html#l00321">AbstractState.h:321</a></div></div>
954
964
  <div class="ttc" id="aclassSVF_1_1SVFArrayType_html"><div class="ttname"><a href="classSVF_1_1SVFArrayType.html">SVF::SVFArrayType</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFType_8h_source.html#l00377">SVFType.h:377</a></div></div>
955
965
  <div class="ttc" id="anamespaceSVF_html_a5d28d0818391747924478e86b9033431"><div class="ttname"><a href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">SVF::IntervalToIntStr</a></div><div class="ttdeci">std::string IntervalToIntStr(const IntervalValue &amp;inv)</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00037">BufOverflowChecker.cpp:37</a></div></div>
956
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a2a5e0a88ebef4ae740983726e7f1b5eb"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a2a5e0a88ebef4ae740983726e7f1b5eb">SVF::AbstractInterpretation::_bugLoc</a></div><div class="ttdeci">Set&lt; std::string &gt; _bugLoc</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00352">AbstractInterpretation.h:352</a></div></div>
957
- <div class="ttc" id="aclassSVF_1_1SVFIR2AbsState_html_a21e927af79c73460ff5629cbd4961163"><div class="ttname"><a href="classSVF_1_1SVFIR2AbsState.html#a21e927af79c73460ff5629cbd4961163">SVF::SVFIR2AbsState::getByteOffset</a></div><div class="ttdeci">AbstractValue getByteOffset(const GepStmt *gep)</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR2AbsState_8cpp_source.html#l00415">SVFIR2AbsState.cpp:415</a></div></div>
966
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a2a5e0a88ebef4ae740983726e7f1b5eb"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a2a5e0a88ebef4ae740983726e7f1b5eb">SVF::AbstractInterpretation::_bugLoc</a></div><div class="ttdeci">Set&lt; std::string &gt; _bugLoc</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00346">AbstractInterpretation.h:346</a></div></div>
967
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_af3c6f27181cc271332919732e490ad1d"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#af3c6f27181cc271332919732e490ad1d">SVF::AbstractInterpretation::getStrlen</a></div><div class="ttdeci">AbstractValue getStrlen(AbstractState &amp;es, const SVF::SVFValue *strValue)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01451">AbstractInterpretation.cpp:1451</a></div></div>
958
968
  <div class="ttc" id="aclassSVF_1_1CallICFGNode_html"><div class="ttname"><a href="classSVF_1_1CallICFGNode.html">SVF::CallICFGNode</a></div><div class="ttdef"><b>Definition:</b> <a href="ICFGNode_8h_source.html#l00385">ICFGNode.h:385</a></div></div>
959
969
  <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a13fdb4a6a6d09e3504fdad16b88616daa9cc269dadf9cff7d399c54d9570a6614"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa9cc269dadf9cff7d399c54d9570a6614">SVF::AbstractInterpretation::MEMCPY</a></div><div class="ttdeci">@ MEMCPY</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00113">AbstractInterpretation.h:113</a></div></div>
960
970
  <div class="ttc" id="aclassSVF_1_1SVFType_html"><div class="ttname"><a href="classSVF_1_1SVFType.html">SVF::SVFType</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFType_8h_source.html#l00156">SVFType.h:156</a></div></div>
961
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a048e203517ac727e6fe0653e1f24052c"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a048e203517ac727e6fe0653e1f24052c">SVF::AbstractInterpretation::AccessMemoryViaCallArgs</a></div><div class="ttdeci">void AccessMemoryViaCallArgs(const SVF::SVFArgument *arg, SVF::FILOWorkList&lt; const SVFValue * &gt; &amp;worklist, Set&lt; const SVFValue * &gt; &amp;visited)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01751">AbstractInterpretation.cpp:1751</a></div></div>
971
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a048e203517ac727e6fe0653e1f24052c"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a048e203517ac727e6fe0653e1f24052c">SVF::AbstractInterpretation::AccessMemoryViaCallArgs</a></div><div class="ttdeci">void AccessMemoryViaCallArgs(const SVF::SVFArgument *arg, SVF::FILOWorkList&lt; const SVFValue * &gt; &amp;worklist, Set&lt; const SVFValue * &gt; &amp;visited)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01735">AbstractInterpretation.cpp:1735</a></div></div>
972
