svf-tools 1.0.913 → 1.0.915

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (264) hide show
  1. package/SVF-doxygen/html/AbstractInterpretation_8cpp.html +7 -5
  2. package/SVF-doxygen/html/AbstractInterpretation_8cpp_source.html +1593 -1610
  3. package/SVF-doxygen/html/AbstractInterpretation_8h_source.html +157 -144
  4. package/SVF-doxygen/html/BufOverflowChecker_8cpp_source.html +797 -786
  5. package/SVF-doxygen/html/BufOverflowChecker_8h_source.html +7 -7
  6. package/SVF-doxygen/html/SVFIR2AbsState_8cpp_source.html +815 -826
  7. package/SVF-doxygen/html/SVFIR2AbsState_8h_source.html +153 -196
  8. package/SVF-doxygen/html/classSVF_1_1AEStat.html +116 -120
  9. package/SVF-doxygen/html/classSVF_1_1AbstractInterpretation-members.html +33 -33
  10. package/SVF-doxygen/html/classSVF_1_1AbstractInterpretation.html +1739 -1684
  11. package/SVF-doxygen/html/classSVF_1_1BufOverflowChecker-members.html +33 -33
  12. package/SVF-doxygen/html/classSVF_1_1BufOverflowChecker.html +471 -462
  13. package/SVF-doxygen/html/classSVF_1_1SVFIR2AbsState-members.html +35 -47
  14. package/SVF-doxygen/html/classSVF_1_1SVFIR2AbsState.html +1261 -1546
  15. package/SVF-doxygen/html/dir_9a8e7a56f4029a0d9f62b1c6d1f6e85b.html +0 -2
  16. package/SVF-doxygen/html/files.html +0 -1
  17. package/SVF-doxygen/html/functions.html +4 -7
  18. package/SVF-doxygen/html/functions_a.html +2 -2
  19. package/SVF-doxygen/html/functions_f.html +3 -3
  20. package/SVF-doxygen/html/functions_func.html +2 -2
  21. package/SVF-doxygen/html/functions_func_g.html +16 -16
  22. package/SVF-doxygen/html/functions_func_h.html +21 -57
  23. package/SVF-doxygen/html/functions_func_i.html +21 -12
  24. package/SVF-doxygen/html/functions_func_n.html +1 -1
  25. package/SVF-doxygen/html/functions_func_s.html +13 -19
  26. package/SVF-doxygen/html/functions_func_t.html +1 -1
  27. package/SVF-doxygen/html/functions_func_w.html +1 -1
  28. package/SVF-doxygen/html/functions_g.html +16 -16
  29. package/SVF-doxygen/html/functions_h.html +18 -54
  30. package/SVF-doxygen/html/functions_i.html +32 -23
  31. package/SVF-doxygen/html/functions_l.html +3 -3
  32. package/SVF-doxygen/html/functions_n.html +1 -1
  33. package/SVF-doxygen/html/functions_o.html +4 -4
  34. package/SVF-doxygen/html/functions_p.html +19 -17
  35. package/SVF-doxygen/html/functions_r.html +6 -6
  36. package/SVF-doxygen/html/functions_s.html +18 -26
  37. package/SVF-doxygen/html/functions_t.html +4 -4
  38. package/SVF-doxygen/html/functions_v.html +6 -6
  39. package/SVF-doxygen/html/functions_vars.html +4 -7
  40. package/SVF-doxygen/html/functions_w.html +1 -1
  41. package/SVF-doxygen/html/search/all_0.js +131 -132
  42. package/SVF-doxygen/html/search/all_1.js +504 -504
  43. package/SVF-doxygen/html/search/all_10.js +326 -326
  44. package/SVF-doxygen/html/search/all_11.js +227 -227
  45. package/SVF-doxygen/html/search/all_12.js +559 -562
  46. package/SVF-doxygen/html/search/all_13.js +186 -186
  47. package/SVF-doxygen/html/search/all_14.js +74 -74
  48. package/SVF-doxygen/html/search/all_15.js +175 -175
  49. package/SVF-doxygen/html/search/all_16.js +77 -77
  50. package/SVF-doxygen/html/search/all_17.js +1 -1
  51. package/SVF-doxygen/html/search/all_18.js +1 -1
  52. package/SVF-doxygen/html/search/all_19.js +27 -27
  53. package/SVF-doxygen/html/search/all_1a.js +174 -174
  54. package/SVF-doxygen/html/search/all_2.js +180 -180
  55. package/SVF-doxygen/html/search/all_3.js +635 -635
  56. package/SVF-doxygen/html/search/all_4.js +237 -237
  57. package/SVF-doxygen/html/search/all_5.js +120 -120
  58. package/SVF-doxygen/html/search/all_6.js +236 -236
  59. package/SVF-doxygen/html/search/all_7.js +1039 -1039
  60. package/SVF-doxygen/html/search/all_8.js +212 -224
  61. package/SVF-doxygen/html/search/all_9.js +630 -627
  62. package/SVF-doxygen/html/search/all_a.js +46 -46
  63. package/SVF-doxygen/html/search/all_b.js +24 -24
  64. package/SVF-doxygen/html/search/all_c.js +111 -111
  65. package/SVF-doxygen/html/search/all_d.js +204 -204
  66. package/SVF-doxygen/html/search/all_e.js +207 -207
  67. package/SVF-doxygen/html/search/all_f.js +122 -122
  68. package/SVF-doxygen/html/search/classes_0.js +29 -29
  69. package/SVF-doxygen/html/search/classes_1.js +11 -11
  70. package/SVF-doxygen/html/search/classes_10.js +71 -71
  71. package/SVF-doxygen/html/search/classes_11.js +14 -14
  72. package/SVF-doxygen/html/search/classes_12.js +2 -2
  73. package/SVF-doxygen/html/search/classes_13.js +10 -10
  74. package/SVF-doxygen/html/search/classes_14.js +19 -19
  75. package/SVF-doxygen/html/search/classes_15.js +1 -1
  76. package/SVF-doxygen/html/search/classes_2.js +72 -72
  77. package/SVF-doxygen/html/search/classes_3.js +35 -35
  78. package/SVF-doxygen/html/search/classes_4.js +7 -7
  79. package/SVF-doxygen/html/search/classes_5.js +28 -28
  80. package/SVF-doxygen/html/search/classes_6.js +98 -98
  81. package/SVF-doxygen/html/search/classes_7.js +33 -33
  82. package/SVF-doxygen/html/search/classes_8.js +57 -57
  83. package/SVF-doxygen/html/search/classes_9.js +1 -1
  84. package/SVF-doxygen/html/search/classes_a.js +12 -12
  85. package/SVF-doxygen/html/search/classes_b.js +29 -29
  86. package/SVF-doxygen/html/search/classes_c.js +6 -6
  87. package/SVF-doxygen/html/search/classes_d.js +19 -19
  88. package/SVF-doxygen/html/search/classes_e.js +36 -36
  89. package/SVF-doxygen/html/search/classes_f.js +25 -25
  90. package/SVF-doxygen/html/search/defines_0.js +3 -3
  91. package/SVF-doxygen/html/search/defines_1.js +3 -3
  92. package/SVF-doxygen/html/search/defines_10.js +2 -2
  93. package/SVF-doxygen/html/search/defines_2.js +30 -30
  94. package/SVF-doxygen/html/search/defines_3.js +20 -20
  95. package/SVF-doxygen/html/search/defines_4.js +3 -3
  96. package/SVF-doxygen/html/search/defines_5.js +4 -4
  97. package/SVF-doxygen/html/search/defines_6.js +2 -2
  98. package/SVF-doxygen/html/search/defines_7.js +5 -5
  99. package/SVF-doxygen/html/search/defines_8.js +11 -11
  100. package/SVF-doxygen/html/search/defines_9.js +9 -9
  101. package/SVF-doxygen/html/search/defines_a.js +2 -2
  102. package/SVF-doxygen/html/search/defines_b.js +1 -1
  103. package/SVF-doxygen/html/search/defines_c.js +3 -3
  104. package/SVF-doxygen/html/search/defines_d.js +2 -2
  105. package/SVF-doxygen/html/search/defines_e.js +8 -8
  106. package/SVF-doxygen/html/search/defines_f.js +4 -4
  107. package/SVF-doxygen/html/search/enums_0.js +3 -3
  108. package/SVF-doxygen/html/search/enums_1.js +2 -2
  109. package/SVF-doxygen/html/search/enums_10.js +1 -1
  110. package/SVF-doxygen/html/search/enums_11.js +1 -1
  111. package/SVF-doxygen/html/search/enums_2.js +9 -9
  112. package/SVF-doxygen/html/search/enums_3.js +2 -2
  113. package/SVF-doxygen/html/search/enums_4.js +3 -3
  114. package/SVF-doxygen/html/search/enums_5.js +1 -1
  115. package/SVF-doxygen/html/search/enums_6.js +2 -2
  116. package/SVF-doxygen/html/search/enums_7.js +2 -2
  117. package/SVF-doxygen/html/search/enums_8.js +4 -4
  118. package/SVF-doxygen/html/search/enums_9.js +1 -1
  119. package/SVF-doxygen/html/search/enums_a.js +1 -1
  120. package/SVF-doxygen/html/search/enums_b.js +7 -7
  121. package/SVF-doxygen/html/search/enums_c.js +1 -1
  122. package/SVF-doxygen/html/search/enums_d.js +4 -4
  123. package/SVF-doxygen/html/search/enums_e.js +2 -2
  124. package/SVF-doxygen/html/search/enums_f.js +4 -4
  125. package/SVF-doxygen/html/search/enumvalues_0.js +15 -15
  126. package/SVF-doxygen/html/search/enumvalues_1.js +16 -16
  127. package/SVF-doxygen/html/search/enumvalues_10.js +36 -36
  128. package/SVF-doxygen/html/search/enumvalues_11.js +6 -6
  129. package/SVF-doxygen/html/search/enumvalues_12.js +10 -10
  130. package/SVF-doxygen/html/search/enumvalues_13.js +1 -1
  131. package/SVF-doxygen/html/search/enumvalues_14.js +1 -1
  132. package/SVF-doxygen/html/search/enumvalues_15.js +4 -4
  133. package/SVF-doxygen/html/search/enumvalues_2.js +36 -36
  134. package/SVF-doxygen/html/search/enumvalues_3.js +13 -13
  135. package/SVF-doxygen/html/search/enumvalues_4.js +2 -2
  136. package/SVF-doxygen/html/search/enumvalues_5.js +50 -50
  137. package/SVF-doxygen/html/search/enumvalues_6.js +6 -6
  138. package/SVF-doxygen/html/search/enumvalues_7.js +8 -8
  139. package/SVF-doxygen/html/search/enumvalues_8.js +24 -24
  140. package/SVF-doxygen/html/search/enumvalues_9.js +6 -6
  141. package/SVF-doxygen/html/search/enumvalues_a.js +17 -17
  142. package/SVF-doxygen/html/search/enumvalues_b.js +11 -11
  143. package/SVF-doxygen/html/search/enumvalues_c.js +5 -5
  144. package/SVF-doxygen/html/search/enumvalues_d.js +19 -19
  145. package/SVF-doxygen/html/search/enumvalues_e.js +9 -9
  146. package/SVF-doxygen/html/search/enumvalues_f.js +48 -48
  147. package/SVF-doxygen/html/search/files_0.js +18 -18
  148. package/SVF-doxygen/html/search/files_1.js +9 -9
  149. package/SVF-doxygen/html/search/files_10.js +8 -8
  150. package/SVF-doxygen/html/search/files_11.js +8 -8
  151. package/SVF-doxygen/html/search/files_12.js +2 -2
  152. package/SVF-doxygen/html/search/files_2.js +51 -51
  153. package/SVF-doxygen/html/search/files_3.js +14 -14
  154. package/SVF-doxygen/html/search/files_4.js +3 -3
  155. package/SVF-doxygen/html/search/files_5.js +13 -13
  156. package/SVF-doxygen/html/search/files_6.js +10 -10
  157. package/SVF-doxygen/html/search/files_7.js +15 -15
  158. package/SVF-doxygen/html/search/files_8.js +13 -13
  159. package/SVF-doxygen/html/search/files_9.js +18 -18
  160. package/SVF-doxygen/html/search/files_a.js +3 -3
  161. package/SVF-doxygen/html/search/files_b.js +4 -4
  162. package/SVF-doxygen/html/search/files_c.js +20 -20
  163. package/SVF-doxygen/html/search/files_d.js +4 -4
  164. package/SVF-doxygen/html/search/files_e.js +56 -57
  165. package/SVF-doxygen/html/search/files_f.js +8 -8
  166. package/SVF-doxygen/html/search/functions_0.js +13 -13
  167. package/SVF-doxygen/html/search/functions_1.js +366 -366
  168. package/SVF-doxygen/html/search/functions_10.js +140 -140
  169. package/SVF-doxygen/html/search/functions_11.js +140 -140
  170. package/SVF-doxygen/html/search/functions_12.js +291 -293
  171. package/SVF-doxygen/html/search/functions_13.js +52 -52
  172. package/SVF-doxygen/html/search/functions_14.js +41 -41
  173. package/SVF-doxygen/html/search/functions_15.js +70 -70
  174. package/SVF-doxygen/html/search/functions_16.js +38 -38
  175. package/SVF-doxygen/html/search/functions_17.js +3 -3
  176. package/SVF-doxygen/html/search/functions_18.js +174 -174
  177. package/SVF-doxygen/html/search/functions_2.js +92 -92
  178. package/SVF-doxygen/html/search/functions_3.js +257 -257
  179. package/SVF-doxygen/html/search/functions_4.js +85 -85
  180. package/SVF-doxygen/html/search/functions_5.js +54 -54
  181. package/SVF-doxygen/html/search/functions_6.js +65 -65
  182. package/SVF-doxygen/html/search/functions_7.js +857 -857
  183. package/SVF-doxygen/html/search/functions_8.js +164 -176
  184. package/SVF-doxygen/html/search/functions_9.js +439 -436
  185. package/SVF-doxygen/html/search/functions_a.js +30 -30
  186. package/SVF-doxygen/html/search/functions_b.js +2 -2
  187. package/SVF-doxygen/html/search/functions_c.js +22 -22
  188. package/SVF-doxygen/html/search/functions_d.js +81 -81
  189. package/SVF-doxygen/html/search/functions_e.js +34 -34
  190. package/SVF-doxygen/html/search/functions_f.js +58 -58
  191. package/SVF-doxygen/html/search/namespaces_0.js +1 -1
  192. package/SVF-doxygen/html/search/namespaces_1.js +7 -7
  193. package/SVF-doxygen/html/search/related_0.js +4 -4
  194. package/SVF-doxygen/html/search/related_1.js +2 -2
  195. package/SVF-doxygen/html/search/related_2.js +2 -2
  196. package/SVF-doxygen/html/search/related_3.js +2 -2
  197. package/SVF-doxygen/html/search/related_4.js +2 -2
  198. package/SVF-doxygen/html/search/related_5.js +1 -1
  199. package/SVF-doxygen/html/search/related_6.js +2 -2
  200. package/SVF-doxygen/html/search/related_7.js +5 -5
  201. package/SVF-doxygen/html/search/related_8.js +2 -2
  202. package/SVF-doxygen/html/search/related_9.js +4 -4
  203. package/SVF-doxygen/html/search/related_a.js +19 -19
  204. package/SVF-doxygen/html/search/related_b.js +4 -4
  205. package/SVF-doxygen/html/search/related_c.js +2 -2
  206. package/SVF-doxygen/html/search/related_d.js +11 -11
  207. package/SVF-doxygen/html/search/related_e.js +2 -2
  208. package/SVF-doxygen/html/search/related_f.js +2 -2
  209. package/SVF-doxygen/html/search/typedefs_0.js +20 -20
  210. package/SVF-doxygen/html/search/typedefs_1.js +27 -27
  211. package/SVF-doxygen/html/search/typedefs_10.js +65 -65
  212. package/SVF-doxygen/html/search/typedefs_11.js +12 -12
  213. package/SVF-doxygen/html/search/typedefs_12.js +13 -13
  214. package/SVF-doxygen/html/search/typedefs_13.js +40 -40
  215. package/SVF-doxygen/html/search/typedefs_14.js +11 -11
  216. package/SVF-doxygen/html/search/typedefs_2.js +125 -125
  217. package/SVF-doxygen/html/search/typedefs_3.js +39 -39
  218. package/SVF-doxygen/html/search/typedefs_4.js +17 -17
  219. package/SVF-doxygen/html/search/typedefs_5.js +42 -42
  220. package/SVF-doxygen/html/search/typedefs_6.js +54 -54
  221. package/SVF-doxygen/html/search/typedefs_7.js +47 -47
  222. package/SVF-doxygen/html/search/typedefs_8.js +1 -1
  223. package/SVF-doxygen/html/search/typedefs_9.js +4 -4
  224. package/SVF-doxygen/html/search/typedefs_a.js +28 -28
  225. package/SVF-doxygen/html/search/typedefs_b.js +29 -29
  226. package/SVF-doxygen/html/search/typedefs_c.js +41 -41
  227. package/SVF-doxygen/html/search/typedefs_d.js +15 -15
  228. package/SVF-doxygen/html/search/typedefs_e.js +52 -52
  229. package/SVF-doxygen/html/search/typedefs_f.js +14 -14
  230. package/SVF-doxygen/html/search/variables_0.js +169 -170
  231. package/SVF-doxygen/html/search/variables_1.js +78 -78
  232. package/SVF-doxygen/html/search/variables_10.js +98 -98
  233. package/SVF-doxygen/html/search/variables_11.js +47 -47
  234. package/SVF-doxygen/html/search/variables_12.js +93 -93
  235. package/SVF-doxygen/html/search/variables_13.js +76 -76
  236. package/SVF-doxygen/html/search/variables_14.js +14 -14
  237. package/SVF-doxygen/html/search/variables_15.js +49 -49
  238. package/SVF-doxygen/html/search/variables_16.js +11 -11
  239. package/SVF-doxygen/html/search/variables_17.js +1 -1
  240. package/SVF-doxygen/html/search/variables_18.js +17 -17
  241. package/SVF-doxygen/html/search/variables_2.js +40 -40
  242. package/SVF-doxygen/html/search/variables_3.js +143 -143
  243. package/SVF-doxygen/html/search/variables_4.js +51 -51
  244. package/SVF-doxygen/html/search/variables_5.js +39 -39
  245. package/SVF-doxygen/html/search/variables_6.js +66 -66
  246. package/SVF-doxygen/html/search/variables_7.js +32 -32
  247. package/SVF-doxygen/html/search/variables_8.js +8 -8
  248. package/SVF-doxygen/html/search/variables_9.js +80 -80
  249. package/SVF-doxygen/html/search/variables_a.js +4 -4
  250. package/SVF-doxygen/html/search/variables_b.js +10 -10
  251. package/SVF-doxygen/html/search/variables_c.js +44 -44
  252. package/SVF-doxygen/html/search/variables_d.js +58 -58
  253. package/SVF-doxygen/html/search/variables_e.js +123 -123
  254. package/SVF-doxygen/html/search/variables_f.js +31 -31
  255. package/SVF-doxygen/html/svf-ex_8cpp.html +199 -197
  256. package/SVF-doxygen/html/svf-ex_8cpp_source.html +204 -202
  257. package/package.json +1 -1
  258. package/svf/include/AE/Svfexe/AbstractInterpretation.h +28 -21
  259. package/svf/include/AE/Svfexe/SVFIR2AbsState.h +37 -67
  260. package/svf/lib/AE/Svfexe/AbstractInterpretation.cpp +153 -169
  261. package/svf/lib/AE/Svfexe/BufOverflowChecker.cpp +64 -54
  262. package/svf/lib/AE/Svfexe/SVFIR2AbsState.cpp +134 -146
  263. package/svf-llvm/tools/Example/svf-ex.cpp +13 -12
  264. package/svf/lib/AE/Core/SVFIR2Relation.cpp +0 -193
package/SVF-doxygen/html/BufOverflowChecker_8cpp_source.html CHANGED
@@ -133,801 +133,811 @@ $(function() {
133
133
  <div class="line"><a name="l00062"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#a0b79c3694a08100d2d8d1b8109998131"> 62</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0b79c3694a08100d2d8d1b8109998131">BufOverflowChecker::handleSVFStatement</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFStmt.html">SVFStmt</a> *stmt)</div>
134
134
  <div class="line"><a name="l00063"></a><span class="lineno"> 63</span>&#160;{</div>
135
135
  <div class="line"><a name="l00064"></a><span class="lineno"> 64</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a896d04a02951947bc228bf97b2c00313">AbstractInterpretation::handleSVFStatement</a>(stmt);</div>
136
- <div class="line"><a name="l00065"></a><span class="lineno"> 65</span>&#160; <span class="comment">// for gep stmt, add the gep stmt to the addrToGep map</span></div>
137
- <div class="line"><a name="l00066"></a><span class="lineno"> 66</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1GepStmt.html">GepStmt</a> *gep = SVFUtil::dyn_cast&lt;GepStmt&gt;(stmt))</div>
138
- <div class="line"><a name="l00067"></a><span class="lineno"> 67</span>&#160; {</div>
139
- <div class="line"><a name="l00068"></a><span class="lineno"> 68</span>&#160; <span class="keywordflow">for</span> (<a class="code" href="namespaceSVF.html#a43a65e0d33af3c743294f7a1139d2301">NodeID</a> addrID:</div>
140
- <div class="line"><a name="l00069"></a><span class="lineno"> 69</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#aa3e62b9ef912def502b95992199f5d8c">getAddrs</a>(gep-&gt;getLHSVarID()).<a class="code" href="structSVF_1_1AbstractValue.html#ab1fe6a57f784971b3bc603dbfda746e8">getAddrs</a>())</div>
141
- <div class="line"><a name="l00070"></a><span class="lineno"> 70</span>&#160; {</div>
142
- <div class="line"><a name="l00071"></a><span class="lineno"> 71</span>&#160; <a class="code" href="namespaceSVF.html#a43a65e0d33af3c743294f7a1139d2301">NodeID</a> objId = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#ac37760566b534d89a61d789b00efb993">getInternalID</a>(addrID);</div>
143
- <div class="line"><a name="l00072"></a><span class="lineno"> 72</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>[objId] = gep;</div>
144
- <div class="line"><a name="l00073"></a><span class="lineno"> 73</span>&#160; }</div>
145
- <div class="line"><a name="l00074"></a><span class="lineno"> 74</span>&#160; }</div>
146
- <div class="line"><a name="l00075"></a><span class="lineno"> 75</span>&#160;}</div>
147
- <div class="line"><a name="l00076"></a><span class="lineno"> 76</span>&#160; </div>
148
- <div class="line"><a name="l00077"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#aed959fce840cbea32d3567ee1ac01e82"> 77</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#aed959fce840cbea32d3567ee1ac01e82">BufOverflowChecker::initExtAPIBufOverflowCheckRules</a>()</div>
149
- <div class="line"><a name="l00078"></a><span class="lineno"> 78</span>&#160;{</div>
150
- <div class="line"><a name="l00079"></a><span class="lineno"> 79</span>&#160; <span class="comment">//void llvm_memcpy_p0i8_p0i8_i64(char* dst, char* src, int sz, int flag){}</span></div>
151
- <div class="line"><a name="l00080"></a><span class="lineno"> 80</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memcpy_p0i8_p0i8_i64&quot;</span>] = {{0, 2}, {1,2}};</div>
152
- <div class="line"><a name="l00081"></a><span class="lineno"> 81</span>&#160; <span class="comment">//void llvm_memcpy_p0_p0_i64(char* dst, char* src, int sz, int flag){}</span></div>
153
- <div class="line"><a name="l00082"></a><span class="lineno"> 82</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memcpy_p0_p0_i64&quot;</span>] = {{0, 2}, {1,2}};</div>
154
- <div class="line"><a name="l00083"></a><span class="lineno"> 83</span>&#160; <span class="comment">//void llvm_memcpy_p0i8_p0i8_i32(char* dst, char* src, int sz, int flag){}</span></div>
155
- <div class="line"><a name="l00084"></a><span class="lineno"> 84</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memcpy_p0i8_p0i8_i32&quot;</span>] = {{0, 2}, {1,2}};</div>
156
- <div class="line"><a name="l00085"></a><span class="lineno"> 85</span>&#160; <span class="comment">//void llvm_memcpy(char* dst, char* src, int sz, int flag){}</span></div>
157
- <div class="line"><a name="l00086"></a><span class="lineno"> 86</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memcpy&quot;</span>] = {{0, 2}, {1,2}};</div>
158
- <div class="line"><a name="l00087"></a><span class="lineno"> 87</span>&#160; <span class="comment">//void llvm_memmove(char* dst, char* src, int sz, int flag){}</span></div>
159
- <div class="line"><a name="l00088"></a><span class="lineno"> 88</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memmove&quot;</span>] = {{0, 2}, {1,2}};</div>
160
- <div class="line"><a name="l00089"></a><span class="lineno"> 89</span>&#160; <span class="comment">//void llvm_memmove_p0i8_p0i8_i64(char* dst, char* src, int sz, int flag){}</span></div>
161
- <div class="line"><a name="l00090"></a><span class="lineno"> 90</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memmove_p0i8_p0i8_i64&quot;</span>] = {{0, 2}, {1,2}};</div>
162
- <div class="line"><a name="l00091"></a><span class="lineno"> 91</span>&#160; <span class="comment">//void llvm_memmove_p0_p0_i64(char* dst, char* src, int sz, int flag){}</span></div>
163
- <div class="line"><a name="l00092"></a><span class="lineno"> 92</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memmove_p0_p0_i64&quot;</span>] = {{0, 2}, {1,2}};</div>
164
- <div class="line"><a name="l00093"></a><span class="lineno"> 93</span>&#160; <span class="comment">//void llvm_memmove_p0i8_p0i8_i32(char* dst, char* src, int sz, int flag){}</span></div>
165
- <div class="line"><a name="l00094"></a><span class="lineno"> 94</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memmove_p0i8_p0i8_i32&quot;</span>] = {{0, 2}, {1,2}};</div>
166
- <div class="line"><a name="l00095"></a><span class="lineno"> 95</span>&#160; <span class="comment">//void __memcpy_chk(char* dst, char* src, int sz, int flag){}</span></div>
167
- <div class="line"><a name="l00096"></a><span class="lineno"> 96</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;__memcpy_chk&quot;</span>] = {{0, 2}, {1,2}};</div>
168
- <div class="line"><a name="l00097"></a><span class="lineno"> 97</span>&#160; <span class="comment">//void *memmove(void *str1, const void *str2, unsigned long n)</span></div>
169
- <div class="line"><a name="l00098"></a><span class="lineno"> 98</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;memmove&quot;</span>] = {{0, 2}, {1,2}};</div>
170
- <div class="line"><a name="l00099"></a><span class="lineno"> 99</span>&#160; <span class="comment">//void bcopy(const void *s1, void *s2, unsigned long n){}</span></div>
171
- <div class="line"><a name="l00100"></a><span class="lineno"> 100</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;bcopy&quot;</span>] = {{0, 2}, {1,2}};</div>
172
- <div class="line"><a name="l00101"></a><span class="lineno"> 101</span>&#160; <span class="comment">//void *memccpy( void * restrict dest, const void * restrict src, int c, unsigned long count)</span></div>
173
- <div class="line"><a name="l00102"></a><span class="lineno"> 102</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;memccpy&quot;</span>] = {{0, 3}, {1,3}};</div>
174
- <div class="line"><a name="l00103"></a><span class="lineno"> 103</span>&#160; <span class="comment">//void __memmove_chk(char* dst, char* src, int sz){}</span></div>
175
- <div class="line"><a name="l00104"></a><span class="lineno"> 104</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;__memmove_chk&quot;</span>] = {{0, 2}, {1,2}};</div>
176
- <div class="line"><a name="l00105"></a><span class="lineno"> 105</span>&#160; <span class="comment">//void llvm_memset(char* dst, char elem, int sz, int flag){}</span></div>
177
- <div class="line"><a name="l00106"></a><span class="lineno"> 106</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memset&quot;</span>] = {{0, 2}};</div>
178
- <div class="line"><a name="l00107"></a><span class="lineno"> 107</span>&#160; <span class="comment">//void llvm_memset_p0i8_i32(char* dst, char elem, int sz, int flag){}</span></div>
179
- <div class="line"><a name="l00108"></a><span class="lineno"> 108</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memset_p0i8_i32&quot;</span>] = {{0, 2}};</div>
180