+ <div class="ttc" id="aclassSVF_1_1SVFIR2AbsState_html_aec9a351850857fa3c6fb23c58317cb0d"><div class="ttname"><a href="classSVF_1_1SVFIR2AbsState.html#aec9a351850857fa3c6fb23c58317cb0d">SVF::SVFIR2AbsState::getByteOffset</a></div><div class="ttdeci">AbstractValue getByteOffset(AbstractState &amp;es, const GepStmt *gep)</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR2AbsState_8cpp_source.html#l00403">SVFIR2AbsState.cpp:403</a></div></div>
962
973
  <div class="ttc" id="aclassSVF_1_1ICFG_html_a5f2c0aaba07d6fdd63058da0fb60ca8b"><div class="ttname"><a href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">SVF::ICFG::getICFGNode</a></div><div class="ttdeci">ICFGNode * getICFGNode(NodeID id) const</div><div class="ttdoc">Get a ICFG node.</div><div class="ttdef"><b>Definition:</b> <a href="ICFG_8h_source.html#l00092">ICFG.h:92</a></div></div>
963
974
  <div class="ttc" id="aclassSVF_1_1SVFFunction_html"><div class="ttname"><a href="classSVF_1_1SVFFunction.html">SVF::SVFFunction</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFValue_8h_source.html#l00297">SVFValue.h:297</a></div></div>
975
+ <div class="ttc" id="aclassSVF_1_1SVFIR2AbsState_html_ad42ca3cab47612c78a5d99cedea2f4ba"><div class="ttname"><a href="classSVF_1_1SVFIR2AbsState.html#ad42ca3cab47612c78a5d99cedea2f4ba">SVF::SVFIR2AbsState::inVarToAddrsTable</a></div><div class="ttdeci">bool inVarToAddrsTable(AbstractState &amp;es, u32_t id) const</div><div class="ttdoc">whether the variable is in varToAddrs table</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR2AbsState_8h_source.html#l00120">SVFIR2AbsState.h:120</a></div></div>
964
976
  <div class="ttc" id="aclassSVF_1_1FILOWorkList_html_afcf3fcda18e8d3e2bad70a51376c0ce1"><div class="ttname"><a href="classSVF_1_1FILOWorkList.html#afcf3fcda18e8d3e2bad70a51376c0ce1">SVF::FILOWorkList::push</a></div><div class="ttdeci">bool push(const Data &amp;data)</div><div class="ttdef"><b>Definition:</b> <a href="WorkList_8h_source.html#l00257">WorkList.h:257</a></div></div>
965
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a550c12360c2149ba0e55bdf4cf7b8dd0"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a550c12360c2149ba0e55bdf4cf7b8dd0">SVF::AbstractInterpretation::AccessMemoryViaCopyStmt</a></div><div class="ttdeci">void AccessMemoryViaCopyStmt(const CopyStmt *copy, SVF::FILOWorkList&lt; const SVFValue * &gt; &amp;worklist, Set&lt; const SVFValue * &gt; &amp;visited)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01721">AbstractInterpretation.cpp:1721</a></div></div>
977
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a550c12360c2149ba0e55bdf4cf7b8dd0"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a550c12360c2149ba0e55bdf4cf7b8dd0">SVF::AbstractInterpretation::AccessMemoryViaCopyStmt</a></div><div class="ttdeci">void AccessMemoryViaCopyStmt(const CopyStmt *copy, SVF::FILOWorkList&lt; const SVFValue * &gt; &amp;worklist, Set&lt; const SVFValue * &gt; &amp;visited)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01705">AbstractInterpretation.cpp:1705</a></div></div>
966
978
  <div class="ttc" id="aclassSVF_1_1SVFConstantInt_html"><div class="ttname"><a href="classSVF_1_1SVFConstantInt.html">SVF::SVFConstantInt</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFValue_8h_source.html#l00966">SVFValue.h:966</a></div></div>
967
979
  <div class="ttc" id="aclassSVF_1_1IntervalValue_html_adac2dc2c9f744a071ad3f0175ed40cd9"><div class="ttname"><a href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">SVF::IntervalValue::ub</a></div><div class="ttdeci">const NumericLiteral &amp; ub() const</div><div class="ttdoc">Return the upper bound.</div><div class="ttdef"><b>Definition:</b> <a href="IntervalValue_8h_source.html#l00213">IntervalValue.h:213</a></div></div>
968
980
  <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_a52de7d619e8746a70718719306d7c5a1"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#a52de7d619e8746a70718719306d7c5a1">SVF::BufOverflowChecker::detectBufOverflow</a></div><div class="ttdeci">bool detectBufOverflow(const ICFGNode *node)</div></div>
@@ -970,35 +982,34 @@ $(function() {
970
982
  <div class="ttc" id="aclassSVF_1_1SVFStmt_html"><div class="ttname"><a href="classSVF_1_1SVFStmt.html">SVF::SVFStmt</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFStatements_8h_source.html#l00051">SVFStatements.h:51</a></div></div>
971
983