- <div class="line"><a name="l00109"></a><span class="lineno"> 109</span>&#160; <span class="comment">//void llvm_memset_p0i8_i64(char* dst, char elem, int sz, int flag){}</span></div>
181
- <div class="line"><a name="l00110"></a><span class="lineno"> 110</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memset_p0i8_i64&quot;</span>] = {{0, 2}};</div>
182
- <div class="line"><a name="l00111"></a><span class="lineno"> 111</span>&#160; <span class="comment">//void llvm_memset_p0_i64(char* dst, char elem, int sz, int flag){}</span></div>
183
- <div class="line"><a name="l00112"></a><span class="lineno"> 112</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memset_p0_i64&quot;</span>] = {{0, 2}};</div>
184
- <div class="line"><a name="l00113"></a><span class="lineno"> 113</span>&#160; <span class="comment">//char *__memset_chk(char * dest, int c, unsigned long destlen, int flag)</span></div>
185
- <div class="line"><a name="l00114"></a><span class="lineno"> 114</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;__memset_chk&quot;</span>] = {{0, 2}};</div>
186
- <div class="line"><a name="l00115"></a><span class="lineno"> 115</span>&#160; <span class="comment">//char *wmemset(wchar_t * dst, wchar_t elem, int sz, int flag) {</span></div>
187
- <div class="line"><a name="l00116"></a><span class="lineno"> 116</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;wmemset&quot;</span>] = {{0, 2}};</div>
188
- <div class="line"><a name="l00117"></a><span class="lineno"> 117</span>&#160; <span class="comment">//char *strncpy(char *dest, const char *src, unsigned long n)</span></div>
189
- <div class="line"><a name="l00118"></a><span class="lineno"> 118</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;strncpy&quot;</span>] = {{0, 2}, {1,2}};</div>
190
- <div class="line"><a name="l00119"></a><span class="lineno"> 119</span>&#160; <span class="comment">//unsigned long iconv(void* cd, char **restrict inbuf, unsigned long *restrict inbytesleft, char **restrict outbuf, unsigned long *restrict outbytesleft)</span></div>
191
- <div class="line"><a name="l00120"></a><span class="lineno"> 120</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;iconv&quot;</span>] = {{1, 2}, {3, 4}};</div>
192
- <div class="line"><a name="l00121"></a><span class="lineno"> 121</span>&#160;}</div>
193
- <div class="line"><a name="l00122"></a><span class="lineno"> 122</span>&#160; </div>
136
+ <div class="line"><a name="l00065"></a><span class="lineno"> 65</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp; as = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a57e4ee3fde79c408dffe98894210d7c9">getAbsState</a>(stmt-&gt;<a class="code" href="classSVF_1_1SVFStmt.html#aa809a57c8cdaaa35dfc3cc0f3b33b52b">getICFGNode</a>());</div>
137
+ <div class="line"><a name="l00066"></a><span class="lineno"> 66</span>&#160; <span class="comment">// for gep stmt, add the gep stmt to the addrToGep map</span></div>
138
+ <div class="line"><a name="l00067"></a><span class="lineno"> 67</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1GepStmt.html">GepStmt</a> *gep = SVFUtil::dyn_cast&lt;GepStmt&gt;(stmt))</div>
139
+ <div class="line"><a name="l00068"></a><span class="lineno"> 68</span>&#160; {</div>
140
+ <div class="line"><a name="l00069"></a><span class="lineno"> 69</span>&#160; <span class="keywordflow">for</span> (<a class="code" href="namespaceSVF.html#a43a65e0d33af3c743294f7a1139d2301">NodeID</a> addrID:</div>
141
+ <div class="line"><a name="l00070"></a><span class="lineno"> 70</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a611ac228efd661b301ea1dd675cd1c0c">getAddrs</a>(as, gep-&gt;getLHSVarID()).<a class="code" href="structSVF_1_1AbstractValue.html#ab1fe6a57f784971b3bc603dbfda746e8">getAddrs</a>())</div>
142
+ <div class="line"><a name="l00071"></a><span class="lineno"> 71</span>&#160; {</div>
143
+ <div class="line"><a name="l00072"></a><span class="lineno"> 72</span>&#160; <a class="code" href="namespaceSVF.html#a43a65e0d33af3c743294f7a1139d2301">NodeID</a> objId = <a class="code" href="classSVF_1_1AbstractState.html#aaabe5850dbf1620c6058f5ac6cb169b6">AbstractState::getInternalID</a>(addrID);</div>
144
+ <div class="line"><a name="l00073"></a><span class="lineno"> 73</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>[objId] = gep;</div>
145
+ <div class="line"><a name="l00074"></a><span class="lineno"> 74</span>&#160; }</div>
146
+ <div class="line"><a name="l00075"></a><span class="lineno"> 75</span>&#160; }</div>
147
+ <div class="line"><a name="l00076"></a><span class="lineno"> 76</span>&#160;}</div>
148
+ <div class="line"><a name="l00077"></a><span class="lineno"> 77</span>&#160; </div>
149
+ <div class="line"><a name="l00078"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#aed959fce840cbea32d3567ee1ac01e82"> 78</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#aed959fce840cbea32d3567ee1ac01e82">BufOverflowChecker::initExtAPIBufOverflowCheckRules</a>()</div>
150
+ <div class="line"><a name="l00079"></a><span class="lineno"> 79</span>&#160;{</div>
151
+ <div class="line"><a name="l00080"></a><span class="lineno"> 80</span>&#160; <span class="comment">//void llvm_memcpy_p0i8_p0i8_i64(char* dst, char* src, int sz, int flag){}</span></div>
152
+ <div class="line"><a name="l00081"></a><span class="lineno"> 81</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memcpy_p0i8_p0i8_i64&quot;</span>] = {{0, 2}, {1,2}};</div>
153
+ <div class="line"><a name="l00082"></a><span class="lineno"> 82</span>&#160; <span class="comment">//void llvm_memcpy_p0_p0_i64(char* dst, char* src, int sz, int flag){}</span></div>
154
+ <div class="line"><a name="l00083"></a><span class="lineno"> 83</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memcpy_p0_p0_i64&quot;</span>] = {{0, 2}, {1,2}};</div>
155
+ <div class="line"><a name="l00084"></a><span class="lineno"> 84</span>&#160; <span class="comment">//void llvm_memcpy_p0i8_p0i8_i32(char* dst, char* src, int sz, int flag){}</span></div>
156
+ <div class="line"><a name="l00085"></a><span class="lineno"> 85</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memcpy_p0i8_p0i8_i32&quot;</span>] = {{0, 2}, {1,2}};</div>
157
+ <div class="line"><a name="l00086"></a><span class="lineno"> 86</span>&#160; <span class="comment">//void llvm_memcpy(char* dst, char* src, int sz, int flag){}</span></div>
158
+ <div class="line"><a name="l00087"></a><span class="lineno"> 87</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memcpy&quot;</span>] = {{0, 2}, {1,2}};</div>
159
+ <div class="line"><a name="l00088"></a><span class="lineno"> 88</span>&#160; <span class="comment">//void llvm_memmove(char* dst, char* src, int sz, int flag){}</span></div>
160
+ <div class="line"><a name="l00089"></a><span class="lineno"> 89</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memmove&quot;</span>] = {{0, 2}, {1,2}};</div>
161
+ <div class="line"><a name="l00090"></a><span class="lineno"> 90</span>&#160; <span class="comment">//void llvm_memmove_p0i8_p0i8_i64(char* dst, char* src, int sz, int flag){}</span></div>
162
+ <div class="line"><a name="l00091"></a><span class="lineno"> 91</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memmove_p0i8_p0i8_i64&quot;</span>] = {{0, 2}, {1,2}};</div>
163
+ <div class="line"><a name="l00092"></a><span class="lineno"> 92</span>&#160; <span class="comment">//void llvm_memmove_p0_p0_i64(char* dst, char* src, int sz, int flag){}</span></div>
164
+ <div class="line"><a name="l00093"></a><span class="lineno"> 93</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memmove_p0_p0_i64&quot;</span>] = {{0, 2}, {1,2}};</div>
165
+ <div class="line"><a name="l00094"></a><span class="lineno"> 94</span>&#160; <span class="comment">//void llvm_memmove_p0i8_p0i8_i32(char* dst, char* src, int sz, int flag){}</span></div>
166
+ <div class="line"><a name="l00095"></a><span class="lineno"> 95</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memmove_p0i8_p0i8_i32&quot;</span>] = {{0, 2}, {1,2}};</div>
167
+ <div class="line"><a name="l00096"></a><span class="lineno"> 96</span>&#160; <span class="comment">//void __memcpy_chk(char* dst, char* src, int sz, int flag){}</span></div>
168
+ <div class="line"><a name="l00097"></a><span class="lineno"> 97</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;__memcpy_chk&quot;</span>] = {{0, 2}, {1,2}};</div>
169
+ <div class="line"><a name="l00098"></a><span class="lineno"> 98</span>&#160; <span class="comment">//void *memmove(void *str1, const void *str2, unsigned long n)</span></div>
170
+ <div class="line"><a name="l00099"></a><span class="lineno"> 99</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;memmove&quot;</span>] = {{0, 2}, {1,2}};</div>
171
+ <div class="line"><a name="l00100"></a><span class="lineno"> 100</span>&#160; <span class="comment">//void bcopy(const void *s1, void *s2, unsigned long n){}</span></div>
172
+ <div class="line"><a name="l00101"></a><span class="lineno"> 101</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;bcopy&quot;</span>] = {{0, 2}, {1,2}};</div>
173
+ <div class="line"><a name="l00102"></a><span class="lineno"> 102</span>&#160; <span class="comment">//void *memccpy( void * restrict dest, const void * restrict src, int c, unsigned long count)</span></div>
174
+ <div class="line"><a name="l00103"></a><span class="lineno"> 103</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;memccpy&quot;</span>] = {{0, 3}, {1,3}};</div>
175
+ <div class="line"><a name="l00104"></a><span class="lineno"> 104</span>&#160; <span class="comment">//void __memmove_chk(char* dst, char* src, int sz){}</span></div>
176
+ <div class="line"><a name="l00105"></a><span class="lineno"> 105</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;__memmove_chk&quot;</span>] = {{0, 2}, {1,2}};</div>
177
+ <div class="line"><a name="l00106"></a><span class="lineno"> 106</span>&#160; <span class="comment">//void llvm_memset(char* dst, char elem, int sz, int flag){}</span></div>
178
+ <div class="line"><a name="l00107"></a><span class="lineno"> 107</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memset&quot;</span>] = {{0, 2}};</div>
179
+ <div class="line"><a name="l00108"></a><span class="lineno"> 108</span>&#160; <span class="comment">//void llvm_memset_p0i8_i32(char* dst, char elem, int sz, int flag){}</span></div>
180
+ <div class="line"><a name="l00109"></a><span class="lineno"> 109</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memset_p0i8_i32&quot;</span>] = {{0, 2}};</div>
181
+ <div class="line"><a name="l00110"></a><span class="lineno"> 110</span>&#160; <span class="comment">//void llvm_memset_p0i8_i64(char* dst, char elem, int sz, int flag){}</span></div>
182
+ <div class="line"><a name="l00111"></a><span class="lineno"> 111</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memset_p0i8_i64&quot;</span>] = {{0, 2}};</div>
183
+ <div class="line"><a name="l00112"></a><span class="lineno"> 112</span>&#160; <span class="comment">//void llvm_memset_p0_i64(char* dst, char elem, int sz, int flag){}</span></div>
184
+ <div class="line"><a name="l00113"></a><span class="lineno"> 113</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;llvm_memset_p0_i64&quot;</span>] = {{0, 2}};</div>
185
+ <div class="line"><a name="l00114"></a><span class="lineno"> 114</span>&#160; <span class="comment">//char *__memset_chk(char * dest, int c, unsigned long destlen, int flag)</span></div>
186
+ <div class="line"><a name="l00115"></a><span class="lineno"> 115</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;__memset_chk&quot;</span>] = {{0, 2}};</div>
187
+ <div class="line"><a name="l00116"></a><span class="lineno"> 116</span>&#160; <span class="comment">//char *wmemset(wchar_t * dst, wchar_t elem, int sz, int flag) {</span></div>
188
+ <div class="line"><a name="l00117"></a><span class="lineno"> 117</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;wmemset&quot;</span>] = {{0, 2}};</div>
189
+ <div class="line"><a name="l00118"></a><span class="lineno"> 118</span>&#160; <span class="comment">//char *strncpy(char *dest, const char *src, unsigned long n)</span></div>
190
+ <div class="line"><a name="l00119"></a><span class="lineno"> 119</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;strncpy&quot;</span>] = {{0, 2}, {1,2}};</div>
191
+ <div class="line"><a name="l00120"></a><span class="lineno"> 120</span>&#160; <span class="comment">//unsigned long iconv(void* cd, char **restrict inbuf, unsigned long *restrict inbytesleft, char **restrict outbuf, unsigned long *restrict outbytesleft)</span></div>
192
+ <div class="line"><a name="l00121"></a><span class="lineno"> 121</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>[<span class="stringliteral">&quot;iconv&quot;</span>] = {{1, 2}, {3, 4}};</div>
193
+ <div class="line"><a name="l00122"></a><span class="lineno"> 122</span>&#160;}</div>
194
194
  <div class="line"><a name="l00123"></a><span class="lineno"> 123</span>&#160; </div>
195
- <div class="line"><a name="l00124"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#ad8b2f2fa6f22b9d1655135c819cbad8a"> 124</a></span>&#160;<span class="keywordtype">bool</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad8b2f2fa6f22b9d1655135c819cbad8a">BufOverflowChecker::detectStrcpy</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a> *call)</div>
196
- <div class="line"><a name="l00125"></a><span class="lineno"> 125</span>&#160;{</div>
197
- <div class="line"><a name="l00126"></a><span class="lineno"> 126</span>&#160; <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> cs = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a9815a5b31ac7dc21239d08e5b9f61106">SVFUtil::getSVFCallSite</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
198
- <div class="line"><a name="l00127"></a><span class="lineno"> 127</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg0Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(0);</div>
199
- <div class="line"><a name="l00128"></a><span class="lineno"> 128</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg1Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(1);</div>
200
- <div class="line"><a name="l00129"></a><span class="lineno"> 129</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> strLen = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a5bba3c0570d73acc743742a30af1b0b4">getStrlen</a>(arg1Val);</div>
201
- <div class="line"><a name="l00130"></a><span class="lineno"> 130</span>&#160; <span class="comment">// no need to -1, since it has \0 as the last byte</span></div>
202
- <div class="line"><a name="l00131"></a><span class="lineno"> 131</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(arg0Val, strLen, call);</div>
203
- <div class="line"><a name="l00132"></a><span class="lineno"> 132</span>&#160;}</div>
204
- <div class="line"><a name="l00133"></a><span class="lineno"> 133</span>&#160; </div>
205
- <div class="line"><a name="l00134"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#af0e2276001df7d51c45b22d5d11ca09b"> 134</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#af0e2276001df7d51c45b22d5d11ca09b">BufOverflowChecker::initExtFunMap</a>()</div>
206
- <div class="line"><a name="l00135"></a><span class="lineno"> 135</span>&#160;{</div>
207
- <div class="line"><a name="l00136"></a><span class="lineno"> 136</span>&#160; </div>
208
- <div class="line"><a name="l00137"></a><span class="lineno"> 137</span>&#160; <span class="keyword">auto</span> sse_scanf = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
209
- <div class="line"><a name="l00138"></a><span class="lineno"> 138</span>&#160; {</div>
210
- <div class="line"><a name="l00139"></a><span class="lineno"> 139</span>&#160; <span class="comment">//scanf(&quot;%d&quot;, &amp;data);</span></div>
211
- <div class="line"><a name="l00140"></a><span class="lineno"> 140</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 2) <span class="keywordflow">return</span>;</div>
212
- <div class="line"><a name="l00141"></a><span class="lineno"> 141</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>();</div>
213
- <div class="line"><a name="l00142"></a><span class="lineno"> 142</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> dst_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
214
- <div class="line"><a name="l00143"></a><span class="lineno"> 143</span>&#160; <span class="keywordflow">if</span> (!<a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a62baa9403069a9b1e010eaeb2f6b9b34">inVarToAddrsTable</a>(dst_id))</div>
215
- <div class="line"><a name="l00144"></a><span class="lineno"> 144</span>&#160; {</div>
216
- <div class="line"><a name="l00145"></a><span class="lineno"> 145</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<span class="stringliteral">&quot;scanf may cause buffer overflow.\n&quot;</span>, 0, 0, 0, 0, cs.getArgument(1));</div>
217
- <div class="line"><a name="l00146"></a><span class="lineno"> 146</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
218
- <div class="line"><a name="l00147"></a><span class="lineno"> 147</span>&#160; <span class="keywordflow">return</span>;</div>
219
- <div class="line"><a name="l00148"></a><span class="lineno"> 148</span>&#160; }</div>
220
- <div class="line"><a name="l00149"></a><span class="lineno"> 149</span>&#160; <span class="keywordflow">else</span></div>
221
- <div class="line"><a name="l00150"></a><span class="lineno"> 150</span>&#160; {</div>
222
- <div class="line"><a name="l00151"></a><span class="lineno"> 151</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> Addrs = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#aa3e62b9ef912def502b95992199f5d8c">getAddrs</a>(dst_id);</div>
223
- <div class="line"><a name="l00152"></a><span class="lineno"> 152</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> vaddr: Addrs.<a class="code" href="structSVF_1_1AbstractValue.html#ab1fe6a57f784971b3bc603dbfda746e8">getAddrs</a>())</div>
224
- <div class="line"><a name="l00153"></a><span class="lineno"> 153</span>&#160; {</div>
225
- <div class="line"><a name="l00154"></a><span class="lineno"> 154</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> objId = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#ac37760566b534d89a61d789b00efb993">getInternalID</a>(vaddr);</div>
226
- <div class="line"><a name="l00155"></a><span class="lineno"> 155</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> range = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a4e032a5e0898f0e349927d5a86c8477c">getRangeLimitFromType</a>(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1GenericGraph.html#a43c9c773bfa17abf481c33073e30d01b">getGNode</a>(objId)-&gt;<a class="code" href="classSVF_1_1SVFVar.html#ab6f95d3e7e099d75cfc9645ebc037047">getType</a>());</div>
227
- <div class="line"><a name="l00156"></a><span class="lineno"> 156</span>&#160; es.<a class="code" href="classSVF_1_1AbstractState.html#a1f935ea8ab16b04699284bf92bbbb23c">store</a>(vaddr, range);</div>
228
- <div class="line"><a name="l00157"></a><span class="lineno"> 157</span>&#160; }</div>
229
- <div class="line"><a name="l00158"></a><span class="lineno"> 158</span>&#160; }</div>
230
- <div class="line"><a name="l00159"></a><span class="lineno"> 159</span>&#160; };</div>
231
- <div class="line"><a name="l00160"></a><span class="lineno"> 160</span>&#160; <span class="keyword">auto</span> sse_fscanf = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
232
- <div class="line"><a name="l00161"></a><span class="lineno"> 161</span>&#160; {</div>
233
- <div class="line"><a name="l00162"></a><span class="lineno"> 162</span>&#160; <span class="comment">//fscanf(stdin, &quot;%d&quot;, &amp;data);</span></div>
234
- <div class="line"><a name="l00163"></a><span class="lineno"> 163</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 3) <span class="keywordflow">return</span>;</div>
235
- <div class="line"><a name="l00164"></a><span class="lineno"> 164</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>();</div>
236
- <div class="line"><a name="l00165"></a><span class="lineno"> 165</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> dst_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(2));</div>
237
- <div class="line"><a name="l00166"></a><span class="lineno"> 166</span>&#160; <span class="keywordflow">if</span> (!<a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a62baa9403069a9b1e010eaeb2f6b9b34">inVarToAddrsTable</a>(dst_id))</div>
238
- <div class="line"><a name="l00167"></a><span class="lineno"> 167</span>&#160; {</div>
239
- <div class="line"><a name="l00168"></a><span class="lineno"> 168</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<span class="stringliteral">&quot;scanf may cause buffer overflow.\n&quot;</span>, 0, 0, 0, 0, cs.getArgument(2));</div>
240
- <div class="line"><a name="l00169"></a><span class="lineno"> 169</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
241
- <div class="line"><a name="l00170"></a><span class="lineno"> 170</span>&#160; <span class="keywordflow">return</span>;</div>
242
- <div class="line"><a name="l00171"></a><span class="lineno"> 171</span>&#160; }</div>
243
- <div class="line"><a name="l00172"></a><span class="lineno"> 172</span>&#160; <span class="keywordflow">else</span></div>
244
- <div class="line"><a name="l00173"></a><span class="lineno"> 173</span>&#160; {</div>
245
- <div class="line"><a name="l00174"></a><span class="lineno"> 174</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> Addrs = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#aa3e62b9ef912def502b95992199f5d8c">getAddrs</a>(dst_id);</div>
246
- <div class="line"><a name="l00175"></a><span class="lineno"> 175</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> vaddr: Addrs.<a class="code" href="structSVF_1_1AbstractValue.html#ab1fe6a57f784971b3bc603dbfda746e8">getAddrs</a>())</div>
247
- <div class="line"><a name="l00176"></a><span class="lineno"> 176</span>&#160; {</div>
248
- <div class="line"><a name="l00177"></a><span class="lineno"> 177</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> objId = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#ac37760566b534d89a61d789b00efb993">getInternalID</a>(vaddr);</div>
249
- <div class="line"><a name="l00178"></a><span class="lineno"> 178</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> range = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a4e032a5e0898f0e349927d5a86c8477c">getRangeLimitFromType</a>(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1GenericGraph.html#a43c9c773bfa17abf481c33073e30d01b">getGNode</a>(objId)-&gt;<a class="code" href="classSVF_1_1SVFVar.html#ab6f95d3e7e099d75cfc9645ebc037047">getType</a>());</div>
250
- <div class="line"><a name="l00179"></a><span class="lineno"> 179</span>&#160; es.<a class="code" href="classSVF_1_1AbstractState.html#a1f935ea8ab16b04699284bf92bbbb23c">store</a>(vaddr, range);</div>
251
- <div class="line"><a name="l00180"></a><span class="lineno"> 180</span>&#160; }</div>
252
- <div class="line"><a name="l00181"></a><span class="lineno"> 181</span>&#160; }</div>
253
- <div class="line"><a name="l00182"></a><span class="lineno"> 182</span>&#160; };</div>
254
- <div class="line"><a name="l00183"></a><span class="lineno"> 183</span>&#160; </div>
255
- <div class="line"><a name="l00184"></a><span class="lineno"> 184</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__isoc99_fscanf&quot;</span>] = sse_fscanf;</div>
256
- <div class="line"><a name="l00185"></a><span class="lineno"> 185</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__isoc99_scanf&quot;</span>] = sse_scanf;</div>
257
- <div class="line"><a name="l00186"></a><span class="lineno"> 186</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__isoc99_vscanf&quot;</span>] = sse_scanf;</div>
258
- <div class="line"><a name="l00187"></a><span class="lineno"> 187</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;fscanf&quot;</span>] = sse_fscanf;</div>
259
- <div class="line"><a name="l00188"></a><span class="lineno"> 188</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;scanf&quot;</span>] = sse_scanf;</div>
260
- <div class="line"><a name="l00189"></a><span class="lineno"> 189</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;sscanf&quot;</span>] = sse_scanf;</div>
261
- <div class="line"><a name="l00190"></a><span class="lineno"> 190</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__isoc99_sscanf&quot;</span>] = sse_scanf;</div>
262
- <div class="line"><a name="l00191"></a><span class="lineno"> 191</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;vscanf&quot;</span>] = sse_scanf;</div>
263
- <div class="line"><a name="l00192"></a><span class="lineno"> 192</span>&#160; </div>
264
- <div class="line"><a name="l00193"></a><span class="lineno"> 193</span>&#160; <span class="keyword">auto</span> sse_fread = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
265
- <div class="line"><a name="l00194"></a><span class="lineno"> 194</span>&#160; {</div>
266
- <div class="line"><a name="l00195"></a><span class="lineno"> 195</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 3) <span class="keywordflow">return</span>;</div>
267
- <div class="line"><a name="l00196"></a><span class="lineno"> 196</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>();</div>
268
- <div class="line"><a name="l00197"></a><span class="lineno"> 197</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> block_count_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(2));</div>
269
- <div class="line"><a name="l00198"></a><span class="lineno"> 198</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> block_size_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
270
- <div class="line"><a name="l00199"></a><span class="lineno"> 199</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> block_count = es[block_count_id];</div>
271
- <div class="line"><a name="l00200"></a><span class="lineno"> 200</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> block_size = es[block_size_id];</div>
272
- <div class="line"><a name="l00201"></a><span class="lineno"> 201</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> block_byte = block_count * block_size;</div>
273
- <div class="line"><a name="l00202"></a><span class="lineno"> 202</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(0), block_byte, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
274
- <div class="line"><a name="l00203"></a><span class="lineno"> 203</span>&#160; };</div>
275
- <div class="line"><a name="l00204"></a><span class="lineno"> 204</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;fread&quot;</span>] = sse_fread;</div>
276
- <div class="line"><a name="l00205"></a><span class="lineno"> 205</span>&#160; </div>
277
- <div class="line"><a name="l00206"></a><span class="lineno"> 206</span>&#160; <span class="keyword">auto</span> sse_sprintf = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
278
- <div class="line"><a name="l00207"></a><span class="lineno"> 207</span>&#160; {</div>
279
- <div class="line"><a name="l00208"></a><span class="lineno"> 208</span>&#160; <span class="comment">// printf is difficult to predict since it has no byte size arguments</span></div>
195
+ <div class="line"><a name="l00124"></a><span class="lineno"> 124</span>&#160; </div>
196
+ <div class="line"><a name="l00125"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#ad8b2f2fa6f22b9d1655135c819cbad8a"> 125</a></span>&#160;<span class="keywordtype">bool</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad8b2f2fa6f22b9d1655135c819cbad8a">BufOverflowChecker::detectStrcpy</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a> *call)</div>
197
+ <div class="line"><a name="l00126"></a><span class="lineno"> 126</span>&#160;{</div>
198
+ <div class="line"><a name="l00127"></a><span class="lineno"> 127</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp; as = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a57e4ee3fde79c408dffe98894210d7c9">getAbsState</a>(call);</div>
199
+ <div class="line"><a name="l00128"></a><span class="lineno"> 128</span>&#160; <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> cs = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a9815a5b31ac7dc21239d08e5b9f61106">SVFUtil::getSVFCallSite</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
200
+ <div class="line"><a name="l00129"></a><span class="lineno"> 129</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg0Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(0);</div>
201
+ <div class="line"><a name="l00130"></a><span class="lineno"> 130</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg1Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(1);</div>
202
+ <div class="line"><a name="l00131"></a><span class="lineno"> 131</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> strLen = <a class="code" href="classSVF_1_1AbstractInterpretation.html#ab076eddb7908768126c190c23b91eb85">getStrlen</a>(as, arg1Val);</div>
203
+ <div class="line"><a name="l00132"></a><span class="lineno"> 132</span>&#160; <span class="comment">// no need to -1, since it has \0 as the last byte</span></div>
204
+ <div class="line"><a name="l00133"></a><span class="lineno"> 133</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(arg0Val, strLen, call);</div>
205
+ <div class="line"><a name="l00134"></a><span class="lineno"> 134</span>&#160;}</div>
206
+ <div class="line"><a name="l00135"></a><span class="lineno"> 135</span>&#160; </div>
207
+ <div class="line"><a name="l00136"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#af0e2276001df7d51c45b22d5d11ca09b"> 136</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#af0e2276001df7d51c45b22d5d11ca09b">BufOverflowChecker::initExtFunMap</a>()</div>
208
+ <div class="line"><a name="l00137"></a><span class="lineno"> 137</span>&#160;{</div>
209
+ <div class="line"><a name="l00138"></a><span class="lineno"> 138</span>&#160; </div>
210
+ <div class="line"><a name="l00139"></a><span class="lineno"> 139</span>&#160; <span class="keyword">auto</span> sse_scanf = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
211
+ <div class="line"><a name="l00140"></a><span class="lineno"> 140</span>&#160; {</div>
212
+ <div class="line"><a name="l00141"></a><span class="lineno"> 141</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
213
+ <div class="line"><a name="l00142"></a><span class="lineno"> 142</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp; as = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a57e4ee3fde79c408dffe98894210d7c9">getAbsState</a>(callNode);</div>
214
+ <div class="line"><a name="l00143"></a><span class="lineno"> 143</span>&#160; <span class="comment">//scanf(&quot;%d&quot;, &amp;data);</span></div>
215
+ <div class="line"><a name="l00144"></a><span class="lineno"> 144</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 2) <span class="keywordflow">return</span>;</div>
216
+ <div class="line"><a name="l00145"></a><span class="lineno"> 145</span>&#160; </div>
217
+ <div class="line"><a name="l00146"></a><span class="lineno"> 146</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> dst_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
218
+ <div class="line"><a name="l00147"></a><span class="lineno"> 147</span>&#160; <span class="keywordflow">if</span> (!<a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#ad42ca3cab47612c78a5d99cedea2f4ba">inVarToAddrsTable</a>(as, dst_id))</div>
219
+ <div class="line"><a name="l00148"></a><span class="lineno"> 148</span>&#160; {</div>
220
+ <div class="line"><a name="l00149"></a><span class="lineno"> 149</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<span class="stringliteral">&quot;scanf may cause buffer overflow.\n&quot;</span>, 0, 0, 0, 0, cs.getArgument(1));</div>
221
+ <div class="line"><a name="l00150"></a><span class="lineno"> 150</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
222
+ <div class="line"><a name="l00151"></a><span class="lineno"> 151</span>&#160; <span class="keywordflow">return</span>;</div>
223
+ <div class="line"><a name="l00152"></a><span class="lineno"> 152</span>&#160; }</div>
224
+ <div class="line"><a name="l00153"></a><span class="lineno"> 153</span>&#160; <span class="keywordflow">else</span></div>
225
+ <div class="line"><a name="l00154"></a><span class="lineno"> 154</span>&#160; {</div>
226
+ <div class="line"><a name="l00155"></a><span class="lineno"> 155</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> Addrs = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a611ac228efd661b301ea1dd675cd1c0c">getAddrs</a>(as, dst_id);</div>
227
+ <div class="line"><a name="l00156"></a><span class="lineno"> 156</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> vaddr: Addrs.<a class="code" href="structSVF_1_1AbstractValue.html#ab1fe6a57f784971b3bc603dbfda746e8">getAddrs</a>())</div>
228
+ <div class="line"><a name="l00157"></a><span class="lineno"> 157</span>&#160; {</div>
229
+ <div class="line"><a name="l00158"></a><span class="lineno"> 158</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> objId = <a class="code" href="classSVF_1_1AbstractState.html#aaabe5850dbf1620c6058f5ac6cb169b6">AbstractState::getInternalID</a>(vaddr);</div>
230
+ <div class="line"><a name="l00159"></a><span class="lineno"> 159</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> range = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a4e032a5e0898f0e349927d5a86c8477c">getRangeLimitFromType</a>(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1GenericGraph.html#a43c9c773bfa17abf481c33073e30d01b">getGNode</a>(objId)-&gt;<a class="code" href="classSVF_1_1SVFVar.html#ab6f95d3e7e099d75cfc9645ebc037047">getType</a>());</div>
231
+ <div class="line"><a name="l00160"></a><span class="lineno"> 160</span>&#160; as.<a class="code" href="classSVF_1_1AbstractState.html#a1f935ea8ab16b04699284bf92bbbb23c">store</a>(vaddr, range);</div>
232
+ <div class="line"><a name="l00161"></a><span class="lineno"> 161</span>&#160; }</div>
233
+ <div class="line"><a name="l00162"></a><span class="lineno"> 162</span>&#160; }</div>
234
+ <div class="line"><a name="l00163"></a><span class="lineno"> 163</span>&#160; };</div>
235
+ <div class="line"><a name="l00164"></a><span class="lineno"> 164</span>&#160; <span class="keyword">auto</span> sse_fscanf = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
236
+ <div class="line"><a name="l00165"></a><span class="lineno"> 165</span>&#160; {</div>
237
+ <div class="line"><a name="l00166"></a><span class="lineno"> 166</span>&#160; <span class="comment">//fscanf(stdin, &quot;%d&quot;, &amp;data);</span></div>
238
+ <div class="line"><a name="l00167"></a><span class="lineno"> 167</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 3) <span class="keywordflow">return</span>;</div>
239
+ <div class="line"><a name="l00168"></a><span class="lineno"> 168</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
240
+ <div class="line"><a name="l00169"></a><span class="lineno"> 169</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp; as = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a57e4ee3fde79c408dffe98894210d7c9">getAbsState</a>(callNode);</div>
241
+ <div class="line"><a name="l00170"></a><span class="lineno"> 170</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> dst_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(2));</div>
242
+ <div class="line"><a name="l00171"></a><span class="lineno"> 171</span>&#160; <span class="keywordflow">if</span> (!<a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#ad42ca3cab47612c78a5d99cedea2f4ba">inVarToAddrsTable</a>(as, dst_id))</div>
243
+ <div class="line"><a name="l00172"></a><span class="lineno"> 172</span>&#160; {</div>
244
+ <div class="line"><a name="l00173"></a><span class="lineno"> 173</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<span class="stringliteral">&quot;scanf may cause buffer overflow.\n&quot;</span>, 0, 0, 0, 0, cs.getArgument(2));</div>
245
+ <div class="line"><a name="l00174"></a><span class="lineno"> 174</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
246
+ <div class="line"><a name="l00175"></a><span class="lineno"> 175</span>&#160; <span class="keywordflow">return</span>;</div>
247
+ <div class="line"><a name="l00176"></a><span class="lineno"> 176</span>&#160; }</div>
248
+ <div class="line"><a name="l00177"></a><span class="lineno"> 177</span>&#160; <span class="keywordflow">else</span></div>
249
+ <div class="line"><a name="l00178"></a><span class="lineno"> 178</span>&#160; {</div>
250
+ <div class="line"><a name="l00179"></a><span class="lineno"> 179</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> Addrs = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a611ac228efd661b301ea1dd675cd1c0c">getAddrs</a>(as, dst_id);</div>
251
+ <div class="line"><a name="l00180"></a><span class="lineno"> 180</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> vaddr: Addrs.<a class="code" href="structSVF_1_1AbstractValue.html#ab1fe6a57f784971b3bc603dbfda746e8">getAddrs</a>())</div>
252
+ <div class="line"><a name="l00181"></a><span class="lineno"> 181</span>&#160; {</div>
253
+ <div class="line"><a name="l00182"></a><span class="lineno"> 182</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> objId = <a class="code" href="classSVF_1_1AbstractState.html#aaabe5850dbf1620c6058f5ac6cb169b6">AbstractState::getInternalID</a>(vaddr);</div>
254
+ <div class="line"><a name="l00183"></a><span class="lineno"> 183</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> range = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a4e032a5e0898f0e349927d5a86c8477c">getRangeLimitFromType</a>(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1GenericGraph.html#a43c9c773bfa17abf481c33073e30d01b">getGNode</a>(objId)-&gt;<a class="code" href="classSVF_1_1SVFVar.html#ab6f95d3e7e099d75cfc9645ebc037047">getType</a>());</div>
255
+ <div class="line"><a name="l00184"></a><span class="lineno"> 184</span>&#160; as.<a class="code" href="classSVF_1_1AbstractState.html#a1f935ea8ab16b04699284bf92bbbb23c">store</a>(vaddr, range);</div>
256
+ <div class="line"><a name="l00185"></a><span class="lineno"> 185</span>&#160; }</div>
257
+ <div class="line"><a name="l00186"></a><span class="lineno"> 186</span>&#160; }</div>
258
+ <div class="line"><a name="l00187"></a><span class="lineno"> 187</span>&#160; };</div>
259
+ <div class="line"><a name="l00188"></a><span class="lineno"> 188</span>&#160; </div>
260
+ <div class="line"><a name="l00189"></a><span class="lineno"> 189</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__isoc99_fscanf&quot;</span>] = sse_fscanf;</div>
261
+ <div class="line"><a name="l00190"></a><span class="lineno"> 190</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__isoc99_scanf&quot;</span>] = sse_scanf;</div>
262
+ <div class="line"><a name="l00191"></a><span class="lineno"> 191</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__isoc99_vscanf&quot;</span>] = sse_scanf;</div>
263
+ <div class="line"><a name="l00192"></a><span class="lineno"> 192</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;fscanf&quot;</span>] = sse_fscanf;</div>
264
+ <div class="line"><a name="l00193"></a><span class="lineno"> 193</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;scanf&quot;</span>] = sse_scanf;</div>
265
+ <div class="line"><a name="l00194"></a><span class="lineno"> 194</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;sscanf&quot;</span>] = sse_scanf;</div>
266
+ <div class="line"><a name="l00195"></a><span class="lineno"> 195</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__isoc99_sscanf&quot;</span>] = sse_scanf;</div>
267
+ <div class="line"><a name="l00196"></a><span class="lineno"> 196</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;vscanf&quot;</span>] = sse_scanf;</div>
268
+ <div class="line"><a name="l00197"></a><span class="lineno"> 197</span>&#160; </div>
269
+ <div class="line"><a name="l00198"></a><span class="lineno"> 198</span>&#160; <span class="keyword">auto</span> sse_fread = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
270
+ <div class="line"><a name="l00199"></a><span class="lineno"> 199</span>&#160; {</div>
271
+ <div class="line"><a name="l00200"></a><span class="lineno"> 200</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 3) <span class="keywordflow">return</span>;</div>
272
+ <div class="line"><a name="l00201"></a><span class="lineno"> 201</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
273
+ <div class="line"><a name="l00202"></a><span class="lineno"> 202</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;as = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a57e4ee3fde79c408dffe98894210d7c9">getAbsState</a>(callNode);</div>
274
+ <div class="line"><a name="l00203"></a><span class="lineno"> 203</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> block_count_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(2));</div>
275
+ <div class="line"><a name="l00204"></a><span class="lineno"> 204</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> block_size_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
276
+ <div class="line"><a name="l00205"></a><span class="lineno"> 205</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> block_count = as[block_count_id];</div>
277
+ <div class="line"><a name="l00206"></a><span class="lineno"> 206</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> block_size = as[block_size_id];</div>
278
+ <div class="line"><a name="l00207"></a><span class="lineno"> 207</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> block_byte = block_count * block_size;</div>
279
+ <div class="line"><a name="l00208"></a><span class="lineno"> 208</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(0), block_byte, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
280
280
  <div class="line"><a name="l00209"></a><span class="lineno"> 209</span>&#160; };</div>
281
- <div class="line"><a name="l00210"></a><span class="lineno"> 210</span>&#160; </div>
282
- <div class="line"><a name="l00211"></a><span class="lineno"> 211</span>&#160; <span class="keyword">auto</span> sse_snprintf = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
283
- <div class="line"><a name="l00212"></a><span class="lineno"> 212</span>&#160; {</div>
284
- <div class="line"><a name="l00213"></a><span class="lineno"> 213</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 2) <span class="keywordflow">return</span>;</div>
285
- <div class="line"><a name="l00214"></a><span class="lineno"> 214</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>();</div>
286
- <div class="line"><a name="l00215"></a><span class="lineno"> 215</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> size_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
287
- <div class="line"><a name="l00216"></a><span class="lineno"> 216</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> dst_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(0));</div>
288
- <div class="line"><a name="l00217"></a><span class="lineno"> 217</span>&#160; <span class="comment">// get elem size of arg2</span></div>
289
- <div class="line"><a name="l00218"></a><span class="lineno"> 218</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> elemSize = 1;</div>
290
- <div class="line"><a name="l00219"></a><span class="lineno"> 219</span>&#160; <span class="keywordflow">if</span> (cs.getArgument(2)-&gt;getType()-&gt;isArrayTy())</div>
291
- <div class="line"><a name="l00220"></a><span class="lineno"> 220</span>&#160; {</div>
292
- <div class="line"><a name="l00221"></a><span class="lineno"> 221</span>&#160; elemSize = SVFUtil::dyn_cast&lt;SVFArrayType&gt;(cs.getArgument(2)-&gt;getType())-&gt;getTypeOfElement()-&gt;getByteSize();</div>
293
- <div class="line"><a name="l00222"></a><span class="lineno"> 222</span>&#160; }</div>
294
- <div class="line"><a name="l00223"></a><span class="lineno"> 223</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (cs.getArgument(2)-&gt;getType()-&gt;isPointerTy())</div>
295
- <div class="line"><a name="l00224"></a><span class="lineno"> 224</span>&#160; {</div>
296
- <div class="line"><a name="l00225"></a><span class="lineno"> 225</span>&#160; elemSize = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2057e8e1c0aaf39e74f0a8fb2a1b580c">getPointeeElement</a>(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(2)))-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
297
- <div class="line"><a name="l00226"></a><span class="lineno"> 226</span>&#160; }</div>
298
- <div class="line"><a name="l00227"></a><span class="lineno"> 227</span>&#160; <span class="keywordflow">else</span></div>
299
- <div class="line"><a name="l00228"></a><span class="lineno"> 228</span>&#160; {</div>
300
- <div class="line"><a name="l00229"></a><span class="lineno"> 229</span>&#160; <span class="keywordflow">return</span>;</div>
301
- <div class="line"><a name="l00230"></a><span class="lineno"> 230</span>&#160; <span class="comment">// assert(false &amp;&amp; &quot;we cannot support this type&quot;);</span></div>
302
- <div class="line"><a name="l00231"></a><span class="lineno"> 231</span>&#160; }</div>
303
- <div class="line"><a name="l00232"></a><span class="lineno"> 232</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> size = es[size_id] * <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(elemSize) - <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(1);</div>
304
- <div class="line"><a name="l00233"></a><span class="lineno"> 233</span>&#160; <span class="keywordflow">if</span> (!es.<a class="code" href="classSVF_1_1AbstractState.html#aa34516a95191c5ec56ce44a117e8b018">inVarToAddrsTable</a>(dst_id))</div>
305
- <div class="line"><a name="l00234"></a><span class="lineno"> 234</span>&#160; {</div>
306
- <div class="line"><a name="l00235"></a><span class="lineno"> 235</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1Options.html#afbe432aabda95308e2c190a04d227a6d">Options::BufferOverflowCheck</a>())</div>
307
- <div class="line"><a name="l00236"></a><span class="lineno"> 236</span>&#160; {</div>
308
- <div class="line"><a name="l00237"></a><span class="lineno"> 237</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(</div>
309
- <div class="line"><a name="l00238"></a><span class="lineno"> 238</span>&#160; <span class="stringliteral">&quot;snprintf dst_id or dst is not defined nor initializesd.\n&quot;</span>,</div>
310
- <div class="line"><a name="l00239"></a><span class="lineno"> 239</span>&#160; 0, 0, 0, 0, cs.getArgument(0));</div>
311
- <div class="line"><a name="l00240"></a><span class="lineno"> 240</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
312
- <div class="line"><a name="l00241"></a><span class="lineno"> 241</span>&#160; <span class="keywordflow">return</span>;</div>
313
- <div class="line"><a name="l00242"></a><span class="lineno"> 242</span>&#160; }</div>
314
- <div class="line"><a name="l00243"></a><span class="lineno"> 243</span>&#160; }</div>
315
- <div class="line"><a name="l00244"></a><span class="lineno"> 244</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(0), size, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
316
- <div class="line"><a name="l00245"></a><span class="lineno"> 245</span>&#160; };</div>
317
- <div class="line"><a name="l00246"></a><span class="lineno"> 246</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__snprintf_chk&quot;</span>] = sse_snprintf;</div>
318
- <div class="line"><a name="l00247"></a><span class="lineno"> 247</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__vsprintf_chk&quot;</span>] = sse_sprintf;</div>
319
- <div class="line"><a name="l00248"></a><span class="lineno"> 248</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__sprintf_chk&quot;</span>] = sse_sprintf;</div>
320
- <div class="line"><a name="l00249"></a><span class="lineno"> 249</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;snprintf&quot;</span>] = sse_snprintf;</div>
321
- <div class="line"><a name="l00250"></a><span class="lineno"> 250</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;sprintf&quot;</span>] = sse_sprintf;</div>
322
- <div class="line"><a name="l00251"></a><span class="lineno"> 251</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;vsprintf&quot;</span>] = sse_sprintf;</div>
323
- <div class="line"><a name="l00252"></a><span class="lineno"> 252</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;vsnprintf&quot;</span>] = sse_snprintf;</div>
324
- <div class="line"><a name="l00253"></a><span class="lineno"> 253</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__vsnprintf_chk&quot;</span>] = sse_snprintf;</div>
325
- <div class="line"><a name="l00254"></a><span class="lineno"> 254</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;swprintf&quot;</span>] = sse_snprintf;</div>
326
- <div class="line"><a name="l00255"></a><span class="lineno"> 255</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;_snwprintf&quot;</span>] = sse_snprintf;</div>
327
- <div class="line"><a name="l00256"></a><span class="lineno"> 256</span>&#160; </div>
328
- <div class="line"><a name="l00257"></a><span class="lineno"> 257</span>&#160; </div>
329