  <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_af83b65ed98cd4e0f6cd92962e7392d4d"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">SVF::BufOverflowChecker::_extAPIBufOverflowCheckRules</a></div><div class="ttdeci">Map&lt; std::string, std::vector&lt; std::pair&lt; u32_t, u32_t &gt; &gt; &gt; _extAPIBufOverflowCheckRules</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8h_source.html#l00202">BufOverflowChecker.h:202</a></div></div>
972
984
  <div class="ttc" id="aclassSVF_1_1SVFVar_html"><div class="ttname"><a href="classSVF_1_1SVFVar.html">SVF::SVFVar</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFVariables_8h_source.html#l00045">SVFVariables.h:45</a></div></div>
973
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a9c592b91a1e3d72ada730387232a2fcf"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">SVF::AbstractInterpretation::_svfir2AbsState</a></div><div class="ttdeci">SVFIR2AbsState * _svfir2AbsState</div><div class="ttdoc">Execution State, used to store the Interval Value of every SVF variable.</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00345">AbstractInterpretation.h:345</a></div></div>
985
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a9c592b91a1e3d72ada730387232a2fcf"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">SVF::AbstractInterpretation::_svfir2AbsState</a></div><div class="ttdeci">SVFIR2AbsState * _svfir2AbsState</div><div class="ttdoc">Execution State, used to store the Interval Value of every SVF variable.</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00339">AbstractInterpretation.h:339</a></div></div>
974
986
  <div class="ttc" id="aclassSVF_1_1LoadStmt_html"><div class="ttname"><a href="classSVF_1_1LoadStmt.html">SVF::LoadStmt</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFStatements_8h_source.html#l00489">SVFStatements.h:489</a></div></div>
975
987
  <div class="ttc" id="aclassSVF_1_1IntervalValue_html"><div class="ttname"><a href="classSVF_1_1IntervalValue.html">SVF::IntervalValue</a></div><div class="ttdef"><b>Definition:</b> <a href="IntervalValue_8h_source.html#l00043">IntervalValue.h:43</a></div></div>
976
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a6cac9b69d85111a5a26373ec848a3282"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a6cac9b69d85111a5a26373ec848a3282">SVF::AbstractInterpretation::handleExtAPI</a></div><div class="ttdeci">virtual void handleExtAPI(const CallICFGNode *call)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01174">AbstractInterpretation.cpp:1174</a></div></div>
988
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a6cac9b69d85111a5a26373ec848a3282"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a6cac9b69d85111a5a26373ec848a3282">SVF::AbstractInterpretation::handleExtAPI</a></div><div class="ttdeci">virtual void handleExtAPI(const CallICFGNode *call)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01166">AbstractInterpretation.cpp:1166</a></div></div>
977
989
  <div class="ttc" id="aclassSVF_1_1GenericGraph_html_a43c9c773bfa17abf481c33073e30d01b"><div class="ttname"><a href="classSVF_1_1GenericGraph.html#a43c9c773bfa17abf481c33073e30d01b">SVF::GenericGraph::getGNode</a></div><div class="ttdeci">NodeType * getGNode(NodeID id) const</div><div class="ttdoc">Get a node.</div><div class="ttdef"><b>Definition:</b> <a href="GenericGraph_8h_source.html#l00406">GenericGraph.h:406</a></div></div>
978
990
  <div class="ttc" id="aclassSVF_1_1Options_html_afbe432aabda95308e2c190a04d227a6d"><div class="ttname"><a href="classSVF_1_1Options.html#afbe432aabda95308e2c190a04d227a6d">SVF::Options::BufferOverflowCheck</a></div><div class="ttdeci">static const Option&lt; bool &gt; BufferOverflowCheck</div><div class="ttdoc">buffer overflow checker, Default: false</div><div class="ttdef"><b>Definition:</b> <a href="Options_8h_source.html#l00271">Options.h:271</a></div></div>
979
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a29fe7c63c61a7aec8ae1477a061f5bf2"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a29fe7c63c61a7aec8ae1477a061f5bf2">SVF::AbstractInterpretation::AccessMemoryViaRetNode</a></div><div class="ttdeci">void AccessMemoryViaRetNode(const CallICFGNode *callnode, SVF::FILOWorkList&lt; const SVFValue * &gt; &amp;worklist, Set&lt; const SVFValue * &gt; &amp;visited)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01696">AbstractInterpretation.cpp:1696</a></div></div>
991