- <div class="line"><a name="l00258"></a><span class="lineno"> 258</span>&#160; <span class="keyword">auto</span> sse_itoa = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
330
- <div class="line"><a name="l00259"></a><span class="lineno"> 259</span>&#160; {</div>
331
- <div class="line"><a name="l00260"></a><span class="lineno"> 260</span>&#160; <span class="comment">// itoa(num, ch, 10);</span></div>
332
- <div class="line"><a name="l00261"></a><span class="lineno"> 261</span>&#160; <span class="comment">// num: int, ch: char*, 10 is decimal</span></div>
333
- <div class="line"><a name="l00262"></a><span class="lineno"> 262</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 3) <span class="keywordflow">return</span>;</div>
334
- <div class="line"><a name="l00263"></a><span class="lineno"> 263</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>();</div>
335
- <div class="line"><a name="l00264"></a><span class="lineno"> 264</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> num_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(0));</div>
336
- <div class="line"><a name="l00265"></a><span class="lineno"> 265</span>&#160; </div>
337
- <div class="line"><a name="l00266"></a><span class="lineno"> 266</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> num = (<a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a>) es[num_id].getInterval().getNumeral();</div>
338
- <div class="line"><a name="l00267"></a><span class="lineno"> 267</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> snum = std::to_string(num);</div>
339
- <div class="line"><a name="l00268"></a><span class="lineno"> 268</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(1), <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a>((<a class="code" href="namespaceSVF.html#a9b707002523ece2ac54ca893ee9a2d4e">s32_t</a>)snum.size()), <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
340
- <div class="line"><a name="l00269"></a><span class="lineno"> 269</span>&#160; };</div>
341
- <div class="line"><a name="l00270"></a><span class="lineno"> 270</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;itoa&quot;</span>] = sse_itoa;</div>
342
- <div class="line"><a name="l00271"></a><span class="lineno"> 271</span>&#160; </div>
343
- <div class="line"><a name="l00272"></a><span class="lineno"> 272</span>&#160; </div>
344
- <div class="line"><a name="l00273"></a><span class="lineno"> 273</span>&#160; <span class="keyword">auto</span> sse_strlen = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
345
- <div class="line"><a name="l00274"></a><span class="lineno"> 274</span>&#160; {</div>
346
- <div class="line"><a name="l00275"></a><span class="lineno"> 275</span>&#160; <span class="comment">// check the arg size</span></div>
347
- <div class="line"><a name="l00276"></a><span class="lineno"> 276</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 1) <span class="keywordflow">return</span>;</div>
348
- <div class="line"><a name="l00277"></a><span class="lineno"> 277</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* strValue = cs.getArgument(0);</div>
349
- <div class="line"><a name="l00278"></a><span class="lineno"> 278</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>();</div>
350
- <div class="line"><a name="l00279"></a><span class="lineno"> 279</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> dst_size = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a5bba3c0570d73acc743742a30af1b0b4">getStrlen</a>(strValue);</div>
351
- <div class="line"><a name="l00280"></a><span class="lineno"> 280</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> elemSize = 1;</div>
352
- <div class="line"><a name="l00281"></a><span class="lineno"> 281</span>&#160; <span class="keywordflow">if</span> (strValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a11f2d9b6e969ede6fca2c204cc15b821">getType</a>()-&gt;<a class="code" href="classSVF_1_1SVFType.html#a330084f9a3deb6e5acb52a8ee3eb7fe4">isArrayTy</a>())</div>
353
- <div class="line"><a name="l00282"></a><span class="lineno"> 282</span>&#160; {</div>
354
- <div class="line"><a name="l00283"></a><span class="lineno"> 283</span>&#160; elemSize = SVFUtil::dyn_cast&lt;SVFArrayType&gt;(strValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a11f2d9b6e969ede6fca2c204cc15b821">getType</a>())-&gt;getTypeOfElement()-&gt;getByteSize();</div>
355
- <div class="line"><a name="l00284"></a><span class="lineno"> 284</span>&#160; }</div>
356
- <div class="line"><a name="l00285"></a><span class="lineno"> 285</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (strValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a11f2d9b6e969ede6fca2c204cc15b821">getType</a>()-&gt;<a class="code" href="classSVF_1_1SVFType.html#a870b63af2bf9fe43cdf1df3d56b20f6c">isPointerTy</a>())</div>
357
- <div class="line"><a name="l00286"></a><span class="lineno"> 286</span>&#160; {</div>
358
- <div class="line"><a name="l00287"></a><span class="lineno"> 287</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFType.html">SVFType</a>* pointee = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2057e8e1c0aaf39e74f0a8fb2a1b580c">getPointeeElement</a>(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(strValue)))</div>
359
- <div class="line"><a name="l00288"></a><span class="lineno"> 288</span>&#160; elemSize = pointee-&gt;getByteSize();</div>
360
- <div class="line"><a name="l00289"></a><span class="lineno"> 289</span>&#160; <span class="keywordflow">else</span></div>
361
- <div class="line"><a name="l00290"></a><span class="lineno"> 290</span>&#160; elemSize = 1;</div>
362
- <div class="line"><a name="l00291"></a><span class="lineno"> 291</span>&#160; }</div>
363
- <div class="line"><a name="l00292"></a><span class="lineno"> 292</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> lhsId = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getInstruction());</div>
364
- <div class="line"><a name="l00293"></a><span class="lineno"> 293</span>&#160; es[lhsId] = dst_size / <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(elemSize);</div>
365
- <div class="line"><a name="l00294"></a><span class="lineno"> 294</span>&#160; };</div>
366
- <div class="line"><a name="l00295"></a><span class="lineno"> 295</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;strlen&quot;</span>] = sse_strlen;</div>
367
- <div class="line"><a name="l00296"></a><span class="lineno"> 296</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;wcslen&quot;</span>] = sse_strlen;</div>
368
- <div class="line"><a name="l00297"></a><span class="lineno"> 297</span>&#160; </div>
369
- <div class="line"><a name="l00298"></a><span class="lineno"> 298</span>&#160; <span class="keyword">auto</span> sse_recv = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
370
- <div class="line"><a name="l00299"></a><span class="lineno"> 299</span>&#160; {</div>
371
- <div class="line"><a name="l00300"></a><span class="lineno"> 300</span>&#160; <span class="comment">// recv(sockfd, buf, len, flags);</span></div>
372
- <div class="line"><a name="l00301"></a><span class="lineno"> 301</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 4) <span class="keywordflow">return</span>;</div>
373
- <div class="line"><a name="l00302"></a><span class="lineno"> 302</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>();</div>
374
- <div class="line"><a name="l00303"></a><span class="lineno"> 303</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> len_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(2));</div>
375
- <div class="line"><a name="l00304"></a><span class="lineno"> 304</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> len = es[len_id] - <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(1);</div>
376
- <div class="line"><a name="l00305"></a><span class="lineno"> 305</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> lhsId = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getInstruction());</div>
377
- <div class="line"><a name="l00306"></a><span class="lineno"> 306</span>&#160; es[lhsId] = len;</div>
378
- <div class="line"><a name="l00307"></a><span class="lineno"> 307</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(1), len, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));;</div>
379
- <div class="line"><a name="l00308"></a><span class="lineno"> 308</span>&#160; };</div>
380
- <div class="line"><a name="l00309"></a><span class="lineno"> 309</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;recv&quot;</span>] = sse_recv;</div>
381
- <div class="line"><a name="l00310"></a><span class="lineno"> 310</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__recv&quot;</span>] = sse_recv;</div>
382
- <div class="line"><a name="l00311"></a><span class="lineno"> 311</span>&#160; <span class="keyword">auto</span> safe_bufaccess = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
383
- <div class="line"><a name="l00312"></a><span class="lineno"> 312</span>&#160; {</div>
384
- <div class="line"><a name="l00313"></a><span class="lineno"> 313</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
385
- <div class="line"><a name="l00314"></a><span class="lineno"> 314</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a219313e979d779221116c1bc45becc1b">_checkpoints</a>.erase(callNode);</div>
386
- <div class="line"><a name="l00315"></a><span class="lineno"> 315</span>&#160; <span class="comment">//void SAFE_BUFACCESS(void* data, int size);</span></div>
387
- <div class="line"><a name="l00316"></a><span class="lineno"> 316</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 2) <span class="keywordflow">return</span>;</div>
388
- <div class="line"><a name="l00317"></a><span class="lineno"> 317</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>();</div>
389
- <div class="line"><a name="l00318"></a><span class="lineno"> 318</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> size_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
390
- <div class="line"><a name="l00319"></a><span class="lineno"> 319</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> val = es[size_id];</div>
391
- <div class="line"><a name="l00320"></a><span class="lineno"> 320</span>&#160; <span class="keywordflow">if</span> (val.<a class="code" href="structSVF_1_1AbstractValue.html#a8b1af972fa8a4e40347990d179ec1c52">isBottom</a>())</div>
392
- <div class="line"><a name="l00321"></a><span class="lineno"> 321</span>&#160; {</div>
393
- <div class="line"><a name="l00322"></a><span class="lineno"> 322</span>&#160; val = <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(0);</div>
394
- <div class="line"><a name="l00323"></a><span class="lineno"> 323</span>&#160; assert(<span class="keyword">false</span> &amp;&amp; <span class="stringliteral">&quot;SAFE_BUFACCESS size is bottom&quot;</span>);</div>
395
- <div class="line"><a name="l00324"></a><span class="lineno"> 324</span>&#160; }</div>
396
- <div class="line"><a name="l00325"></a><span class="lineno"> 325</span>&#160; <span class="keywordtype">bool</span> isSafe = <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(0), val, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
397
- <div class="line"><a name="l00326"></a><span class="lineno"> 326</span>&#160; <span class="keywordflow">if</span> (isSafe)</div>
398
- <div class="line"><a name="l00327"></a><span class="lineno"> 327</span>&#160; {</div>
399
- <div class="line"><a name="l00328"></a><span class="lineno"> 328</span>&#160; std::cout &lt;&lt; <span class="stringliteral">&quot;safe buffer access success\n&quot;</span>;</div>
400
- <div class="line"><a name="l00329"></a><span class="lineno"> 329</span>&#160; <span class="keywordflow">return</span>;</div>
401
- <div class="line"><a name="l00330"></a><span class="lineno"> 330</span>&#160; }</div>
402
- <div class="line"><a name="l00331"></a><span class="lineno"> 331</span>&#160; <span class="keywordflow">else</span></div>
403
- <div class="line"><a name="l00332"></a><span class="lineno"> 332</span>&#160; {</div>
404
- <div class="line"><a name="l00333"></a><span class="lineno"> 333</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> err_msg = <span class="stringliteral">&quot;this SAFE_BUFACCESS should be a safe access but detected buffer overflow. Pos: &quot;</span>;</div>
405
- <div class="line"><a name="l00334"></a><span class="lineno"> 334</span>&#160; err_msg += cs.getInstruction()-&gt;getSourceLoc();</div>
406
- <div class="line"><a name="l00335"></a><span class="lineno"> 335</span>&#160; std::cerr &lt;&lt; err_msg &lt;&lt; std::endl;</div>
407
- <div class="line"><a name="l00336"></a><span class="lineno"> 336</span>&#160; assert(<span class="keyword">false</span>);</div>
408
- <div class="line"><a name="l00337"></a><span class="lineno"> 337</span>&#160; }</div>
409
- <div class="line"><a name="l00338"></a><span class="lineno"> 338</span>&#160; };</div>
410
- <div class="line"><a name="l00339"></a><span class="lineno"> 339</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;SAFE_BUFACCESS&quot;</span>] = safe_bufaccess;</div>
411
- <div class="line"><a name="l00340"></a><span class="lineno"> 340</span>&#160; </div>
412
- <div class="line"><a name="l00341"></a><span class="lineno"> 341</span>&#160; <span class="keyword">auto</span> unsafe_bufaccess = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
413
- <div class="line"><a name="l00342"></a><span class="lineno"> 342</span>&#160; {</div>
414
- <div class="line"><a name="l00343"></a><span class="lineno"> 343</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
415
- <div class="line"><a name="l00344"></a><span class="lineno"> 344</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a219313e979d779221116c1bc45becc1b">_checkpoints</a>.erase(callNode);</div>
416
- <div class="line"><a name="l00345"></a><span class="lineno"> 345</span>&#160; <span class="comment">//void UNSAFE_BUFACCESS(void* data, int size);</span></div>
417
- <div class="line"><a name="l00346"></a><span class="lineno"> 346</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 2) <span class="keywordflow">return</span>;</div>
418
- <div class="line"><a name="l00347"></a><span class="lineno"> 347</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;es = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>();</div>
419
- <div class="line"><a name="l00348"></a><span class="lineno"> 348</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> size_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
420
- <div class="line"><a name="l00349"></a><span class="lineno"> 349</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> val = es[size_id];</div>
421
- <div class="line"><a name="l00350"></a><span class="lineno"> 350</span>&#160; <span class="keywordflow">if</span> (val.<a class="code" href="structSVF_1_1AbstractValue.html#a8b1af972fa8a4e40347990d179ec1c52">isBottom</a>())</div>
422
- <div class="line"><a name="l00351"></a><span class="lineno"> 351</span>&#160; {</div>
423
- <div class="line"><a name="l00352"></a><span class="lineno"> 352</span>&#160; assert(<span class="keyword">false</span> &amp;&amp; <span class="stringliteral">&quot;UNSAFE_BUFACCESS size is bottom&quot;</span>);</div>
424
- <div class="line"><a name="l00353"></a><span class="lineno"> 353</span>&#160; }</div>
425
- <div class="line"><a name="l00354"></a><span class="lineno"> 354</span>&#160; <span class="keywordtype">bool</span> isSafe = <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(0), val, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
426
- <div class="line"><a name="l00355"></a><span class="lineno"> 355</span>&#160; <span class="keywordflow">if</span> (!isSafe)</div>
427
- <div class="line"><a name="l00356"></a><span class="lineno"> 356</span>&#160; {</div>
428
- <div class="line"><a name="l00357"></a><span class="lineno"> 357</span>&#160; std::cout &lt;&lt; <span class="stringliteral">&quot;detect buffer overflow success\n&quot;</span>;</div>
429
- <div class="line"><a name="l00358"></a><span class="lineno"> 358</span>&#160; <span class="keywordflow">return</span>;</div>
430
- <div class="line"><a name="l00359"></a><span class="lineno"> 359</span>&#160; }</div>
431
- <div class="line"><a name="l00360"></a><span class="lineno"> 360</span>&#160; <span class="keywordflow">else</span></div>
281
+ <div class="line"><a name="l00210"></a><span class="lineno"> 210</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;fread&quot;</span>] = sse_fread;</div>
282
+ <div class="line"><a name="l00211"></a><span class="lineno"> 211</span>&#160; </div>
283
+ <div class="line"><a name="l00212"></a><span class="lineno"> 212</span>&#160; <span class="keyword">auto</span> sse_sprintf = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
284
+ <div class="line"><a name="l00213"></a><span class="lineno"> 213</span>&#160; {</div>
285
+ <div class="line"><a name="l00214"></a><span class="lineno"> 214</span>&#160; <span class="comment">// printf is difficult to predict since it has no byte size arguments</span></div>
286
+ <div class="line"><a name="l00215"></a><span class="lineno"> 215</span>&#160; };</div>
287
+ <div class="line"><a name="l00216"></a><span class="lineno"> 216</span>&#160; </div>
288
+ <div class="line"><a name="l00217"></a><span class="lineno"> 217</span>&#160; <span class="keyword">auto</span> sse_snprintf = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
289
+ <div class="line"><a name="l00218"></a><span class="lineno"> 218</span>&#160; {</div>
290
+ <div class="line"><a name="l00219"></a><span class="lineno"> 219</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 2) <span class="keywordflow">return</span>;</div>
291
+ <div class="line"><a name="l00220"></a><span class="lineno"> 220</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
292
+ <div class="line"><a name="l00221"></a><span class="lineno"> 221</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;as = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a57e4ee3fde79c408dffe98894210d7c9">getAbsState</a>(callNode);</div>
293
+ <div class="line"><a name="l00222"></a><span class="lineno"> 222</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> size_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
294
+ <div class="line"><a name="l00223"></a><span class="lineno"> 223</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> dst_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(0));</div>
295
+ <div class="line"><a name="l00224"></a><span class="lineno"> 224</span>&#160; <span class="comment">// get elem size of arg2</span></div>
296
+ <div class="line"><a name="l00225"></a><span class="lineno"> 225</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> elemSize = 1;</div>
297
+ <div class="line"><a name="l00226"></a><span class="lineno"> 226</span>&#160; <span class="keywordflow">if</span> (cs.getArgument(2)-&gt;getType()-&gt;isArrayTy())</div>
298
+ <div class="line"><a name="l00227"></a><span class="lineno"> 227</span>&#160; {</div>
299
+ <div class="line"><a name="l00228"></a><span class="lineno"> 228</span>&#160; elemSize = SVFUtil::dyn_cast&lt;SVFArrayType&gt;(cs.getArgument(2)-&gt;getType())-&gt;getTypeOfElement()-&gt;getByteSize();</div>
300
+ <div class="line"><a name="l00229"></a><span class="lineno"> 229</span>&#160; }</div>
301
+ <div class="line"><a name="l00230"></a><span class="lineno"> 230</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (cs.getArgument(2)-&gt;getType()-&gt;isPointerTy())</div>
302
+ <div class="line"><a name="l00231"></a><span class="lineno"> 231</span>&#160; {</div>
303
+ <div class="line"><a name="l00232"></a><span class="lineno"> 232</span>&#160; elemSize = <a class="code" href="classSVF_1_1AbstractInterpretation.html#abb8dd7424d62b56b899d3f4d218eeaac">getPointeeElement</a>(as, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(2)))-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
304
+ <div class="line"><a name="l00233"></a><span class="lineno"> 233</span>&#160; }</div>
305
+ <div class="line"><a name="l00234"></a><span class="lineno"> 234</span>&#160; <span class="keywordflow">else</span></div>
306
+ <div class="line"><a name="l00235"></a><span class="lineno"> 235</span>&#160; {</div>
307
+ <div class="line"><a name="l00236"></a><span class="lineno"> 236</span>&#160; <span class="keywordflow">return</span>;</div>
308
+ <div class="line"><a name="l00237"></a><span class="lineno"> 237</span>&#160; <span class="comment">// assert(false &amp;&amp; &quot;we cannot support this type&quot;);</span></div>
309
+ <div class="line"><a name="l00238"></a><span class="lineno"> 238</span>&#160; }</div>
310
+ <div class="line"><a name="l00239"></a><span class="lineno"> 239</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> size = as[size_id] * <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(elemSize) - <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(1);</div>
311
+ <div class="line"><a name="l00240"></a><span class="lineno"> 240</span>&#160; <span class="keywordflow">if</span> (!as.<a class="code" href="classSVF_1_1AbstractState.html#aa34516a95191c5ec56ce44a117e8b018">inVarToAddrsTable</a>(dst_id))</div>
312
+ <div class="line"><a name="l00241"></a><span class="lineno"> 241</span>&#160; {</div>
313
+ <div class="line"><a name="l00242"></a><span class="lineno"> 242</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1Options.html#afbe432aabda95308e2c190a04d227a6d">Options::BufferOverflowCheck</a>())</div>
314
+ <div class="line"><a name="l00243"></a><span class="lineno"> 243</span>&#160; {</div>
315
+ <div class="line"><a name="l00244"></a><span class="lineno"> 244</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(</div>
316
+ <div class="line"><a name="l00245"></a><span class="lineno"> 245</span>&#160; <span class="stringliteral">&quot;snprintf dst_id or dst is not defined nor initializesd.\n&quot;</span>,</div>
317
+ <div class="line"><a name="l00246"></a><span class="lineno"> 246</span>&#160; 0, 0, 0, 0, cs.getArgument(0));</div>
318
+ <div class="line"><a name="l00247"></a><span class="lineno"> 247</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
319
+ <div class="line"><a name="l00248"></a><span class="lineno"> 248</span>&#160; <span class="keywordflow">return</span>;</div>
320
+ <div class="line"><a name="l00249"></a><span class="lineno"> 249</span>&#160; }</div>
321
+ <div class="line"><a name="l00250"></a><span class="lineno"> 250</span>&#160; }</div>
322
+ <div class="line"><a name="l00251"></a><span class="lineno"> 251</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(0), size, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
323
+ <div class="line"><a name="l00252"></a><span class="lineno"> 252</span>&#160; };</div>
324
+ <div class="line"><a name="l00253"></a><span class="lineno"> 253</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__snprintf_chk&quot;</span>] = sse_snprintf;</div>
325
+ <div class="line"><a name="l00254"></a><span class="lineno"> 254</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__vsprintf_chk&quot;</span>] = sse_sprintf;</div>
326
+ <div class="line"><a name="l00255"></a><span class="lineno"> 255</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__sprintf_chk&quot;</span>] = sse_sprintf;</div>
327
+ <div class="line"><a name="l00256"></a><span class="lineno"> 256</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;snprintf&quot;</span>] = sse_snprintf;</div>
328
+ <div class="line"><a name="l00257"></a><span class="lineno"> 257</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;sprintf&quot;</span>] = sse_sprintf;</div>
329
+ <div class="line"><a name="l00258"></a><span class="lineno"> 258</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;vsprintf&quot;</span>] = sse_sprintf;</div>
330
+ <div class="line"><a name="l00259"></a><span class="lineno"> 259</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;vsnprintf&quot;</span>] = sse_snprintf;</div>
331
+ <div class="line"><a name="l00260"></a><span class="lineno"> 260</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__vsnprintf_chk&quot;</span>] = sse_snprintf;</div>
332
+ <div class="line"><a name="l00261"></a><span class="lineno"> 261</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;swprintf&quot;</span>] = sse_snprintf;</div>
333
+ <div class="line"><a name="l00262"></a><span class="lineno"> 262</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;_snwprintf&quot;</span>] = sse_snprintf;</div>
334
+ <div class="line"><a name="l00263"></a><span class="lineno"> 263</span>&#160; </div>
335
+ <div class="line"><a name="l00264"></a><span class="lineno"> 264</span>&#160; </div>
336
+ <div class="line"><a name="l00265"></a><span class="lineno"> 265</span>&#160; <span class="keyword">auto</span> sse_itoa = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
337
+ <div class="line"><a name="l00266"></a><span class="lineno"> 266</span>&#160; {</div>
338
+ <div class="line"><a name="l00267"></a><span class="lineno"> 267</span>&#160; <span class="comment">// itoa(num, ch, 10);</span></div>
339
+ <div class="line"><a name="l00268"></a><span class="lineno"> 268</span>&#160; <span class="comment">// num: int, ch: char*, 10 is decimal</span></div>
340
+ <div class="line"><a name="l00269"></a><span class="lineno"> 269</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 3) <span class="keywordflow">return</span>;</div>
341
+ <div class="line"><a name="l00270"></a><span class="lineno"> 270</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
342
+ <div class="line"><a name="l00271"></a><span class="lineno"> 271</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;as = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a57e4ee3fde79c408dffe98894210d7c9">getAbsState</a>(callNode);</div>
343
+ <div class="line"><a name="l00272"></a><span class="lineno"> 272</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> num_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(0));</div>
344
+ <div class="line"><a name="l00273"></a><span class="lineno"> 273</span>&#160; </div>
345
+ <div class="line"><a name="l00274"></a><span class="lineno"> 274</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> num = (<a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a>) as[num_id].getInterval().getNumeral();</div>
346
+ <div class="line"><a name="l00275"></a><span class="lineno"> 275</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> snum = std::to_string(num);</div>
347
+ <div class="line"><a name="l00276"></a><span class="lineno"> 276</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(1), <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a>((<a class="code" href="namespaceSVF.html#a9b707002523ece2ac54ca893ee9a2d4e">s32_t</a>)snum.size()), <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
348
+ <div class="line"><a name="l00277"></a><span class="lineno"> 277</span>&#160; };</div>
349
+ <div class="line"><a name="l00278"></a><span class="lineno"> 278</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;itoa&quot;</span>] = sse_itoa;</div>
350
+ <div class="line"><a name="l00279"></a><span class="lineno"> 279</span>&#160; </div>
351
+ <div class="line"><a name="l00280"></a><span class="lineno"> 280</span>&#160; </div>
352
+ <div class="line"><a name="l00281"></a><span class="lineno"> 281</span>&#160; <span class="keyword">auto</span> sse_strlen = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
353
+ <div class="line"><a name="l00282"></a><span class="lineno"> 282</span>&#160; {</div>
354
+ <div class="line"><a name="l00283"></a><span class="lineno"> 283</span>&#160; <span class="comment">// check the arg size</span></div>
355
+ <div class="line"><a name="l00284"></a><span class="lineno"> 284</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 1) <span class="keywordflow">return</span>;</div>
356
+ <div class="line"><a name="l00285"></a><span class="lineno"> 285</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* strValue = cs.getArgument(0);</div>
357
+ <div class="line"><a name="l00286"></a><span class="lineno"> 286</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
358
+ <div class="line"><a name="l00287"></a><span class="lineno"> 287</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp; as = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a57e4ee3fde79c408dffe98894210d7c9">getAbsState</a>(callNode);</div>
359
+ <div class="line"><a name="l00288"></a><span class="lineno"> 288</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> dst_size = <a class="code" href="classSVF_1_1AbstractInterpretation.html#ab076eddb7908768126c190c23b91eb85">getStrlen</a>(as, strValue);</div>
360
+ <div class="line"><a name="l00289"></a><span class="lineno"> 289</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> elemSize = 1;</div>
361
+ <div class="line"><a name="l00290"></a><span class="lineno"> 290</span>&#160; <span class="keywordflow">if</span> (strValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a11f2d9b6e969ede6fca2c204cc15b821">getType</a>()-&gt;<a class="code" href="classSVF_1_1SVFType.html#a330084f9a3deb6e5acb52a8ee3eb7fe4">isArrayTy</a>())</div>
362
+ <div class="line"><a name="l00291"></a><span class="lineno"> 291</span>&#160; {</div>
363
+ <div class="line"><a name="l00292"></a><span class="lineno"> 292</span>&#160; elemSize = SVFUtil::dyn_cast&lt;SVFArrayType&gt;(strValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a11f2d9b6e969ede6fca2c204cc15b821">getType</a>())-&gt;getTypeOfElement()-&gt;getByteSize();</div>
364
+ <div class="line"><a name="l00293"></a><span class="lineno"> 293</span>&#160; }</div>
365
+ <div class="line"><a name="l00294"></a><span class="lineno"> 294</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (strValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a11f2d9b6e969ede6fca2c204cc15b821">getType</a>()-&gt;<a class="code" href="classSVF_1_1SVFType.html#a870b63af2bf9fe43cdf1df3d56b20f6c">isPointerTy</a>())</div>
366
+ <div class="line"><a name="l00295"></a><span class="lineno"> 295</span>&#160; {</div>
367
+ <div class="line"><a name="l00296"></a><span class="lineno"> 296</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFType.html">SVFType</a>* pointee = <a class="code" href="classSVF_1_1AbstractInterpretation.html#abb8dd7424d62b56b899d3f4d218eeaac">getPointeeElement</a>(as, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(strValue)))</div>
368
+ <div class="line"><a name="l00297"></a><span class="lineno"> 297</span>&#160; elemSize = pointee-&gt;getByteSize();</div>
369
+ <div class="line"><a name="l00298"></a><span class="lineno"> 298</span>&#160; <span class="keywordflow">else</span></div>
370
+ <div class="line"><a name="l00299"></a><span class="lineno"> 299</span>&#160; elemSize = 1;</div>
371
+ <div class="line"><a name="l00300"></a><span class="lineno"> 300</span>&#160; }</div>
372
+ <div class="line"><a name="l00301"></a><span class="lineno"> 301</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> lhsId = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getInstruction());</div>
373
+ <div class="line"><a name="l00302"></a><span class="lineno"> 302</span>&#160; as[lhsId] = dst_size / <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(elemSize);</div>
374
+ <div class="line"><a name="l00303"></a><span class="lineno"> 303</span>&#160; };</div>
375
+ <div class="line"><a name="l00304"></a><span class="lineno"> 304</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;strlen&quot;</span>] = sse_strlen;</div>
376
+ <div class="line"><a name="l00305"></a><span class="lineno"> 305</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;wcslen&quot;</span>] = sse_strlen;</div>
377
+ <div class="line"><a name="l00306"></a><span class="lineno"> 306</span>&#160; </div>
378
+ <div class="line"><a name="l00307"></a><span class="lineno"> 307</span>&#160; <span class="keyword">auto</span> sse_recv = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
379
+ <div class="line"><a name="l00308"></a><span class="lineno"> 308</span>&#160; {</div>
380
+ <div class="line"><a name="l00309"></a><span class="lineno"> 309</span>&#160; <span class="comment">// recv(sockfd, buf, len, flags);</span></div>
381
+ <div class="line"><a name="l00310"></a><span class="lineno"> 310</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 4) <span class="keywordflow">return</span>;</div>
382
+ <div class="line"><a name="l00311"></a><span class="lineno"> 311</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
383
+ <div class="line"><a name="l00312"></a><span class="lineno"> 312</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;as = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a57e4ee3fde79c408dffe98894210d7c9">getAbsState</a>(callNode);</div>
384
+ <div class="line"><a name="l00313"></a><span class="lineno"> 313</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> len_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(2));</div>
385
+ <div class="line"><a name="l00314"></a><span class="lineno"> 314</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> len = as[len_id] - <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(1);</div>
386
+ <div class="line"><a name="l00315"></a><span class="lineno"> 315</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> lhsId = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getInstruction());</div>
387
+ <div class="line"><a name="l00316"></a><span class="lineno"> 316</span>&#160; as[lhsId] = len;</div>
388
+ <div class="line"><a name="l00317"></a><span class="lineno"> 317</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(1), len, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));;</div>
389
+ <div class="line"><a name="l00318"></a><span class="lineno"> 318</span>&#160; };</div>
390
+ <div class="line"><a name="l00319"></a><span class="lineno"> 319</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;recv&quot;</span>] = sse_recv;</div>
391
+ <div class="line"><a name="l00320"></a><span class="lineno"> 320</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;__recv&quot;</span>] = sse_recv;</div>
392
+ <div class="line"><a name="l00321"></a><span class="lineno"> 321</span>&#160; <span class="keyword">auto</span> safe_bufaccess = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
393
+ <div class="line"><a name="l00322"></a><span class="lineno"> 322</span>&#160; {</div>
394
+ <div class="line"><a name="l00323"></a><span class="lineno"> 323</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
395
+ <div class="line"><a name="l00324"></a><span class="lineno"> 324</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a219313e979d779221116c1bc45becc1b">_checkpoints</a>.erase(callNode);</div>
396
+ <div class="line"><a name="l00325"></a><span class="lineno"> 325</span>&#160; <span class="comment">//void SAFE_BUFACCESS(void* data, int size);</span></div>
397
+ <div class="line"><a name="l00326"></a><span class="lineno"> 326</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 2) <span class="keywordflow">return</span>;</div>
398
+ <div class="line"><a name="l00327"></a><span class="lineno"> 327</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;as = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a57e4ee3fde79c408dffe98894210d7c9">getAbsState</a>(callNode);</div>
399
+ <div class="line"><a name="l00328"></a><span class="lineno"> 328</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> size_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
400
+ <div class="line"><a name="l00329"></a><span class="lineno"> 329</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> val = as[size_id];</div>
401
+ <div class="line"><a name="l00330"></a><span class="lineno"> 330</span>&#160; <span class="keywordflow">if</span> (val.<a class="code" href="structSVF_1_1AbstractValue.html#a8b1af972fa8a4e40347990d179ec1c52">isBottom</a>())</div>
402
+ <div class="line"><a name="l00331"></a><span class="lineno"> 331</span>&#160; {</div>
403
+ <div class="line"><a name="l00332"></a><span class="lineno"> 332</span>&#160; val = <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(0);</div>
404
+ <div class="line"><a name="l00333"></a><span class="lineno"> 333</span>&#160; assert(<span class="keyword">false</span> &amp;&amp; <span class="stringliteral">&quot;SAFE_BUFACCESS size is bottom&quot;</span>);</div>
405
+ <div class="line"><a name="l00334"></a><span class="lineno"> 334</span>&#160; }</div>
406
+ <div class="line"><a name="l00335"></a><span class="lineno"> 335</span>&#160; <span class="keywordtype">bool</span> isSafe = <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(0), val, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
407
+ <div class="line"><a name="l00336"></a><span class="lineno"> 336</span>&#160; <span class="keywordflow">if</span> (isSafe)</div>
408
+ <div class="line"><a name="l00337"></a><span class="lineno"> 337</span>&#160; {</div>
409
+ <div class="line"><a name="l00338"></a><span class="lineno"> 338</span>&#160; std::cout &lt;&lt; <span class="stringliteral">&quot;safe buffer access success\n&quot;</span>;</div>
410
+ <div class="line"><a name="l00339"></a><span class="lineno"> 339</span>&#160; <span class="keywordflow">return</span>;</div>
411
+ <div class="line"><a name="l00340"></a><span class="lineno"> 340</span>&#160; }</div>
412
+ <div class="line"><a name="l00341"></a><span class="lineno"> 341</span>&#160; <span class="keywordflow">else</span></div>
413
+ <div class="line"><a name="l00342"></a><span class="lineno"> 342</span>&#160; {</div>
414
+ <div class="line"><a name="l00343"></a><span class="lineno"> 343</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> err_msg = <span class="stringliteral">&quot;this SAFE_BUFACCESS should be a safe access but detected buffer overflow. Pos: &quot;</span>;</div>
415
+ <div class="line"><a name="l00344"></a><span class="lineno"> 344</span>&#160; err_msg += cs.getInstruction()-&gt;getSourceLoc();</div>
416
+ <div class="line"><a name="l00345"></a><span class="lineno"> 345</span>&#160; std::cerr &lt;&lt; err_msg &lt;&lt; std::endl;</div>
417
+ <div class="line"><a name="l00346"></a><span class="lineno"> 346</span>&#160; assert(<span class="keyword">false</span>);</div>
418
+ <div class="line"><a name="l00347"></a><span class="lineno"> 347</span>&#160; }</div>
419
+ <div class="line"><a name="l00348"></a><span class="lineno"> 348</span>&#160; };</div>
420
+ <div class="line"><a name="l00349"></a><span class="lineno"> 349</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;SAFE_BUFACCESS&quot;</span>] = safe_bufaccess;</div>
421
+ <div class="line"><a name="l00350"></a><span class="lineno"> 350</span>&#160; </div>
422
+ <div class="line"><a name="l00351"></a><span class="lineno"> 351</span>&#160; <span class="keyword">auto</span> unsafe_bufaccess = [&amp;](<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> &amp;cs)</div>
423
+ <div class="line"><a name="l00352"></a><span class="lineno"> 352</span>&#160; {</div>
424
+ <div class="line"><a name="l00353"></a><span class="lineno"> 353</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a>* callNode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
425
+ <div class="line"><a name="l00354"></a><span class="lineno"> 354</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a219313e979d779221116c1bc45becc1b">_checkpoints</a>.erase(callNode);</div>
426
+ <div class="line"><a name="l00355"></a><span class="lineno"> 355</span>&#160; <span class="comment">//void UNSAFE_BUFACCESS(void* data, int size);</span></div>
427
+ <div class="line"><a name="l00356"></a><span class="lineno"> 356</span>&#160; <span class="keywordflow">if</span> (cs.arg_size() &lt; 2) <span class="keywordflow">return</span>;</div>
428
+ <div class="line"><a name="l00357"></a><span class="lineno"> 357</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp;as = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a57e4ee3fde79c408dffe98894210d7c9">getAbsState</a>(callNode);</div>
429
+ <div class="line"><a name="l00358"></a><span class="lineno"> 358</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> size_id = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.getArgument(1));</div>
430
+ <div class="line"><a name="l00359"></a><span class="lineno"> 359</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> val = as[size_id];</div>
431
+ <div class="line"><a name="l00360"></a><span class="lineno"> 360</span>&#160; <span class="keywordflow">if</span> (val.<a class="code" href="structSVF_1_1AbstractValue.html#a8b1af972fa8a4e40347990d179ec1c52">isBottom</a>())</div>
432
432
  <div class="line"><a name="l00361"></a><span class="lineno"> 361</span>&#160; {</div>
433
- <div class="line"><a name="l00362"></a><span class="lineno"> 362</span>&#160; <span class="comment">// if it is safe, it means it is wrongly labeled, assert false.</span></div>
434
- <div class="line"><a name="l00363"></a><span class="lineno"> 363</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> err_msg = <span class="stringliteral">&quot;this UNSAFE_BUFACCESS should be a buffer overflow but not detected. Pos: &quot;</span>;</div>
435
- <div class="line"><a name="l00364"></a><span class="lineno"> 364</span>&#160; err_msg += cs.getInstruction()-&gt;getSourceLoc();</div>
436
- <div class="line"><a name="l00365"></a><span class="lineno"> 365</span>&#160; std::cerr &lt;&lt; err_msg &lt;&lt; std::endl;</div>
437
- <div class="line"><a name="l00366"></a><span class="lineno"> 366</span>&#160; assert(<span class="keyword">false</span>);</div>
438
- <div class="line"><a name="l00367"></a><span class="lineno"> 367</span>&#160; }</div>
439
- <div class="line"><a name="l00368"></a><span class="lineno"> 368</span>&#160; };</div>
440
- <div class="line"><a name="l00369"></a><span class="lineno"> 369</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;UNSAFE_BUFACCESS&quot;</span>] = unsafe_bufaccess;</div>
441
- <div class="line"><a name="l00370"></a><span class="lineno"> 370</span>&#160; </div>
442
- <div class="line"><a name="l00371"></a><span class="lineno"> 371</span>&#160; <span class="comment">// init _checkpoint_names</span></div>
443
- <div class="line"><a name="l00372"></a><span class="lineno"> 372</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a1e1b72ed740cef4c3e57e3e32c3f75">_checkpoint_names</a>.insert(<span class="stringliteral">&quot;SAFE_BUFACCESS&quot;</span>);</div>
444
- <div class="line"><a name="l00373"></a><span class="lineno"> 373</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a1e1b72ed740cef4c3e57e3e32c3f75">_checkpoint_names</a>.insert(<span class="stringliteral">&quot;UNSAFE_BUFACCESS&quot;</span>);</div>
445
- <div class="line"><a name="l00374"></a><span class="lineno"> 374</span>&#160;}</div>
446
- <div class="line"><a name="l00375"></a><span class="lineno"> 375</span>&#160; </div>
447
- <div class="line"><a name="l00376"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#aa68f8aef09481d7c07dc59d7dfb83822"> 376</a></span>&#160;<span class="keywordtype">bool</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#aa68f8aef09481d7c07dc59d7dfb83822">BufOverflowChecker::detectStrcat</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a> *call)</div>
448
- <div class="line"><a name="l00377"></a><span class="lineno"> 377</span>&#160;{</div>
449
- <div class="line"><a name="l00378"></a><span class="lineno"> 378</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFFunction.html">SVFFunction</a> *fun = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a145abbd2958629718fbca41d25c3124d">SVFUtil::getCallee</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
450
- <div class="line"><a name="l00379"></a><span class="lineno"> 379</span>&#160; <span class="comment">// check the arg size</span></div>
451
- <div class="line"><a name="l00380"></a><span class="lineno"> 380</span>&#160; <span class="comment">// if it is strcat group, we need to check the length of string,</span></div>
452
- <div class="line"><a name="l00381"></a><span class="lineno"> 381</span>&#160; <span class="comment">// e.g. strcat(str1, str2); which checks AllocSize(str1) &gt;= Strlen(str1) + Strlen(str2);</span></div>
453
- <div class="line"><a name="l00382"></a><span class="lineno"> 382</span>&#160; <span class="comment">// if it is strncat group, we do not need to check the length of string,</span></div>
454
- <div class="line"><a name="l00383"></a><span class="lineno"> 383</span>&#160; <span class="comment">// e.g. strncat(str1, str2, n); which checks AllocSize(str1) &gt;= Strlen(str1) + n;</span></div>
455
- <div class="line"><a name="l00384"></a><span class="lineno"> 384</span>&#160; </div>
456
- <div class="line"><a name="l00385"></a><span class="lineno"> 385</span>&#160; <span class="keyword">const</span> std::vector&lt;std::string&gt; strcatGroup = {<span class="stringliteral">&quot;__strcat_chk&quot;</span>, <span class="stringliteral">&quot;strcat&quot;</span>, <span class="stringliteral">&quot;__wcscat_chk&quot;</span>, <span class="stringliteral">&quot;wcscat&quot;</span>};</div>
457
- <div class="line"><a name="l00386"></a><span class="lineno"> 386</span>&#160; <span class="keyword">const</span> std::vector&lt;std::string&gt; strncatGroup = {<span class="stringliteral">&quot;__strncat_chk&quot;</span>, <span class="stringliteral">&quot;strncat&quot;</span>, <span class="stringliteral">&quot;__wcsncat_chk&quot;</span>, <span class="stringliteral">&quot;wcsncat&quot;</span>};</div>
458
- <div class="line"><a name="l00387"></a><span class="lineno"> 387</span>&#160; <span class="keywordflow">if</span> (std::find(strcatGroup.begin(), strcatGroup.end(), fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>()) != strcatGroup.end())</div>
459
- <div class="line"><a name="l00388"></a><span class="lineno"> 388</span>&#160; {</div>
460
- <div class="line"><a name="l00389"></a><span class="lineno"> 389</span>&#160; <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> cs = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a9815a5b31ac7dc21239d08e5b9f61106">SVFUtil::getSVFCallSite</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
461
- <div class="line"><a name="l00390"></a><span class="lineno"> 390</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg0Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(0);</div>
462
- <div class="line"><a name="l00391"></a><span class="lineno"> 391</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg1Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(1);</div>
463
- <div class="line"><a name="l00392"></a><span class="lineno"> 392</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> strLen0 = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a5bba3c0570d73acc743742a30af1b0b4">getStrlen</a>(arg0Val);</div>
464
- <div class="line"><a name="l00393"></a><span class="lineno"> 393</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> strLen1 = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a5bba3c0570d73acc743742a30af1b0b4">getStrlen</a>(arg1Val);</div>
465
- <div class="line"><a name="l00394"></a><span class="lineno"> 394</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> totalLen = strLen0 + strLen1;</div>
466
- <div class="line"><a name="l00395"></a><span class="lineno"> 395</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(arg0Val, totalLen, call);</div>
467
- <div class="line"><a name="l00396"></a><span class="lineno"> 396</span>&#160; }</div>
468
- <div class="line"><a name="l00397"></a><span class="lineno"> 397</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (std::find(strncatGroup.begin(), strncatGroup.end(), fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>()) != strncatGroup.end())</div>
469
- <div class="line"><a name="l00398"></a><span class="lineno"> 398</span>&#160; {</div>
470
- <div class="line"><a name="l00399"></a><span class="lineno"> 399</span>&#160; <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> cs = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a9815a5b31ac7dc21239d08e5b9f61106">SVFUtil::getSVFCallSite</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
471
- <div class="line"><a name="l00400"></a><span class="lineno"> 400</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg0Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(0);</div>
472
- <div class="line"><a name="l00401"></a><span class="lineno"> 401</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg2Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(2);</div>
473
- <div class="line"><a name="l00402"></a><span class="lineno"> 402</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> arg2Num =</div>
474
- <div class="line"><a name="l00403"></a><span class="lineno"> 403</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>()[<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(arg2Val)];</div>
475
- <div class="line"><a name="l00404"></a><span class="lineno"> 404</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> strLen0 = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a5bba3c0570d73acc743742a30af1b0b4">getStrlen</a>(arg0Val);</div>
476
- <div class="line"><a name="l00405"></a><span class="lineno"> 405</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> totalLen = strLen0 + arg2Num;</div>
433