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a29fe7c63c61a7aec8ae1477a061f5bf2"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a29fe7c63c61a7aec8ae1477a061f5bf2">SVF::AbstractInterpretation::AccessMemoryViaRetNode</a></div><div class="ttdeci">void AccessMemoryViaRetNode(const CallICFGNode *callnode, SVF::FILOWorkList&lt; const SVFValue * &gt; &amp;worklist, Set&lt; const SVFValue * &gt; &amp;visited)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01680">AbstractInterpretation.cpp:1680</a></div></div>
980
992
  <div class="ttc" id="aclassSVF_1_1AbstractState_html"><div class="ttname"><a href="classSVF_1_1AbstractState.html">SVF::AbstractState</a></div><div class="ttdef"><b>Definition:</b> <a href="AbstractState_8h_source.html#l00054">AbstractState.h:54</a></div></div>
981
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_ac60581a57407fa4c65b1975f5be687b8"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#ac60581a57407fa4c65b1975f5be687b8">SVF::AbstractInterpretation::AccessMemoryViaLoadStmt</a></div><div class="ttdeci">void AccessMemoryViaLoadStmt(const LoadStmt *load, SVF::FILOWorkList&lt; const SVFValue * &gt; &amp;worklist, Set&lt; const SVFValue * &gt; &amp;visited)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01730">AbstractInterpretation.cpp:1730</a></div></div>
982
993
  <div class="ttc" id="anamespaceSVF_html_a9b707002523ece2ac54ca893ee9a2d4e"><div class="ttname"><a href="namespaceSVF.html#a9b707002523ece2ac54ca893ee9a2d4e">SVF::s32_t</a></div><div class="ttdeci">signed s32_t</div><div class="ttdef"><b>Definition:</b> <a href="GeneralType_8h_source.html#l00047">GeneralType.h:47</a></div></div>
983
994
  <div class="ttc" id="aclassSVF_1_1GepStmt_html"><div class="ttname"><a href="classSVF_1_1GepStmt.html">SVF::GepStmt</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFStatements_8h_source.html#l00526">SVFStatements.h:526</a></div></div>
984
- <div class="ttc" id="aclassSVF_1_1SVFIR2AbsState_html_a99b526db536fb241ff755a82a45123fa"><div class="ttname"><a href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">SVF::SVFIR2AbsState::getAbsState</a></div><div class="ttdeci">AbstractState &amp; getAbsState()</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR2AbsState_8h_source.html#l00054">SVFIR2AbsState.h:54</a></div></div>
985
995
  <div class="ttc" id="aclassSVF_1_1SVFIR_html_abda052b73e869ed6d7c139ad1528da11"><div class="ttname"><a href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">SVF::SVFIR::getICFG</a></div><div class="ttdeci">ICFG * getICFG() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR_8h_source.html#l00170">SVFIR.h:170</a></div></div>
986
996
  <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a13fdb4a6a6d09e3504fdad16b88616da"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616da">SVF::AbstractInterpretation::ExtAPIType</a></div><div class="ttdeci">ExtAPIType</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00113">AbstractInterpretation.h:113</a></div></div>
987
- <div class="ttc" id="aclassSVF_1_1SVFIR2AbsState_html_aa3e62b9ef912def502b95992199f5d8c"><div class="ttname"><a href="classSVF_1_1SVFIR2AbsState.html#aa3e62b9ef912def502b95992199f5d8c">SVF::SVFIR2AbsState::getAddrs</a></div><div class="ttdeci">AbstractValue &amp; getAddrs(u32_t id)</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR2AbsState_8h_source.html#l00113">SVFIR2AbsState.h:113</a></div></div>
997
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a11ceda75dbe328bcabdc6ff6919f9526"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a11ceda75dbe328bcabdc6ff6919f9526">SVF::AbstractInterpretation::getState</a></div><div class="ttdeci">AbstractState &amp; getState(const ICFGNode *node)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00372">AbstractInterpretation.h:372</a></div></div>
988
998
  <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_a0b79c3694a08100d2d8d1b8109998131"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#a0b79c3694a08100d2d8d1b8109998131">SVF::BufOverflowChecker::handleSVFStatement</a></div><div class="ttdeci">virtual void handleSVFStatement(const SVFStmt *stmt) override</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00062">BufOverflowChecker.cpp:62</a></div></div>
989
999
  <div class="ttc" id="acJSON_8cpp_html_a95bf816579e97b6f33bdb5e25ed6d5de"><div class="ttname"><a href="cJSON_8cpp.html#a95bf816579e97b6f33bdb5e25ed6d5de">offset</a></div><div class="ttdeci">buffer offset</div><div class="ttdef"><b>Definition:</b> <a href="cJSON_8cpp_source.html#l01113">cJSON.cpp:1113</a></div></div>