+ <div class="line"><a name="l00362"></a><span class="lineno"> 362</span>&#160; assert(<span class="keyword">false</span> &amp;&amp; <span class="stringliteral">&quot;UNSAFE_BUFACCESS size is bottom&quot;</span>);</div>
434
+ <div class="line"><a name="l00363"></a><span class="lineno"> 363</span>&#160; }</div>
435
+ <div class="line"><a name="l00364"></a><span class="lineno"> 364</span>&#160; <span class="keywordtype">bool</span> isSafe = <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.getArgument(0), val, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(cs.getInstruction()));</div>
436
+ <div class="line"><a name="l00365"></a><span class="lineno"> 365</span>&#160; <span class="keywordflow">if</span> (!isSafe)</div>
437
+ <div class="line"><a name="l00366"></a><span class="lineno"> 366</span>&#160; {</div>
438
+ <div class="line"><a name="l00367"></a><span class="lineno"> 367</span>&#160; std::cout &lt;&lt; <span class="stringliteral">&quot;detect buffer overflow success\n&quot;</span>;</div>
439
+ <div class="line"><a name="l00368"></a><span class="lineno"> 368</span>&#160; <span class="keywordflow">return</span>;</div>
440
+ <div class="line"><a name="l00369"></a><span class="lineno"> 369</span>&#160; }</div>
441
+ <div class="line"><a name="l00370"></a><span class="lineno"> 370</span>&#160; <span class="keywordflow">else</span></div>
442
+ <div class="line"><a name="l00371"></a><span class="lineno"> 371</span>&#160; {</div>
443
+ <div class="line"><a name="l00372"></a><span class="lineno"> 372</span>&#160; <span class="comment">// if it is safe, it means it is wrongly labeled, assert false.</span></div>
444
+ <div class="line"><a name="l00373"></a><span class="lineno"> 373</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> err_msg = <span class="stringliteral">&quot;this UNSAFE_BUFACCESS should be a buffer overflow but not detected. Pos: &quot;</span>;</div>
445
+ <div class="line"><a name="l00374"></a><span class="lineno"> 374</span>&#160; err_msg += cs.getInstruction()-&gt;getSourceLoc();</div>
446
+ <div class="line"><a name="l00375"></a><span class="lineno"> 375</span>&#160; std::cerr &lt;&lt; err_msg &lt;&lt; std::endl;</div>
447
+ <div class="line"><a name="l00376"></a><span class="lineno"> 376</span>&#160; assert(<span class="keyword">false</span>);</div>
448
+ <div class="line"><a name="l00377"></a><span class="lineno"> 377</span>&#160; }</div>
449
+ <div class="line"><a name="l00378"></a><span class="lineno"> 378</span>&#160; };</div>
450
+ <div class="line"><a name="l00379"></a><span class="lineno"> 379</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">_func_map</a>[<span class="stringliteral">&quot;UNSAFE_BUFACCESS&quot;</span>] = unsafe_bufaccess;</div>
451
+ <div class="line"><a name="l00380"></a><span class="lineno"> 380</span>&#160; </div>
452
+ <div class="line"><a name="l00381"></a><span class="lineno"> 381</span>&#160; <span class="comment">// init _checkpoint_names</span></div>
453
+ <div class="line"><a name="l00382"></a><span class="lineno"> 382</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a1e1b72ed740cef4c3e57e3e32c3f75">_checkpoint_names</a>.insert(<span class="stringliteral">&quot;SAFE_BUFACCESS&quot;</span>);</div>
454
+ <div class="line"><a name="l00383"></a><span class="lineno"> 383</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a1e1b72ed740cef4c3e57e3e32c3f75">_checkpoint_names</a>.insert(<span class="stringliteral">&quot;UNSAFE_BUFACCESS&quot;</span>);</div>
455
+ <div class="line"><a name="l00384"></a><span class="lineno"> 384</span>&#160;}</div>
456
+ <div class="line"><a name="l00385"></a><span class="lineno"> 385</span>&#160; </div>
457
+ <div class="line"><a name="l00386"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#aa68f8aef09481d7c07dc59d7dfb83822"> 386</a></span>&#160;<span class="keywordtype">bool</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#aa68f8aef09481d7c07dc59d7dfb83822">BufOverflowChecker::detectStrcat</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a> *call)</div>
458
+ <div class="line"><a name="l00387"></a><span class="lineno"> 387</span>&#160;{</div>
459
+ <div class="line"><a name="l00388"></a><span class="lineno"> 388</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp; as = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a57e4ee3fde79c408dffe98894210d7c9">getAbsState</a>(call);</div>
460
+ <div class="line"><a name="l00389"></a><span class="lineno"> 389</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFFunction.html">SVFFunction</a> *fun = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a145abbd2958629718fbca41d25c3124d">SVFUtil::getCallee</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
461
+ <div class="line"><a name="l00390"></a><span class="lineno"> 390</span>&#160; <span class="comment">// check the arg size</span></div>
462
+ <div class="line"><a name="l00391"></a><span class="lineno"> 391</span>&#160; <span class="comment">// if it is strcat group, we need to check the length of string,</span></div>
463
+ <div class="line"><a name="l00392"></a><span class="lineno"> 392</span>&#160; <span class="comment">// e.g. strcat(str1, str2); which checks AllocSize(str1) &gt;= Strlen(str1) + Strlen(str2);</span></div>
464
+ <div class="line"><a name="l00393"></a><span class="lineno"> 393</span>&#160; <span class="comment">// if it is strncat group, we do not need to check the length of string,</span></div>
465
+ <div class="line"><a name="l00394"></a><span class="lineno"> 394</span>&#160; <span class="comment">// e.g. strncat(str1, str2, n); which checks AllocSize(str1) &gt;= Strlen(str1) + n;</span></div>
466
+ <div class="line"><a name="l00395"></a><span class="lineno"> 395</span>&#160; </div>
467
+ <div class="line"><a name="l00396"></a><span class="lineno"> 396</span>&#160; <span class="keyword">const</span> std::vector&lt;std::string&gt; strcatGroup = {<span class="stringliteral">&quot;__strcat_chk&quot;</span>, <span class="stringliteral">&quot;strcat&quot;</span>, <span class="stringliteral">&quot;__wcscat_chk&quot;</span>, <span class="stringliteral">&quot;wcscat&quot;</span>};</div>
468
+ <div class="line"><a name="l00397"></a><span class="lineno"> 397</span>&#160; <span class="keyword">const</span> std::vector&lt;std::string&gt; strncatGroup = {<span class="stringliteral">&quot;__strncat_chk&quot;</span>, <span class="stringliteral">&quot;strncat&quot;</span>, <span class="stringliteral">&quot;__wcsncat_chk&quot;</span>, <span class="stringliteral">&quot;wcsncat&quot;</span>};</div>
469
+ <div class="line"><a name="l00398"></a><span class="lineno"> 398</span>&#160; <span class="keywordflow">if</span> (std::find(strcatGroup.begin(), strcatGroup.end(), fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>()) != strcatGroup.end())</div>
470
+ <div class="line"><a name="l00399"></a><span class="lineno"> 399</span>&#160; {</div>
471
+ <div class="line"><a name="l00400"></a><span class="lineno"> 400</span>&#160; <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> cs = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a9815a5b31ac7dc21239d08e5b9f61106">SVFUtil::getSVFCallSite</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
472
+ <div class="line"><a name="l00401"></a><span class="lineno"> 401</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg0Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(0);</div>
473
+ <div class="line"><a name="l00402"></a><span class="lineno"> 402</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg1Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(1);</div>
474
+ <div class="line"><a name="l00403"></a><span class="lineno"> 403</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> strLen0 = <a class="code" href="classSVF_1_1AbstractInterpretation.html#ab076eddb7908768126c190c23b91eb85">getStrlen</a>(as, arg0Val);</div>
475
+ <div class="line"><a name="l00404"></a><span class="lineno"> 404</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> strLen1 = <a class="code" href="classSVF_1_1AbstractInterpretation.html#ab076eddb7908768126c190c23b91eb85">getStrlen</a>(as, arg1Val);</div>
476
+ <div class="line"><a name="l00405"></a><span class="lineno"> 405</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> totalLen = strLen0 + strLen1;</div>
477
477
  <div class="line"><a name="l00406"></a><span class="lineno"> 406</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(arg0Val, totalLen, call);</div>
478
478
  <div class="line"><a name="l00407"></a><span class="lineno"> 407</span>&#160; }</div>
479
- <div class="line"><a name="l00408"></a><span class="lineno"> 408</span>&#160; <span class="keywordflow">else</span></div>
479
+ <div class="line"><a name="l00408"></a><span class="lineno"> 408</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (std::find(strncatGroup.begin(), strncatGroup.end(), fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>()) != strncatGroup.end())</div>
480
480
  <div class="line"><a name="l00409"></a><span class="lineno"> 409</span>&#160; {</div>
481
- <div class="line"><a name="l00410"></a><span class="lineno"> 410</span>&#160; assert(<span class="keyword">false</span> &amp;&amp; <span class="stringliteral">&quot;unknown strcat function, please add it to strcatGroup or strncatGroup&quot;</span>);</div>
482
- <div class="line"><a name="l00411"></a><span class="lineno"> 411</span>&#160; abort();</div>
483
- <div class="line"><a name="l00412"></a><span class="lineno"> 412</span>&#160; }</div>
484
- <div class="line"><a name="l00413"></a><span class="lineno"> 413</span>&#160;}</div>
485
- <div class="line"><a name="l00414"></a><span class="lineno"> 414</span>&#160; </div>
486
- <div class="line"><a name="l00415"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#a1ed3cb0a1a118d9e505b192841a58dde"> 415</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#a1ed3cb0a1a118d9e505b192841a58dde">BufOverflowChecker::handleExtAPI</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a> *call)</div>
487
- <div class="line"><a name="l00416"></a><span class="lineno"> 416</span>&#160;{</div>
488
- <div class="line"><a name="l00417"></a><span class="lineno"> 417</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a6cac9b69d85111a5a26373ec848a3282">AbstractInterpretation::handleExtAPI</a>(call);</div>
489
- <div class="line"><a name="l00418"></a><span class="lineno"> 418</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFFunction.html">SVFFunction</a> *fun = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a145abbd2958629718fbca41d25c3124d">SVFUtil::getCallee</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
490
- <div class="line"><a name="l00419"></a><span class="lineno"> 419</span>&#160; assert(fun &amp;&amp; <span class="stringliteral">&quot;SVFFunction* is nullptr&quot;</span>);</div>
491
- <div class="line"><a name="l00420"></a><span class="lineno"> 420</span>&#160; <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> cs = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a9815a5b31ac7dc21239d08e5b9f61106">SVFUtil::getSVFCallSite</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
492
- <div class="line"><a name="l00421"></a><span class="lineno"> 421</span>&#160; <span class="comment">// check the type of mem api,</span></div>
493
- <div class="line"><a name="l00422"></a><span class="lineno"> 422</span>&#160; <span class="comment">// MEMCPY: like memcpy, memcpy_chk, llvm.memcpy etc.</span></div>
494
- <div class="line"><a name="l00423"></a><span class="lineno"> 423</span>&#160; <span class="comment">// MEMSET: like memset, memset_chk, llvm.memset etc.</span></div>
495
- <div class="line"><a name="l00424"></a><span class="lineno"> 424</span>&#160; <span class="comment">// STRCPY: like strcpy, strcpy_chk, wcscpy etc.</span></div>
496
- <div class="line"><a name="l00425"></a><span class="lineno"> 425</span>&#160; <span class="comment">// STRCAT: like strcat, strcat_chk, wcscat etc.</span></div>
497
- <div class="line"><a name="l00426"></a><span class="lineno"> 426</span>&#160; <span class="comment">// for other ext api like printf, scanf, etc., they have their own handlers</span></div>
498
- <div class="line"><a name="l00427"></a><span class="lineno"> 427</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616da">ExtAPIType</a> extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daad20658cd0f68b92583461b0b1f68d543">UNCLASSIFIED</a>;</div>
499
- <div class="line"><a name="l00428"></a><span class="lineno"> 428</span>&#160; <span class="comment">// get type of mem api</span></div>
500
- <div class="line"><a name="l00429"></a><span class="lineno"> 429</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">const</span> <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> &amp;annotation: fun-&gt;<a class="code" href="classSVF_1_1SVFFunction.html#a067bd6dbaf74a028d546fa56b095791b">getAnnotations</a>())</div>
501
- <div class="line"><a name="l00430"></a><span class="lineno"> 430</span>&#160; {</div>
502
- <div class="line"><a name="l00431"></a><span class="lineno"> 431</span>&#160; <span class="keywordflow">if</span> (annotation.find(<span class="stringliteral">&quot;MEMCPY&quot;</span>) != std::string::npos)</div>
503
- <div class="line"><a name="l00432"></a><span class="lineno"> 432</span>&#160; extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa9cc269dadf9cff7d399c54d9570a6614">MEMCPY</a>;</div>
504
- <div class="line"><a name="l00433"></a><span class="lineno"> 433</span>&#160; <span class="keywordflow">if</span> (annotation.find(<span class="stringliteral">&quot;MEMSET&quot;</span>) != std::string::npos)</div>
505
- <div class="line"><a name="l00434"></a><span class="lineno"> 434</span>&#160; extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa5aec33226dc590ec951d0f12bf35f15f">MEMSET</a>;</div>
506
- <div class="line"><a name="l00435"></a><span class="lineno"> 435</span>&#160; <span class="keywordflow">if</span> (annotation.find(<span class="stringliteral">&quot;STRCPY&quot;</span>) != std::string::npos)</div>
507
- <div class="line"><a name="l00436"></a><span class="lineno"> 436</span>&#160; extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa93c9b2a9dc4bdfba5a7b23cfa5f80ccb">STRCPY</a>;</div>
508
- <div class="line"><a name="l00437"></a><span class="lineno"> 437</span>&#160; <span class="keywordflow">if</span> (annotation.find(<span class="stringliteral">&quot;STRCAT&quot;</span>) != std::string::npos)</div>
509
- <div class="line"><a name="l00438"></a><span class="lineno"> 438</span>&#160; extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daae8dad405c06383859d8db715fd455317">STRCAT</a>;</div>
510
- <div class="line"><a name="l00439"></a><span class="lineno"> 439</span>&#160; }</div>
511
- <div class="line"><a name="l00440"></a><span class="lineno"> 440</span>&#160; <span class="comment">// 1. memcpy functions like memcpy_chk, strncpy, annotate(&quot;MEMCPY&quot;), annotate(&quot;BUF_CHECK:Arg0, Arg2&quot;), annotate(&quot;BUF_CHECK:Arg1, Arg2&quot;)</span></div>
512
- <div class="line"><a name="l00441"></a><span class="lineno"> 441</span>&#160; <span class="keywordflow">if</span> (extType == <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa9cc269dadf9cff7d399c54d9570a6614">MEMCPY</a>)</div>
513
- <div class="line"><a name="l00442"></a><span class="lineno"> 442</span>&#160; {</div>
514
- <div class="line"><a name="l00443"></a><span class="lineno"> 443</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>.count(fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>()) == 0)</div>
515
- <div class="line"><a name="l00444"></a><span class="lineno"> 444</span>&#160; {</div>
516
- <div class="line"><a name="l00445"></a><span class="lineno"> 445</span>&#160; <span class="comment">// if it is not in the rules, we do not check it</span></div>
517
- <div class="line"><a name="l00446"></a><span class="lineno"> 446</span>&#160; <a class="code" href="namespaceSVF_1_1SVFUtil.html#ab65033f068bfbeb0a1c52dcec3beb6bc">SVFUtil::errs</a>() &lt;&lt; <span class="stringliteral">&quot;Warning: &quot;</span> &lt;&lt; fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>() &lt;&lt; <span class="stringliteral">&quot; is not in the rules, please implement it\n&quot;</span>;</div>
518
- <div class="line"><a name="l00447"></a><span class="lineno"> 447</span>&#160; <span class="keywordflow">return</span>;</div>
519
- <div class="line"><a name="l00448"></a><span class="lineno"> 448</span>&#160; }</div>
520
- <div class="line"><a name="l00449"></a><span class="lineno"> 449</span>&#160; <span class="comment">// call parseMemcpyBufferCheckArgs to parse the BUF_CHECK annotation</span></div>
521
- <div class="line"><a name="l00450"></a><span class="lineno"> 450</span>&#160; std::vector&lt;std::pair&lt;u32_t, u32_t&gt;&gt; args = <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>.at(fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>());</div>
522
- <div class="line"><a name="l00451"></a><span class="lineno"> 451</span>&#160; <span class="comment">// loop the args and check the offset</span></div>
523
- <div class="line"><a name="l00452"></a><span class="lineno"> 452</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> arg: args)</div>
524
- <div class="line"><a name="l00453"></a><span class="lineno"> 453</span>&#160; {</div>
525
- <div class="line"><a name="l00454"></a><span class="lineno"> 454</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> <a class="code" href="cJSON_8cpp.html#a95bf816579e97b6f33bdb5e25ed6d5de">offset</a> =</div>
526
- <div class="line"><a name="l00455"></a><span class="lineno"> 455</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>()[<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(arg.second))] - <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(1);</div>
527
- <div class="line"><a name="l00456"></a><span class="lineno"> 456</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(arg.first), <a class="code" href="cJSON_8cpp.html#a95bf816579e97b6f33bdb5e25ed6d5de">offset</a>, call);</div>
528
- <div class="line"><a name="l00457"></a><span class="lineno"> 457</span>&#160; }</div>
529
- <div class="line"><a name="l00458"></a><span class="lineno"> 458</span>&#160; }</div>
530
- <div class="line"><a name="l00459"></a><span class="lineno"> 459</span>&#160; <span class="comment">// 2. memset functions like memset, memset_chk, annotate(&quot;MEMSET&quot;), annotate(&quot;BUF_CHECK:Arg0, Arg2&quot;)</span></div>
531
- <div class="line"><a name="l00460"></a><span class="lineno"> 460</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (extType == <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa5aec33226dc590ec951d0f12bf35f15f">MEMSET</a>)</div>
532
- <div class="line"><a name="l00461"></a><span class="lineno"> 461</span>&#160; {</div>
533
- <div class="line"><a name="l00462"></a><span class="lineno"> 462</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>.count(fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>()) == 0)</div>
534
- <div class="line"><a name="l00463"></a><span class="lineno"> 463</span>&#160; {</div>
535
- <div class="line"><a name="l00464"></a><span class="lineno"> 464</span>&#160; <span class="comment">// if it is not in the rules, we do not check it</span></div>
536
- <div class="line"><a name="l00465"></a><span class="lineno"> 465</span>&#160; <a class="code" href="namespaceSVF_1_1SVFUtil.html#ab65033f068bfbeb0a1c52dcec3beb6bc">SVFUtil::errs</a>() &lt;&lt; <span class="stringliteral">&quot;Warning: &quot;</span> &lt;&lt; fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>() &lt;&lt; <span class="stringliteral">&quot; is not in the rules, please implement it\n&quot;</span>;</div>
537
- <div class="line"><a name="l00466"></a><span class="lineno"> 466</span>&#160; <span class="keywordflow">return</span>;</div>
481
+ <div class="line"><a name="l00410"></a><span class="lineno"> 410</span>&#160; <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> cs = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a9815a5b31ac7dc21239d08e5b9f61106">SVFUtil::getSVFCallSite</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
482
+ <div class="line"><a name="l00411"></a><span class="lineno"> 411</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg0Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(0);</div>
483
+ <div class="line"><a name="l00412"></a><span class="lineno"> 412</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a>* arg2Val = cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(2);</div>
484
+ <div class="line"><a name="l00413"></a><span class="lineno"> 413</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> arg2Num = as[<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(arg2Val)];</div>
485
+ <div class="line"><a name="l00414"></a><span class="lineno"> 414</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> strLen0 = <a class="code" href="classSVF_1_1AbstractInterpretation.html#ab076eddb7908768126c190c23b91eb85">getStrlen</a>(as, arg0Val);</div>
486
+ <div class="line"><a name="l00415"></a><span class="lineno"> 415</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> totalLen = strLen0 + arg2Num;</div>
487
+ <div class="line"><a name="l00416"></a><span class="lineno"> 416</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(arg0Val, totalLen, call);</div>
488
+ <div class="line"><a name="l00417"></a><span class="lineno"> 417</span>&#160; }</div>
489
+ <div class="line"><a name="l00418"></a><span class="lineno"> 418</span>&#160; <span class="keywordflow">else</span></div>
490
+ <div class="line"><a name="l00419"></a><span class="lineno"> 419</span>&#160; {</div>
491
+ <div class="line"><a name="l00420"></a><span class="lineno"> 420</span>&#160; assert(<span class="keyword">false</span> &amp;&amp; <span class="stringliteral">&quot;unknown strcat function, please add it to strcatGroup or strncatGroup&quot;</span>);</div>
492
+ <div class="line"><a name="l00421"></a><span class="lineno"> 421</span>&#160; abort();</div>
493
+ <div class="line"><a name="l00422"></a><span class="lineno"> 422</span>&#160; }</div>
494
+ <div class="line"><a name="l00423"></a><span class="lineno"> 423</span>&#160;}</div>
495
+ <div class="line"><a name="l00424"></a><span class="lineno"> 424</span>&#160; </div>
496
+ <div class="line"><a name="l00425"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#a1ed3cb0a1a118d9e505b192841a58dde"> 425</a></span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#a1ed3cb0a1a118d9e505b192841a58dde">BufOverflowChecker::handleExtAPI</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a> *call)</div>
497
+ <div class="line"><a name="l00426"></a><span class="lineno"> 426</span>&#160;{</div>
498
+ <div class="line"><a name="l00427"></a><span class="lineno"> 427</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp; as = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a57e4ee3fde79c408dffe98894210d7c9">getAbsState</a>(call);</div>
499
+ <div class="line"><a name="l00428"></a><span class="lineno"> 428</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a6cac9b69d85111a5a26373ec848a3282">AbstractInterpretation::handleExtAPI</a>(call);</div>
500
+ <div class="line"><a name="l00429"></a><span class="lineno"> 429</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFFunction.html">SVFFunction</a> *fun = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a145abbd2958629718fbca41d25c3124d">SVFUtil::getCallee</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
501
+ <div class="line"><a name="l00430"></a><span class="lineno"> 430</span>&#160; assert(fun &amp;&amp; <span class="stringliteral">&quot;SVFFunction* is nullptr&quot;</span>);</div>
502
+ <div class="line"><a name="l00431"></a><span class="lineno"> 431</span>&#160; <a class="code" href="classSVF_1_1CallSite.html">CallSite</a> cs = <a class="code" href="namespaceSVF_1_1SVFUtil.html#a9815a5b31ac7dc21239d08e5b9f61106">SVFUtil::getSVFCallSite</a>(call-&gt;<a class="code" href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">getCallSite</a>());</div>
503
+ <div class="line"><a name="l00432"></a><span class="lineno"> 432</span>&#160; <span class="comment">// check the type of mem api,</span></div>
504
+ <div class="line"><a name="l00433"></a><span class="lineno"> 433</span>&#160; <span class="comment">// MEMCPY: like memcpy, memcpy_chk, llvm.memcpy etc.</span></div>
505
+ <div class="line"><a name="l00434"></a><span class="lineno"> 434</span>&#160; <span class="comment">// MEMSET: like memset, memset_chk, llvm.memset etc.</span></div>
506
+ <div class="line"><a name="l00435"></a><span class="lineno"> 435</span>&#160; <span class="comment">// STRCPY: like strcpy, strcpy_chk, wcscpy etc.</span></div>