990
- <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_af0e2276001df7d51c45b22d5d11ca09b"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#af0e2276001df7d51c45b22d5d11ca09b">SVF::BufOverflowChecker::initExtFunMap</a></div><div class="ttdeci">virtual void initExtFunMap() override</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00134">BufOverflowChecker.cpp:134</a></div></div>
991
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a9885b50cf28b65bebb488442085fab26"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a9885b50cf28b65bebb488442085fab26">SVF::AbstractInterpretation::_callSiteStack</a></div><div class="ttdeci">std::vector&lt; const CallICFGNode * &gt; _callSiteStack</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00354">AbstractInterpretation.h:354</a></div></div>
1000
+ <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_af0e2276001df7d51c45b22d5d11ca09b"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#af0e2276001df7d51c45b22d5d11ca09b">SVF::BufOverflowChecker::initExtFunMap</a></div><div class="ttdeci">virtual void initExtFunMap() override</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00136">BufOverflowChecker.cpp:136</a></div></div>
1001
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a9885b50cf28b65bebb488442085fab26"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a9885b50cf28b65bebb488442085fab26">SVF::AbstractInterpretation::_callSiteStack</a></div><div class="ttdeci">std::vector&lt; const CallICFGNode * &gt; _callSiteStack</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00348">AbstractInterpretation.h:348</a></div></div>
992
1002
  <div class="ttc" id="aclassSVF_1_1IntervalValue_html_a674f9bb98053f8658e246863d6561072"><div class="ttname"><a href="classSVF_1_1IntervalValue.html#a674f9bb98053f8658e246863d6561072">SVF::IntervalValue::isBottom</a></div><div class="ttdeci">bool isBottom() const</div><div class="ttdef"><b>Definition:</b> <a href="IntervalValue_8h_source.html#l00060">IntervalValue.h:60</a></div></div>
993
1003
  <div class="ttc" id="aclassSVF_1_1CallSite_html"><div class="ttname"><a href="classSVF_1_1CallSite.html">SVF::CallSite</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFValue_8h_source.html#l01113">SVFValue.h:1113</a></div></div>
994
1004
  <div class="ttc" id="aclassSVF_1_1FILOWorkList_html_a071a624c91def82a4bbbf3806c7b7eea"><div class="ttname"><a href="classSVF_1_1FILOWorkList.html#a071a624c91def82a4bbbf3806c7b7eea">SVF::FILOWorkList::empty</a></div><div class="ttdeci">bool empty() const</div><div class="ttdef"><b>Definition:</b> <a href="WorkList_8h_source.html#l00238">WorkList.h:238</a></div></div>
995
1005
  <div class="ttc" id="aclassSVF_1_1SVFValue_html_a4a0cfe3a8f37d33ffcdca3d66026dcc3"><div class="ttname"><a href="classSVF_1_1SVFValue.html#a4a0cfe3a8f37d33ffcdca3d66026dcc3">SVF::SVFValue::toString</a></div><div class="ttdeci">std::string toString() const</div><div class="ttdoc">Needs to be implemented by a SVF front end.</div><div class="ttdef"><b>Definition:</b> <a href="LLVMUtil_8cpp_source.html#l00943">LLVMUtil.cpp:943</a></div></div>
996
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a8e4f0c5f527e321369a19a0b37124079"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a8e4f0c5f527e321369a19a0b37124079">SVF::AbstractInterpretation::_recoder</a></div><div class="ttdeci">SVFBugReport _recoder</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00353">AbstractInterpretation.h:353</a></div></div>
997
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a896d04a02951947bc228bf97b2c00313"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a896d04a02951947bc228bf97b2c00313">SVF::AbstractInterpretation::handleSVFStatement</a></div><div class="ttdeci">virtual void handleSVFStatement(const SVFStmt *stmt)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l00830">AbstractInterpretation.cpp:830</a></div></div>
1006
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a8e4f0c5f527e321369a19a0b37124079"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a8e4f0c5f527e321369a19a0b37124079">SVF::AbstractInterpretation::_recoder</a></div><div class="ttdeci">SVFBugReport _recoder</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00347">AbstractInterpretation.h:347</a></div></div>
1007
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a896d04a02951947bc228bf97b2c00313"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a896d04a02951947bc228bf97b2c00313">SVF::AbstractInterpretation::handleSVFStatement</a></div><div class="ttdeci">virtual void handleSVFStatement(const SVFStmt *stmt)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l00827">AbstractInterpretation.cpp:827</a></div></div>
998
1008
  <div class="ttc" id="aWorkList_8h_html"><div class="ttname"><a href="WorkList_8h.html">WorkList.h</a></div></div>
999
1009
  <div class="ttc" id="acJSON_8cpp_html_a7669ee67a0563250c1efaa24d130e1ac"><div class="ttname"><a href="cJSON_8cpp.html#a7669ee67a0563250c1efaa24d130e1ac">copy</a></div><div class="ttdeci">copy</div><div class="ttdef"><b>Definition:</b> <a href="cJSON_8cpp_source.html#l00414">cJSON.cpp:414</a></div></div>
1000
1010
  <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a13fdb4a6a6d09e3504fdad16b88616daae8dad405c06383859d8db715fd455317"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daae8dad405c06383859d8db715fd455317">SVF::AbstractInterpretation::STRCAT</a></div><div class="ttdeci">@ STRCAT</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00113">AbstractInterpretation.h:113</a></div></div>
1001
- <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_a1ed3cb0a1a118d9e505b192841a58dde"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#a1ed3cb0a1a118d9e505b192841a58dde">SVF::BufOverflowChecker::handleExtAPI</a></div><div class="ttdeci">void handleExtAPI(const CallICFGNode *call) override</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00415">BufOverflowChecker.cpp:415</a></div></div>
1011
+ <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_a1ed3cb0a1a118d9e505b192841a58dde"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#a1ed3cb0a1a118d9e505b192841a58dde">SVF::BufOverflowChecker::handleExtAPI</a></div><div class="ttdeci">void handleExtAPI(const CallICFGNode *call) override</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00425">BufOverflowChecker.cpp:425</a></div></div>
1012
+ <div class="ttc" id="aclassSVF_1_1AbstractState_html_aaabe5850dbf1620c6058f5ac6cb169b6"><div class="ttname"><a href="classSVF_1_1AbstractState.html#aaabe5850dbf1620c6058f5ac6cb169b6">SVF::AbstractState::getInternalID</a></div><div class="ttdeci">static u32_t getInternalID(u32_t idx)</div><div class="ttdoc">Return the internal index if idx is an address otherwise return the value of idx.</div><div class="ttdef"><b>Definition:</b> <a href="AbstractState_8h_source.html#l00093">AbstractState.h:93</a></div></div>
1002
1013
  <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a13fdb4a6a6d09e3504fdad16b88616daa5aec33226dc590ec951d0f12bf35f15f"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa5aec33226dc590ec951d0f12bf35f15f">SVF::AbstractInterpretation::MEMSET</a></div><div class="ttdeci">@ MEMSET</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00113">AbstractInterpretation.h:113</a></div></div>
1003
1014
  <div class="ttc" id="aclassSVF_1_1FILOWorkList_html_a3fd9acb6d09fd142bfd402fdf8cac93b"><div class="ttname"><a href="classSVF_1_1FILOWorkList.html#a3fd9acb6d09fd142bfd402fdf8cac93b">SVF::FILOWorkList::pop</a></div><div class="ttdeci">Data pop()</div><div class="ttdef"><b>Definition:</b> <a href="WorkList_8h_source.html#l00272">WorkList.h:272</a></div></div>
1004
1015
  <div class="ttc" id="aclassSVF_1_1FILOWorkList_html"><div class="ttname"><a href="classSVF_1_1FILOWorkList.html">SVF::FILOWorkList</a></div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00042">AbstractInterpretation.h:42</a></div></div>
@@ -1006,9 +1017,8 @@ $(function() {
1006
1017
  <div class="ttc" id="anamespaceSVF_html_a43a65e0d33af3c743294f7a1139d2301"><div class="ttname"><a href="namespaceSVF.html#a43a65e0d33af3c743294f7a1139d2301">SVF::NodeID</a></div><div class="ttdeci">unsigned NodeID</div><div class="ttdef"><b>Definition:</b> <a href="svf-llvm_2tools_2MTA_2MTAResultValidator_8h_source.html#l00020">MTAResultValidator.h:20</a></div></div>
1007
1018
  <div class="ttc" id="aclassSVF_1_1SVFType_html_a870b63af2bf9fe43cdf1df3d56b20f6c"><div class="ttname"><a href="classSVF_1_1SVFType.html#a870b63af2bf9fe43cdf1df3d56b20f6c">SVF::SVFType::isPointerTy</a></div><div class="ttdeci">bool isPointerTy() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFType_8h_source.html#l00249">SVFType.h:249</a></div></div>
1008
1019