507
+ <div class="line"><a name="l00436"></a><span class="lineno"> 436</span>&#160; <span class="comment">// STRCAT: like strcat, strcat_chk, wcscat etc.</span></div>
508
+ <div class="line"><a name="l00437"></a><span class="lineno"> 437</span>&#160; <span class="comment">// for other ext api like printf, scanf, etc., they have their own handlers</span></div>
509
+ <div class="line"><a name="l00438"></a><span class="lineno"> 438</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616da">ExtAPIType</a> extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daad20658cd0f68b92583461b0b1f68d543">UNCLASSIFIED</a>;</div>
510
+ <div class="line"><a name="l00439"></a><span class="lineno"> 439</span>&#160; <span class="comment">// get type of mem api</span></div>
511
+ <div class="line"><a name="l00440"></a><span class="lineno"> 440</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">const</span> <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> &amp;annotation: fun-&gt;<a class="code" href="classSVF_1_1SVFFunction.html#a067bd6dbaf74a028d546fa56b095791b">getAnnotations</a>())</div>
512
+ <div class="line"><a name="l00441"></a><span class="lineno"> 441</span>&#160; {</div>
513
+ <div class="line"><a name="l00442"></a><span class="lineno"> 442</span>&#160; <span class="keywordflow">if</span> (annotation.find(<span class="stringliteral">&quot;MEMCPY&quot;</span>) != std::string::npos)</div>
514
+ <div class="line"><a name="l00443"></a><span class="lineno"> 443</span>&#160; extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa9cc269dadf9cff7d399c54d9570a6614">MEMCPY</a>;</div>
515
+ <div class="line"><a name="l00444"></a><span class="lineno"> 444</span>&#160; <span class="keywordflow">if</span> (annotation.find(<span class="stringliteral">&quot;MEMSET&quot;</span>) != std::string::npos)</div>
516
+ <div class="line"><a name="l00445"></a><span class="lineno"> 445</span>&#160; extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa5aec33226dc590ec951d0f12bf35f15f">MEMSET</a>;</div>
517
+ <div class="line"><a name="l00446"></a><span class="lineno"> 446</span>&#160; <span class="keywordflow">if</span> (annotation.find(<span class="stringliteral">&quot;STRCPY&quot;</span>) != std::string::npos)</div>
518
+ <div class="line"><a name="l00447"></a><span class="lineno"> 447</span>&#160; extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa93c9b2a9dc4bdfba5a7b23cfa5f80ccb">STRCPY</a>;</div>
519
+ <div class="line"><a name="l00448"></a><span class="lineno"> 448</span>&#160; <span class="keywordflow">if</span> (annotation.find(<span class="stringliteral">&quot;STRCAT&quot;</span>) != std::string::npos)</div>
520
+ <div class="line"><a name="l00449"></a><span class="lineno"> 449</span>&#160; extType = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daae8dad405c06383859d8db715fd455317">STRCAT</a>;</div>
521
+ <div class="line"><a name="l00450"></a><span class="lineno"> 450</span>&#160; }</div>
522
+ <div class="line"><a name="l00451"></a><span class="lineno"> 451</span>&#160; <span class="comment">// 1. memcpy functions like memcpy_chk, strncpy, annotate(&quot;MEMCPY&quot;), annotate(&quot;BUF_CHECK:Arg0, Arg2&quot;), annotate(&quot;BUF_CHECK:Arg1, Arg2&quot;)</span></div>
523
+ <div class="line"><a name="l00452"></a><span class="lineno"> 452</span>&#160; <span class="keywordflow">if</span> (extType == <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa9cc269dadf9cff7d399c54d9570a6614">MEMCPY</a>)</div>
524
+ <div class="line"><a name="l00453"></a><span class="lineno"> 453</span>&#160; {</div>
525
+ <div class="line"><a name="l00454"></a><span class="lineno"> 454</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>.count(fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>()) == 0)</div>
526
+ <div class="line"><a name="l00455"></a><span class="lineno"> 455</span>&#160; {</div>
527
+ <div class="line"><a name="l00456"></a><span class="lineno"> 456</span>&#160; <span class="comment">// if it is not in the rules, we do not check it</span></div>
528
+ <div class="line"><a name="l00457"></a><span class="lineno"> 457</span>&#160; <a class="code" href="namespaceSVF_1_1SVFUtil.html#ab65033f068bfbeb0a1c52dcec3beb6bc">SVFUtil::errs</a>() &lt;&lt; <span class="stringliteral">&quot;Warning: &quot;</span> &lt;&lt; fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>() &lt;&lt; <span class="stringliteral">&quot; is not in the rules, please implement it\n&quot;</span>;</div>
529
+ <div class="line"><a name="l00458"></a><span class="lineno"> 458</span>&#160; <span class="keywordflow">return</span>;</div>
530
+ <div class="line"><a name="l00459"></a><span class="lineno"> 459</span>&#160; }</div>
531
+ <div class="line"><a name="l00460"></a><span class="lineno"> 460</span>&#160; <span class="comment">// call parseMemcpyBufferCheckArgs to parse the BUF_CHECK annotation</span></div>
532
+ <div class="line"><a name="l00461"></a><span class="lineno"> 461</span>&#160; std::vector&lt;std::pair&lt;u32_t, u32_t&gt;&gt; args = <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>.at(fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>());</div>
533
+ <div class="line"><a name="l00462"></a><span class="lineno"> 462</span>&#160; <span class="comment">// loop the args and check the offset</span></div>
534
+ <div class="line"><a name="l00463"></a><span class="lineno"> 463</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> arg: args)</div>
535
+ <div class="line"><a name="l00464"></a><span class="lineno"> 464</span>&#160; {</div>
536
+ <div class="line"><a name="l00465"></a><span class="lineno"> 465</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> <a class="code" href="cJSON_8cpp.html#a95bf816579e97b6f33bdb5e25ed6d5de">offset</a> = as[<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(arg.second))] - <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(1);</div>
537
+ <div class="line"><a name="l00466"></a><span class="lineno"> 466</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(arg.first), <a class="code" href="cJSON_8cpp.html#a95bf816579e97b6f33bdb5e25ed6d5de">offset</a>, call);</div>
538
538
  <div class="line"><a name="l00467"></a><span class="lineno"> 467</span>&#160; }</div>
539
- <div class="line"><a name="l00468"></a><span class="lineno"> 468</span>&#160; std::vector&lt;std::pair&lt;u32_t, u32_t&gt;&gt; args = <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>.at(fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>());</div>
540
- <div class="line"><a name="l00469"></a><span class="lineno"> 469</span>&#160; <span class="comment">// loop the args and check the offset</span></div>
541
- <div class="line"><a name="l00470"></a><span class="lineno"> 470</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> arg: args)</div>
542
- <div class="line"><a name="l00471"></a><span class="lineno"> 471</span>&#160; {</div>
543
- <div class="line"><a name="l00472"></a><span class="lineno"> 472</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> <a class="code" href="cJSON_8cpp.html#a95bf816579e97b6f33bdb5e25ed6d5de">offset</a> =</div>
544
- <div class="line"><a name="l00473"></a><span class="lineno"> 473</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>()[<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(arg.second))] - <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(1);</div>
545
- <div class="line"><a name="l00474"></a><span class="lineno"> 474</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(arg.first), <a class="code" href="cJSON_8cpp.html#a95bf816579e97b6f33bdb5e25ed6d5de">offset</a>, call);</div>
546
- <div class="line"><a name="l00475"></a><span class="lineno"> 475</span>&#160; }</div>
547
- <div class="line"><a name="l00476"></a><span class="lineno"> 476</span>&#160; }</div>
548
- <div class="line"><a name="l00477"></a><span class="lineno"> 477</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (extType == <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa93c9b2a9dc4bdfba5a7b23cfa5f80ccb">STRCPY</a>)</div>
549
- <div class="line"><a name="l00478"></a><span class="lineno"> 478</span>&#160; {</div>
550
- <div class="line"><a name="l00479"></a><span class="lineno"> 479</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad8b2f2fa6f22b9d1655135c819cbad8a">detectStrcpy</a>(call);</div>
551
- <div class="line"><a name="l00480"></a><span class="lineno"> 480</span>&#160; }</div>
552
- <div class="line"><a name="l00481"></a><span class="lineno"> 481</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (extType == <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daae8dad405c06383859d8db715fd455317">STRCAT</a>)</div>
553
- <div class="line"><a name="l00482"></a><span class="lineno"> 482</span>&#160; {</div>
554
- <div class="line"><a name="l00483"></a><span class="lineno"> 483</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#aa68f8aef09481d7c07dc59d7dfb83822">detectStrcat</a>(call);</div>
555
- <div class="line"><a name="l00484"></a><span class="lineno"> 484</span>&#160; }</div>
556
- <div class="line"><a name="l00485"></a><span class="lineno"> 485</span>&#160; <span class="keywordflow">else</span></div>
557
- <div class="line"><a name="l00486"></a><span class="lineno"> 486</span>&#160; {</div>
558
- <div class="line"><a name="l00487"></a><span class="lineno"> 487</span>&#160; </div>
559
- <div class="line"><a name="l00488"></a><span class="lineno"> 488</span>&#160; }</div>
560
- <div class="line"><a name="l00489"></a><span class="lineno"> 489</span>&#160; <span class="keywordflow">return</span>;</div>
561
- <div class="line"><a name="l00490"></a><span class="lineno"> 490</span>&#160;}</div>
562
- <div class="line"><a name="l00491"></a><span class="lineno"> 491</span>&#160; </div>
563
- <div class="line"><a name="l00492"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf"> 492</a></span>&#160;<span class="keywordtype">bool</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">BufOverflowChecker::canSafelyAccessMemory</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a> *value, <span class="keyword">const</span> <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> &amp;len, <span class="keyword">const</span> <a class="code" href="classSVF_1_1ICFGNode.html">ICFGNode</a> *curNode)</div>
564
- <div class="line"><a name="l00493"></a><span class="lineno"> 493</span>&#160;{</div>
565
- <div class="line"><a name="l00494"></a><span class="lineno"> 494</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a> *firstValue = value;</div>
539
+ <div class="line"><a name="l00468"></a><span class="lineno"> 468</span>&#160; }</div>
540
+ <div class="line"><a name="l00469"></a><span class="lineno"> 469</span>&#160; <span class="comment">// 2. memset functions like memset, memset_chk, annotate(&quot;MEMSET&quot;), annotate(&quot;BUF_CHECK:Arg0, Arg2&quot;)</span></div>
541
+ <div class="line"><a name="l00470"></a><span class="lineno"> 470</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (extType == <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa5aec33226dc590ec951d0f12bf35f15f">MEMSET</a>)</div>
542
+ <div class="line"><a name="l00471"></a><span class="lineno"> 471</span>&#160; {</div>
543
+ <div class="line"><a name="l00472"></a><span class="lineno"> 472</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>.count(fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>()) == 0)</div>
544
+ <div class="line"><a name="l00473"></a><span class="lineno"> 473</span>&#160; {</div>
545
+ <div class="line"><a name="l00474"></a><span class="lineno"> 474</span>&#160; <span class="comment">// if it is not in the rules, we do not check it</span></div>
546
+ <div class="line"><a name="l00475"></a><span class="lineno"> 475</span>&#160; <a class="code" href="namespaceSVF_1_1SVFUtil.html#ab65033f068bfbeb0a1c52dcec3beb6bc">SVFUtil::errs</a>() &lt;&lt; <span class="stringliteral">&quot;Warning: &quot;</span> &lt;&lt; fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>() &lt;&lt; <span class="stringliteral">&quot; is not in the rules, please implement it\n&quot;</span>;</div>
547
+ <div class="line"><a name="l00476"></a><span class="lineno"> 476</span>&#160; <span class="keywordflow">return</span>;</div>
548
+ <div class="line"><a name="l00477"></a><span class="lineno"> 477</span>&#160; }</div>
549
+ <div class="line"><a name="l00478"></a><span class="lineno"> 478</span>&#160; std::vector&lt;std::pair&lt;u32_t, u32_t&gt;&gt; args = <a class="code" href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">_extAPIBufOverflowCheckRules</a>.at(fun-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">getName</a>());</div>
550
+ <div class="line"><a name="l00479"></a><span class="lineno"> 479</span>&#160; <span class="comment">// loop the args and check the offset</span></div>
551
+ <div class="line"><a name="l00480"></a><span class="lineno"> 480</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> arg: args)</div>
552
+ <div class="line"><a name="l00481"></a><span class="lineno"> 481</span>&#160; {</div>
553
+ <div class="line"><a name="l00482"></a><span class="lineno"> 482</span>&#160; <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> <a class="code" href="cJSON_8cpp.html#a95bf816579e97b6f33bdb5e25ed6d5de">offset</a> = as[<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(arg.second))] - <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(1);</div>
554
+ <div class="line"><a name="l00483"></a><span class="lineno"> 483</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(cs.<a class="code" href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">getArgument</a>(arg.first), <a class="code" href="cJSON_8cpp.html#a95bf816579e97b6f33bdb5e25ed6d5de">offset</a>, call);</div>
555
+ <div class="line"><a name="l00484"></a><span class="lineno"> 484</span>&#160; }</div>
556
+ <div class="line"><a name="l00485"></a><span class="lineno"> 485</span>&#160; }</div>
557
+ <div class="line"><a name="l00486"></a><span class="lineno"> 486</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (extType == <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa93c9b2a9dc4bdfba5a7b23cfa5f80ccb">STRCPY</a>)</div>
558
+ <div class="line"><a name="l00487"></a><span class="lineno"> 487</span>&#160; {</div>
559
+ <div class="line"><a name="l00488"></a><span class="lineno"> 488</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad8b2f2fa6f22b9d1655135c819cbad8a">detectStrcpy</a>(call);</div>
560
+ <div class="line"><a name="l00489"></a><span class="lineno"> 489</span>&#160; }</div>
561
+ <div class="line"><a name="l00490"></a><span class="lineno"> 490</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (extType == <a class="code" href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daae8dad405c06383859d8db715fd455317">STRCAT</a>)</div>
562
+ <div class="line"><a name="l00491"></a><span class="lineno"> 491</span>&#160; {</div>
563
+ <div class="line"><a name="l00492"></a><span class="lineno"> 492</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#aa68f8aef09481d7c07dc59d7dfb83822">detectStrcat</a>(call);</div>
564
+ <div class="line"><a name="l00493"></a><span class="lineno"> 493</span>&#160; }</div>
565
+ <div class="line"><a name="l00494"></a><span class="lineno"> 494</span>&#160; <span class="keywordflow">else</span></div>
566
+ <div class="line"><a name="l00495"></a><span class="lineno"> 495</span>&#160; {</div>
567
+ <div class="line"><a name="l00496"></a><span class="lineno"> 496</span>&#160; </div>
568
+ <div class="line"><a name="l00497"></a><span class="lineno"> 497</span>&#160; }</div>
569
+ <div class="line"><a name="l00498"></a><span class="lineno"> 498</span>&#160; <span class="keywordflow">return</span>;</div>
570
+ <div class="line"><a name="l00499"></a><span class="lineno"> 499</span>&#160;}</div>
566
571
  <div class="line"><a name="l00500"></a><span class="lineno"> 500</span>&#160; </div>
567
- <div class="line"><a name="l00503"></a><span class="lineno"> 503</span>&#160; <a class="code" href="classSVF_1_1FILOWorkList.html">SVF::FILOWorkList&lt;const SVFValue *&gt;</a> worklist;</div>
568
- <div class="line"><a name="l00504"></a><span class="lineno"> 504</span>&#160; <a class="code" href="namespaceSVF.html#af739db846e47ba6b2fd15eaad31ab7fb">Set&lt;const SVFValue *&gt;</a> visited;</div>
569
- <div class="line"><a name="l00505"></a><span class="lineno"> 505</span>&#160; visited.insert(value);</div>
570
- <div class="line"><a name="l00506"></a><span class="lineno"> 506</span>&#160; <a class="code" href="namespaceSVF.html#a8234d4b959abc9123993bcff4eee34c1">Map&lt;const ICFGNode *, IntervalValue&gt;</a> gep_offsets;</div>
571
- <div class="line"><a name="l00507"></a><span class="lineno"> 507</span>&#160; <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a> total_bytes = len.<a class="code" href="structSVF_1_1AbstractValue.html#acbcec6f55d23e6cd278fe8572a68f393">getInterval</a>();</div>
572
- <div class="line"><a name="l00508"></a><span class="lineno"> 508</span>&#160; worklist.<a class="code" href="classSVF_1_1FILOWorkList.html#afcf3fcda18e8d3e2bad70a51376c0ce1">push</a>(value);</div>
573
- <div class="line"><a name="l00509"></a><span class="lineno"> 509</span>&#160; std::vector&lt;const CallICFGNode *&gt; callstack = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9885b50cf28b65bebb488442085fab26">_callSiteStack</a>;</div>
574
- <div class="line"><a name="l00510"></a><span class="lineno"> 510</span>&#160; <span class="keywordflow">while</span> (!worklist.<a class="code" href="classSVF_1_1FILOWorkList.html#a071a624c91def82a4bbbf3806c7b7eea">empty</a>())</div>
575
- <div class="line"><a name="l00511"></a><span class="lineno"> 511</span>&#160; {</div>
576
- <div class="line"><a name="l00512"></a><span class="lineno"> 512</span>&#160; value = worklist.<a class="code" href="classSVF_1_1FILOWorkList.html#a3fd9acb6d09fd142bfd402fdf8cac93b">pop</a>();</div>
577
- <div class="line"><a name="l00513"></a><span class="lineno"> 513</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFInstruction.html">SVFInstruction</a> *ins = SVFUtil::dyn_cast&lt;SVFInstruction&gt;(value))</div>
578
- <div class="line"><a name="l00514"></a><span class="lineno"> 514</span>&#160; {</div>
579
- <div class="line"><a name="l00515"></a><span class="lineno"> 515</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1ICFGNode.html">ICFGNode</a> *node = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(ins);</div>
580
- <div class="line"><a name="l00516"></a><span class="lineno"> 516</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a> *callnode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(node))</div>
581
- <div class="line"><a name="l00517"></a><span class="lineno"> 517</span>&#160; {</div>
582
- <div class="line"><a name="l00518"></a><span class="lineno"> 518</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a29fe7c63c61a7aec8ae1477a061f5bf2">AccessMemoryViaRetNode</a>(callnode, worklist, visited);</div>
583
- <div class="line"><a name="l00519"></a><span class="lineno"> 519</span>&#160; }</div>
584
- <div class="line"><a name="l00520"></a><span class="lineno"> 520</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFStmt.html">SVFStmt</a> *stmt: node-&gt;<a class="code" href="classSVF_1_1ICFGNode.html#a6c68f52dd90728073fb79141df9b0661">getSVFStmts</a>())</div>
585
- <div class="line"><a name="l00521"></a><span class="lineno"> 521</span>&#160; {</div>
586
- <div class="line"><a name="l00522"></a><span class="lineno"> 522</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1CopyStmt.html">CopyStmt</a> *<a class="code" href="cJSON_8cpp.html#a7669ee67a0563250c1efaa24d130e1ac">copy</a> = SVFUtil::dyn_cast&lt;CopyStmt&gt;(stmt))</div>
587
- <div class="line"><a name="l00523"></a><span class="lineno"> 523</span>&#160; {</div>
588
- <div class="line"><a name="l00524"></a><span class="lineno"> 524</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a550c12360c2149ba0e55bdf4cf7b8dd0">AccessMemoryViaCopyStmt</a>(<a class="code" href="cJSON_8cpp.html#a7669ee67a0563250c1efaa24d130e1ac">copy</a>, worklist, visited);</div>
589
- <div class="line"><a name="l00525"></a><span class="lineno"> 525</span>&#160; }</div>
590
- <div class="line"><a name="l00526"></a><span class="lineno"> 526</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1LoadStmt.html">LoadStmt</a> *load = SVFUtil::dyn_cast&lt;LoadStmt&gt;(stmt))</div>
591
- <div class="line"><a name="l00527"></a><span class="lineno"> 527</span>&#160; {</div>
592
- <div class="line"><a name="l00528"></a><span class="lineno"> 528</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#ac60581a57407fa4c65b1975f5be687b8">AccessMemoryViaLoadStmt</a>(load, worklist, visited);</div>
593
- <div class="line"><a name="l00529"></a><span class="lineno"> 529</span>&#160; }</div>
594
- <div class="line"><a name="l00530"></a><span class="lineno"> 530</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1GepStmt.html">GepStmt</a> *gep = SVFUtil::dyn_cast&lt;GepStmt&gt;(stmt))</div>
595
- <div class="line"><a name="l00531"></a><span class="lineno"> 531</span>&#160; {</div>
596
- <div class="line"><a name="l00532"></a><span class="lineno"> 532</span>&#160; <span class="comment">// there are 3 type of gepStmt</span></div>
597
- <div class="line"><a name="l00533"></a><span class="lineno"> 533</span>&#160; <span class="comment">// 1. ptr get offset</span></div>
598
- <div class="line"><a name="l00534"></a><span class="lineno"> 534</span>&#160; <span class="comment">// 2. struct get field</span></div>
599
- <div class="line"><a name="l00535"></a><span class="lineno"> 535</span>&#160; <span class="comment">// 3. array get element</span></div>
600
- <div class="line"><a name="l00536"></a><span class="lineno"> 536</span>&#160; <span class="comment">// for array gep, there are two kind of overflow checking</span></div>
601
- <div class="line"><a name="l00537"></a><span class="lineno"> 537</span>&#160; <span class="comment">// Arr [Struct.C * 10] arr, Struct.C {i32 a, i32 b}</span></div>
602
- <div class="line"><a name="l00538"></a><span class="lineno"> 538</span>&#160; <span class="comment">// arr[11].a = **, it is &quot;lhs = gep *arr, 0 (ptr), 11 (arrIdx), 0 (ptr), 0(struct field)&quot;</span></div>
603
- <div class="line"><a name="l00539"></a><span class="lineno"> 539</span>&#160; <span class="comment">// 1) in this case arrIdx 11 is overflow.</span></div>
604
- <div class="line"><a name="l00540"></a><span class="lineno"> 540</span>&#160; <span class="comment">// Other case,</span></div>
605
- <div class="line"><a name="l00541"></a><span class="lineno"> 541</span>&#160; <span class="comment">// Struct.C {i32 a, [i32*10] b, i32 c}, C.b[11] = 1</span></div>
606
- <div class="line"><a name="l00542"></a><span class="lineno"> 542</span>&#160; <span class="comment">// it is &quot;lhs - gep *C, 0(ptr), 1(struct field), 0(ptr), 11(arrIdx)&quot;</span></div>
607
- <div class="line"><a name="l00543"></a><span class="lineno"> 543</span>&#160; <span class="comment">// 2) in this case arrIdx 11 is larger than its getOffsetVar.Type Array([i32*10])</span></div>
608
- <div class="line"><a name="l00544"></a><span class="lineno"> 544</span>&#160; </div>
609
- <div class="line"><a name="l00545"></a><span class="lineno"> 545</span>&#160; <span class="comment">// therefore, if last getOffsetVar.Type is not the Array, just check the overall offset and its</span></div>
610
- <div class="line"><a name="l00546"></a><span class="lineno"> 546</span>&#160; <span class="comment">// gep source type size (together with totalOffset along the value flow).</span></div>
611
- <div class="line"><a name="l00547"></a><span class="lineno"> 547</span>&#160; <span class="comment">// so if curgepOffset + totalOffset &gt;= gepSrc (overflow)</span></div>
612
- <div class="line"><a name="l00548"></a><span class="lineno"> 548</span>&#160; <span class="comment">// else totalOffset += curgepOffset</span></div>
613
- <div class="line"><a name="l00549"></a><span class="lineno"> 549</span>&#160; </div>
614
- <div class="line"><a name="l00550"></a><span class="lineno"> 550</span>&#160; <span class="comment">// otherwise, if last getOffsetVar.Type is the Array, check the last idx and array. (just offset,</span></div>
615
- <div class="line"><a name="l00551"></a><span class="lineno"> 551</span>&#160; <span class="comment">// not with totalOffset during check)</span></div>
616
- <div class="line"><a name="l00552"></a><span class="lineno"> 552</span>&#160; <span class="comment">// so if getOffsetVarVal &gt; getOffsetVar.TypeSize (overflow)</span></div>