  <div class="ttc" id="aclassSVF_1_1SVFVar_html_ab6f95d3e7e099d75cfc9645ebc037047"><div class="ttname"><a href="classSVF_1_1SVFVar.html#ab6f95d3e7e099d75cfc9645ebc037047">SVF::SVFVar::getType</a></div><div class="ttdeci">virtual const SVFType * getType() const</div><div class="ttdoc">Return type of the value.</div><div class="ttdef"><b>Definition:</b> <a href="SVFVariables_8h_source.html#l00107">SVFVariables.h:107</a></div></div>
1009
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a9b179466955023f275b6692b59048846"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a9b179466955023f275b6692b59048846">SVF::AbstractInterpretation::handleICFGNode</a></div><div class="ttdeci">virtual void handleICFGNode(const ICFGNode *node)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l00674">AbstractInterpretation.cpp:674</a></div></div>
1020
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a9b179466955023f275b6692b59048846"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a9b179466955023f275b6692b59048846">SVF::AbstractInterpretation::handleICFGNode</a></div><div class="ttdeci">virtual void handleICFGNode(const ICFGNode *node)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l00671">AbstractInterpretation.cpp:671</a></div></div>
1010
1021
  <div class="ttc" id="aclassSVF_1_1SVFArgument_html"><div class="ttname"><a href="classSVF_1_1SVFArgument.html">SVF::SVFArgument</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFValue_8h_source.html#l00897">SVFValue.h:897</a></div></div>
1011
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a2057e8e1c0aaf39e74f0a8fb2a1b580c"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a2057e8e1c0aaf39e74f0a8fb2a1b580c">SVF::AbstractInterpretation::getPointeeElement</a></div><div class="ttdeci">const SVFType * getPointeeElement(NodeID id)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01620">AbstractInterpretation.cpp:1620</a></div></div>
1012
1022
  <div class="ttc" id="aclassSVF_1_1SVFArrayType_html_a28da1169748e38b891133b76568a2759"><div class="ttname"><a href="classSVF_1_1SVFArrayType.html#a28da1169748e38b891133b76568a2759">SVF::SVFArrayType::getTypeOfElement</a></div><div class="ttdeci">const SVFType * getTypeOfElement() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFType_8h_source.html#l00399">SVFType.h:399</a></div></div>
1013
1023
  <div class="ttc" id="aclassSVF_1_1SVFInstruction_html"><div class="ttname"><a href="classSVF_1_1SVFInstruction.html">SVF::SVFInstruction</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFValue_8h_source.html#l00631">SVFValue.h:631</a></div></div>
1014
1024
  <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_a0088456e712c555cbfba6203aec38037"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">SVF::BufOverflowChecker::_addrToGep</a></div><div class="ttdeci">Map&lt; NodeID, const GepStmt * &gt; _addrToGep</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8h_source.html#l00201">BufOverflowChecker.h:201</a></div></div>
@@ -1016,13 +1026,14 @@ $(function() {
1016
1026
  <div class="ttc" id="astructSVF_1_1AbstractValue_html_a8b1af972fa8a4e40347990d179ec1c52"><div class="ttname"><a href="structSVF_1_1AbstractValue.html#a8b1af972fa8a4e40347990d179ec1c52">SVF::AbstractValue::isBottom</a></div><div class="ttdeci">bool isBottom() const</div><div class="ttdef"><b>Definition:</b> <a href="AbstractValue_8h_source.html#l00192">AbstractValue.h:192</a></div></div>
1017
1027
  <div class="ttc" id="anamespaceSVF_html_a8234d4b959abc9123993bcff4eee34c1"><div class="ttname"><a href="namespaceSVF.html#a8234d4b959abc9123993bcff4eee34c1">SVF::Map</a></div><div class="ttdeci">std::unordered_map&lt; Key, Value, Hash, KeyEqual, Allocator &gt; Map</div><div class="ttdef"><b>Definition:</b> <a href="GeneralType_8h_source.html#l00101">GeneralType.h:101</a></div></div>
1018
1028
  <div class="ttc" id="astructSVF_1_1AbstractValue_html"><div class="ttname"><a href="structSVF_1_1AbstractValue.html">SVF::AbstractValue</a></div><div class="ttdef"><b>Definition:</b> <a href="AbstractValue_8h_source.html#l00029">AbstractValue.h:29</a></div></div>
1029
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a37e8e190a8a29d550752d012b9f6e890"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a37e8e190a8a29d550752d012b9f6e890">SVF::AbstractInterpretation::AccessMemoryViaLoadStmt</a></div><div class="ttdeci">void AccessMemoryViaLoadStmt(AbstractState &amp;es, const LoadStmt *load, SVF::FILOWorkList&lt; const SVFValue * &gt; &amp;worklist, Set&lt; const SVFValue * &gt; &amp;visited)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01714">AbstractInterpretation.cpp:1714</a></div></div>
1019
1030
  <div class="ttc" id="aclassSVF_1_1CallSite_html_a9e7c94ee7f689466111487e03b2cebcc"><div class="ttname"><a href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">SVF::CallSite::getArgument</a></div><div class="ttdeci">const SVFValue * getArgument(u32_t ArgNo) const</div><div class="ttdef"><b>Definition:</b> <a href="SVFValue_8h_source.html#l01132">SVFValue.h:1132</a></div></div>
1020
- <div class="ttc" id="aclassSVF_1_1SVFIR2AbsState_html_ac37760566b534d89a61d789b00efb993"><div class="ttname"><a href="classSVF_1_1SVFIR2AbsState.html#ac37760566b534d89a61d789b00efb993">SVF::SVFIR2AbsState::getInternalID</a></div><div class="ttdeci">static u32_t getInternalID(u32_t idx)</div><div class="ttdoc">Return the internal index if idx is an address otherwise return the value of idx.</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR2AbsState_8h_source.html#l00170">SVFIR2AbsState.h:170</a></div></div>
1021
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_aa27d0ef684deec1f5385fdb0d4c64827"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">SVF::AbstractInterpretation::_func_map</a></div><div class="ttdeci">Map&lt; std::string, std::function&lt; void(const CallSite &amp;)&gt; &gt; _func_map</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00380">AbstractInterpretation.h:380</a></div></div>
1031
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a2ee740506a2ad50e1ee8dbb345fe0ff5"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a2ee740506a2ad50e1ee8dbb345fe0ff5">SVF::AbstractInterpretation::getAllocaInstByteSize</a></div><div class="ttdeci">u32_t getAllocaInstByteSize(AbstractState &amp;es, const AddrStmt *addr)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01284">AbstractInterpretation.cpp:1284</a></div></div>
1032
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_aa27d0ef684deec1f5385fdb0d4c64827"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">SVF::AbstractInterpretation::_func_map</a></div><div class="ttdeci">Map&lt; std::string, std::function&lt; void(const CallSite &amp;)&gt; &gt; _func_map</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00387">AbstractInterpretation.h:387</a></div></div>
1022
1033
  <div class="ttc" id="anamespaceSVF_html_ad42bff8d0a7d60a085aa32d10f4955af"><div class="ttname"><a href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">SVF::u32_t</a></div><div class="ttdeci">unsigned u32_t</div><div class="ttdef"><b>Definition:</b> <a href="GeneralType_8h_source.html#l00046">GeneralType.h:46</a></div></div>
1023
1034
  <div class="ttc" id="anamespaceSVF_1_1SVFUtil_html_ab65033f068bfbeb0a1c52dcec3beb6bc"><div class="ttname"><a href="namespaceSVF_1_1SVFUtil.html#ab65033f068bfbeb0a1c52dcec3beb6bc">SVF::SVFUtil::errs</a></div><div class="ttdeci">std::ostream &amp; errs()</div><div class="ttdoc">Overwrite llvm::errs()</div><div class="ttdef"><b>Definition:</b> <a href="SVFUtil_8h_source.html#l00056">SVFUtil.h:56</a></div></div>
1024
1035
  <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_a7c11b81809cb087317cbea654a589f75"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">SVF::BufOverflowChecker::addBugToRecoder</a></div><div class="ttdeci">void addBugToRecoder(const BufOverflowException &amp;e, const ICFGNode *node)</div></div>
1025
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a219313e979d779221116c1bc45becc1b"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a219313e979d779221116c1bc45becc1b">SVF::AbstractInterpretation::_checkpoints</a></div><div class="ttdeci">Set&lt; const CallICFGNode * &gt; _checkpoints</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00381">AbstractInterpretation.h:381</a></div></div>
1036
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a219313e979d779221116c1bc45becc1b"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a219313e979d779221116c1bc45becc1b">SVF::AbstractInterpretation::_checkpoints</a></div><div class="ttdeci">Set&lt; const CallICFGNode * &gt; _checkpoints</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00388">AbstractInterpretation.h:388</a></div></div>
1026
1037
  <!-- start footer part -->
1027
1038
  <hr class="footer"/><address class="footer"><small>
1028
1039
  Generated by &#160;<a href="http://www.doxygen.org/index.html">