617
- <div class="line"><a name="l00553"></a><span class="lineno"> 553</span>&#160; <span class="comment">// else safe and return.</span></div>
618
- <div class="line"><a name="l00554"></a><span class="lineno"> 554</span>&#160; <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a> byteOffset;</div>
619
- <div class="line"><a name="l00555"></a><span class="lineno"> 555</span>&#160; <span class="keywordflow">if</span> (gep-&gt;isConstantOffset())</div>
620
- <div class="line"><a name="l00556"></a><span class="lineno"> 556</span>&#160; {</div>
621
- <div class="line"><a name="l00557"></a><span class="lineno"> 557</span>&#160; byteOffset = <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(gep-&gt;accumulateConstantByteOffset());</div>
622
- <div class="line"><a name="l00558"></a><span class="lineno"> 558</span>&#160; }</div>
623
- <div class="line"><a name="l00559"></a><span class="lineno"> 559</span>&#160; <span class="keywordflow">else</span></div>
624
- <div class="line"><a name="l00560"></a><span class="lineno"> 560</span>&#160; {</div>
625
- <div class="line"><a name="l00561"></a><span class="lineno"> 561</span>&#160; byteOffset =</div>
626
- <div class="line"><a name="l00562"></a><span class="lineno"> 562</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a21e927af79c73460ff5629cbd4961163">getByteOffset</a>(gep).<a class="code" href="structSVF_1_1AbstractValue.html#acbcec6f55d23e6cd278fe8572a68f393">getInterval</a>();</div>
627
- <div class="line"><a name="l00563"></a><span class="lineno"> 563</span>&#160; }</div>
628
- <div class="line"><a name="l00564"></a><span class="lineno"> 564</span>&#160; <span class="comment">// for variable offset, join with accumulate gep offset</span></div>
629
- <div class="line"><a name="l00565"></a><span class="lineno"> 565</span>&#160; gep_offsets[gep-&gt;getICFGNode()] = byteOffset;</div>
630
- <div class="line"><a name="l00566"></a><span class="lineno"> 566</span>&#160; <span class="keywordflow">if</span> (byteOffset.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &gt;= <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>() &amp;&amp; <a class="code" href="classSVF_1_1Options.html#a6450b984f67d3cfa3f44892e8eea555e">Options::GepUnknownIdx</a>())</div>
631
- <div class="line"><a name="l00567"></a><span class="lineno"> 567</span>&#160; {</div>
632
- <div class="line"><a name="l00568"></a><span class="lineno"> 568</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
633
- <div class="line"><a name="l00569"></a><span class="lineno"> 569</span>&#160; }</div>
634
- <div class="line"><a name="l00570"></a><span class="lineno"> 570</span>&#160; </div>
635
- <div class="line"><a name="l00571"></a><span class="lineno"> 571</span>&#160; <span class="keywordflow">if</span> (gep-&gt;getOffsetVarAndGepTypePairVec().size() &gt; 0)</div>
636
- <div class="line"><a name="l00572"></a><span class="lineno"> 572</span>&#160; {</div>
637
- <div class="line"><a name="l00573"></a><span class="lineno"> 573</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFVar.html">SVFVar</a> *gepVal = gep-&gt;getOffsetVarAndGepTypePairVec().back().first;</div>
638
- <div class="line"><a name="l00574"></a><span class="lineno"> 574</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFType.html">SVFType</a> *gepType = gep-&gt;getOffsetVarAndGepTypePairVec().back().second;</div>
639
- <div class="line"><a name="l00575"></a><span class="lineno"> 575</span>&#160; </div>
640
- <div class="line"><a name="l00576"></a><span class="lineno"> 576</span>&#160; <span class="keywordflow">if</span> (gepType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a330084f9a3deb6e5acb52a8ee3eb7fe4">isArrayTy</a>())</div>
641
- <div class="line"><a name="l00577"></a><span class="lineno"> 577</span>&#160; {</div>
642
- <div class="line"><a name="l00578"></a><span class="lineno"> 578</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFArrayType.html">SVFArrayType</a> *gepArrType = SVFUtil::dyn_cast&lt;SVFArrayType&gt;(gepType);</div>
643
- <div class="line"><a name="l00579"></a><span class="lineno"> 579</span>&#160; <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a> gepArrTotalByte(0);</div>
644
- <div class="line"><a name="l00580"></a><span class="lineno"> 580</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a> *idxValue = gepVal-&gt;<a class="code" href="classSVF_1_1SVFVar.html#ac2db6304ea5526fb446ae882983beeb0">getValue</a>();</div>
645
- <div class="line"><a name="l00581"></a><span class="lineno"> 581</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> arrElemSize = gepArrType-&gt;<a class="code" href="classSVF_1_1SVFArrayType.html#a28da1169748e38b891133b76568a2759">getTypeOfElement</a>()-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
646
- <div class="line"><a name="l00582"></a><span class="lineno"> 582</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFConstantInt.html">SVFConstantInt</a> *op = SVFUtil::dyn_cast&lt;SVFConstantInt&gt;(idxValue))</div>
647
- <div class="line"><a name="l00583"></a><span class="lineno"> 583</span>&#160; {</div>
648
- <div class="line"><a name="l00584"></a><span class="lineno"> 584</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> lb = (double) <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>() / arrElemSize &gt;= op-&gt;getSExtValue() ?</div>
649
- <div class="line"><a name="l00585"></a><span class="lineno"> 585</span>&#160; op-&gt;getSExtValue() * arrElemSize : <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>();</div>
650
- <div class="line"><a name="l00586"></a><span class="lineno"> 586</span>&#160; gepArrTotalByte = gepArrTotalByte + <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(lb, lb);</div>
651
- <div class="line"><a name="l00587"></a><span class="lineno"> 587</span>&#160; }</div>
652
- <div class="line"><a name="l00588"></a><span class="lineno"> 588</span>&#160; <span class="keywordflow">else</span></div>
653
- <div class="line"><a name="l00589"></a><span class="lineno"> 589</span>&#160; {</div>
654
- <div class="line"><a name="l00590"></a><span class="lineno"> 590</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> idx = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(idxValue);</div>
655
- <div class="line"><a name="l00591"></a><span class="lineno"> 591</span>&#160; <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a> idxVal =</div>
656
- <div class="line"><a name="l00592"></a><span class="lineno"> 592</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">getAbsState</a>()[idx].getInterval();</div>
657
- <div class="line"><a name="l00593"></a><span class="lineno"> 593</span>&#160; <span class="keywordflow">if</span> (idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#a674f9bb98053f8658e246863d6561072">isBottom</a>())</div>
658
- <div class="line"><a name="l00594"></a><span class="lineno"> 594</span>&#160; {</div>
659
- <div class="line"><a name="l00595"></a><span class="lineno"> 595</span>&#160; gepArrTotalByte = gepArrTotalByte + <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(0, 0);</div>
660
- <div class="line"><a name="l00596"></a><span class="lineno"> 596</span>&#160; }</div>
661
- <div class="line"><a name="l00597"></a><span class="lineno"> 597</span>&#160; <span class="keywordflow">else</span></div>
662
- <div class="line"><a name="l00598"></a><span class="lineno"> 598</span>&#160; {</div>
663
- <div class="line"><a name="l00599"></a><span class="lineno"> 599</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> ub = (idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &lt; 0) ? 0 :</div>
664
- <div class="line"><a name="l00600"></a><span class="lineno"> 600</span>&#160; (<span class="keywordtype">double</span>) <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>() / arrElemSize &gt;=</div>
665
- <div class="line"><a name="l00601"></a><span class="lineno"> 601</span>&#160; idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() ?</div>
666
- <div class="line"><a name="l00602"></a><span class="lineno"> 602</span>&#160; arrElemSize * idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() : <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>();</div>
667
- <div class="line"><a name="l00603"></a><span class="lineno"> 603</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> lb = (idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &lt; 0) ? 0 :</div>
668
- <div class="line"><a name="l00604"></a><span class="lineno"> 604</span>&#160; ((<span class="keywordtype">double</span>) <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>() / arrElemSize &gt;=</div>
669
- <div class="line"><a name="l00605"></a><span class="lineno"> 605</span>&#160; idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>()) ?</div>
670
- <div class="line"><a name="l00606"></a><span class="lineno"> 606</span>&#160; arrElemSize * idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() : <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>();</div>
671
- <div class="line"><a name="l00607"></a><span class="lineno"> 607</span>&#160; gepArrTotalByte = gepArrTotalByte + <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(lb, ub);</div>
672
- <div class="line"><a name="l00608"></a><span class="lineno"> 608</span>&#160; }</div>
673
- <div class="line"><a name="l00609"></a><span class="lineno"> 609</span>&#160; }</div>
674
- <div class="line"><a name="l00610"></a><span class="lineno"> 610</span>&#160; total_bytes = total_bytes + gepArrTotalByte;</div>
675
- <div class="line"><a name="l00611"></a><span class="lineno"> 611</span>&#160; <span class="keywordflow">if</span> (total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &gt;= gepArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>())</div>
676
- <div class="line"><a name="l00612"></a><span class="lineno"> 612</span>&#160; {</div>
677
- <div class="line"><a name="l00613"></a><span class="lineno"> 613</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> msg =</div>
678
- <div class="line"><a name="l00614"></a><span class="lineno"> 614</span>&#160; <span class="stringliteral">&quot;Buffer overflow!! Accessing buffer range: &quot;</span> +</div>
679
- <div class="line"><a name="l00615"></a><span class="lineno"> 615</span>&#160; <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(total_bytes) +</div>
680
- <div class="line"><a name="l00616"></a><span class="lineno"> 616</span>&#160; <span class="stringliteral">&quot;\nAllocated Gep buffer size: &quot;</span> +</div>
681
- <div class="line"><a name="l00617"></a><span class="lineno"> 617</span>&#160; std::to_string(gepArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>()) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
682
- <div class="line"><a name="l00618"></a><span class="lineno"> 618</span>&#160; msg += <span class="stringliteral">&quot;Position: &quot;</span> + firstValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a4a0cfe3a8f37d33ffcdca3d66026dcc3">toString</a>() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
683
- <div class="line"><a name="l00619"></a><span class="lineno"> 619</span>&#160; msg += <span class="stringliteral">&quot; The following is the value flow. [[\n&quot;</span>;</div>
684
- <div class="line"><a name="l00620"></a><span class="lineno"> 620</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> it = gep_offsets.begin(); it != gep_offsets.end(); ++it)</div>
685
- <div class="line"><a name="l00621"></a><span class="lineno"> 621</span>&#160; {</div>
686
- <div class="line"><a name="l00622"></a><span class="lineno"> 622</span>&#160; msg += it-&gt;first-&gt;toString() + <span class="stringliteral">&quot;, Offset: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(it-&gt;second) +</div>
687
- <div class="line"><a name="l00623"></a><span class="lineno"> 623</span>&#160; <span class="stringliteral">&quot;\n&quot;</span>;</div>
688
- <div class="line"><a name="l00624"></a><span class="lineno"> 624</span>&#160; }</div>
689
- <div class="line"><a name="l00625"></a><span class="lineno"> 625</span>&#160; msg += <span class="stringliteral">&quot;]].\nAlloc Site: &quot;</span> + gep-&gt;toString() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
690
- <div class="line"><a name="l00626"></a><span class="lineno"> 626</span>&#160; </div>
691
- <div class="line"><a name="l00627"></a><span class="lineno"> 627</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<a class="code" href="namespaceSVF_1_1SVFUtil.html#a7655b13bbfe720ca2b8a25e0a72528e6">SVFUtil::errMsg</a>(msg), gepArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>(),</div>
692
- <div class="line"><a name="l00628"></a><span class="lineno"> 628</span>&#160; gepArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>(),</div>
693
- <div class="line"><a name="l00629"></a><span class="lineno"> 629</span>&#160; total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(), total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(),</div>
694
- <div class="line"><a name="l00630"></a><span class="lineno"> 630</span>&#160; firstValue);</div>
695
- <div class="line"><a name="l00631"></a><span class="lineno"> 631</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, curNode);</div>
696
- <div class="line"><a name="l00632"></a><span class="lineno"> 632</span>&#160; <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
697
- <div class="line"><a name="l00633"></a><span class="lineno"> 633</span>&#160; }</div>
698
- <div class="line"><a name="l00634"></a><span class="lineno"> 634</span>&#160; <span class="keywordflow">else</span></div>
699
- <div class="line"><a name="l00635"></a><span class="lineno"> 635</span>&#160; {</div>
700
- <div class="line"><a name="l00636"></a><span class="lineno"> 636</span>&#160; <span class="comment">// for gep last index&#39;s type is arr, stop here.</span></div>
701
- <div class="line"><a name="l00637"></a><span class="lineno"> 637</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
702
- <div class="line"><a name="l00638"></a><span class="lineno"> 638</span>&#160; }</div>
703
- <div class="line"><a name="l00639"></a><span class="lineno"> 639</span>&#160; }</div>
704
- <div class="line"><a name="l00640"></a><span class="lineno"> 640</span>&#160; <span class="keywordflow">else</span></div>
705
- <div class="line"><a name="l00641"></a><span class="lineno"> 641</span>&#160; {</div>
706
- <div class="line"><a name="l00642"></a><span class="lineno"> 642</span>&#160; total_bytes = total_bytes + byteOffset;</div>
707
- <div class="line"><a name="l00643"></a><span class="lineno"> 643</span>&#160; }</div>
708
- <div class="line"><a name="l00644"></a><span class="lineno"> 644</span>&#160; </div>
709
- <div class="line"><a name="l00645"></a><span class="lineno"> 645</span>&#160; }</div>
710
- <div class="line"><a name="l00646"></a><span class="lineno"> 646</span>&#160; <span class="keywordflow">if</span> (!visited.count(gep-&gt;getRHSVar()-&gt;getValue()))</div>
711
- <div class="line"><a name="l00647"></a><span class="lineno"> 647</span>&#160; {</div>
712
- <div class="line"><a name="l00648"></a><span class="lineno"> 648</span>&#160; visited.insert(gep-&gt;getRHSVar()-&gt;getValue());</div>
713
- <div class="line"><a name="l00649"></a><span class="lineno"> 649</span>&#160; worklist.<a class="code" href="classSVF_1_1FILOWorkList.html#afcf3fcda18e8d3e2bad70a51376c0ce1">push</a>(gep-&gt;getRHSVar()-&gt;getValue());</div>
714
- <div class="line"><a name="l00650"></a><span class="lineno"> 650</span>&#160; }</div>
715
- <div class="line"><a name="l00651"></a><span class="lineno"> 651</span>&#160; }</div>
716
- <div class="line"><a name="l00652"></a><span class="lineno"> 652</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1AddrStmt.html">AddrStmt</a> *addr = SVFUtil::dyn_cast&lt;AddrStmt&gt;(stmt))</div>
717
- <div class="line"><a name="l00653"></a><span class="lineno"> 653</span>&#160; {</div>
718
- <div class="line"><a name="l00654"></a><span class="lineno"> 654</span>&#160; <span class="comment">// addrStmt is source node.</span></div>
719
- <div class="line"><a name="l00655"></a><span class="lineno"> 655</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> arr_type_size = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a0e8b546f608417e218c2fab5a5893135">getAllocaInstByteSize</a>(addr);</div>
720
- <div class="line"><a name="l00656"></a><span class="lineno"> 656</span>&#160; <span class="keywordflow">if</span> (total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &gt;= arr_type_size ||</div>
721
- <div class="line"><a name="l00657"></a><span class="lineno"> 657</span>&#160; total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &lt; 0)</div>
722
- <div class="line"><a name="l00658"></a><span class="lineno"> 658</span>&#160; {</div>
723
- <div class="line"><a name="l00659"></a><span class="lineno"> 659</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> msg =</div>
724
- <div class="line"><a name="l00660"></a><span class="lineno"> 660</span>&#160; <span class="stringliteral">&quot;Buffer overflow!! Accessing buffer range: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(total_bytes) +</div>
725
- <div class="line"><a name="l00661"></a><span class="lineno"> 661</span>&#160; <span class="stringliteral">&quot;\nAllocated buffer size: &quot;</span> + std::to_string(arr_type_size) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
726
- <div class="line"><a name="l00662"></a><span class="lineno"> 662</span>&#160; msg += <span class="stringliteral">&quot;Position: &quot;</span> + firstValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a4a0cfe3a8f37d33ffcdca3d66026dcc3">toString</a>() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
727
- <div class="line"><a name="l00663"></a><span class="lineno"> 663</span>&#160; msg += <span class="stringliteral">&quot; The following is the value flow. [[\n&quot;</span>;</div>
728
- <div class="line"><a name="l00664"></a><span class="lineno"> 664</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> it = gep_offsets.begin(); it != gep_offsets.end(); ++it)</div>
729
- <div class="line"><a name="l00665"></a><span class="lineno"> 665</span>&#160; {</div>
730
- <div class="line"><a name="l00666"></a><span class="lineno"> 666</span>&#160; msg += it-&gt;first-&gt;toString() + <span class="stringliteral">&quot;, Offset: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(it-&gt;second) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
731
- <div class="line"><a name="l00667"></a><span class="lineno"> 667</span>&#160; }</div>
732
- <div class="line"><a name="l00668"></a><span class="lineno"> 668</span>&#160; msg += <span class="stringliteral">&quot;]].\n Alloc Site: &quot;</span> + addr-&gt;toString() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
733
- <div class="line"><a name="l00669"></a><span class="lineno"> 669</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<a class="code" href="namespaceSVF_1_1SVFUtil.html#ac71522e8c55f84cfc6c13a0ddff18436">SVFUtil::wrnMsg</a>(msg), arr_type_size, arr_type_size,</div>
734
- <div class="line"><a name="l00670"></a><span class="lineno"> 670</span>&#160; total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(), total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(),</div>
735
- <div class="line"><a name="l00671"></a><span class="lineno"> 671</span>&#160; firstValue);</div>
736
- <div class="line"><a name="l00672"></a><span class="lineno"> 672</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, curNode);</div>
737
- <div class="line"><a name="l00673"></a><span class="lineno"> 673</span>&#160; <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
738
- <div class="line"><a name="l00674"></a><span class="lineno"> 674</span>&#160; }</div>
739
- <div class="line"><a name="l00675"></a><span class="lineno"> 675</span>&#160; <span class="keywordflow">else</span></div>
740
- <div class="line"><a name="l00676"></a><span class="lineno"> 676</span>&#160; {</div>
741
- <div class="line"><a name="l00677"></a><span class="lineno"> 677</span>&#160; </div>
742
- <div class="line"><a name="l00678"></a><span class="lineno"> 678</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
743
- <div class="line"><a name="l00679"></a><span class="lineno"> 679</span>&#160; }</div>
744
- <div class="line"><a name="l00680"></a><span class="lineno"> 680</span>&#160; }</div>
745
- <div class="line"><a name="l00681"></a><span class="lineno"> 681</span>&#160; }</div>
746
- <div class="line"><a name="l00682"></a><span class="lineno"> 682</span>&#160; }</div>
747
- <div class="line"><a name="l00683"></a><span class="lineno"> 683</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFGlobalValue.html">SVF::SVFGlobalValue</a> *gvalue = SVFUtil::dyn_cast&lt;SVF::SVFGlobalValue&gt;(value))</div>
748
- <div class="line"><a name="l00684"></a><span class="lineno"> 684</span>&#160; {</div>
749
- <div class="line"><a name="l00685"></a><span class="lineno"> 685</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> arr_type_size = 0;</div>
750
- <div class="line"><a name="l00686"></a><span class="lineno"> 686</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFType.html">SVFType</a> *svftype = gvalue-&gt;getType();</div>
751
- <div class="line"><a name="l00687"></a><span class="lineno"> 687</span>&#160; <span class="keywordflow">if</span> (SVFUtil::isa&lt;SVFPointerType&gt;(svftype))</div>
752
- <div class="line"><a name="l00688"></a><span class="lineno"> 688</span>&#160; {</div>
753
- <div class="line"><a name="l00689"></a><span class="lineno"> 689</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFArrayType.html">SVFArrayType</a> *ptrArrType = SVFUtil::dyn_cast&lt;SVFArrayType&gt;(</div>
754
- <div class="line"><a name="l00690"></a><span class="lineno"> 690</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2057e8e1c0aaf39e74f0a8fb2a1b580c">getPointeeElement</a>(<a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(gvalue))))</div>
755
- <div class="line"><a name="l00691"></a><span class="lineno"> 691</span>&#160; arr_type_size = ptrArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
756
- <div class="line"><a name="l00692"></a><span class="lineno"> 692</span>&#160; <span class="keywordflow">else</span></div>
757
- <div class="line"><a name="l00693"></a><span class="lineno"> 693</span>&#160; arr_type_size = svftype-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
758
- <div class="line"><a name="l00694"></a><span class="lineno"> 694</span>&#160; }</div>
759
- <div class="line"><a name="l00695"></a><span class="lineno"> 695</span>&#160; <span class="keywordflow">else</span></div>
760
- <div class="line"><a name="l00696"></a><span class="lineno"> 696</span>&#160; arr_type_size = svftype-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
761
- <div class="line"><a name="l00697"></a><span class="lineno"> 697</span>&#160; </div>
762
- <div class="line"><a name="l00698"></a><span class="lineno"> 698</span>&#160; <span class="keywordflow">if</span> (total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &gt;= arr_type_size || total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &lt; 0)</div>
763
- <div class="line"><a name="l00699"></a><span class="lineno"> 699</span>&#160; {</div>
764
- <div class="line"><a name="l00700"></a><span class="lineno"> 700</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> msg = <span class="stringliteral">&quot;Buffer overflow!! Accessing buffer range: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(total_bytes) +</div>
765
- <div class="line"><a name="l00701"></a><span class="lineno"> 701</span>&#160; <span class="stringliteral">&quot;\nAllocated buffer size: &quot;</span> + std::to_string(arr_type_size) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
766
- <div class="line"><a name="l00702"></a><span class="lineno"> 702</span>&#160; msg += <span class="stringliteral">&quot;Position: &quot;</span> + firstValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a4a0cfe3a8f37d33ffcdca3d66026dcc3">toString</a>() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
767
- <div class="line"><a name="l00703"></a><span class="lineno"> 703</span>&#160; msg += <span class="stringliteral">&quot; The following is the value flow.\n[[&quot;</span>;</div>
768
- <div class="line"><a name="l00704"></a><span class="lineno"> 704</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> it = gep_offsets.begin(); it != gep_offsets.end(); ++it)</div>
769
- <div class="line"><a name="l00705"></a><span class="lineno"> 705</span>&#160; {</div>
770
- <div class="line"><a name="l00706"></a><span class="lineno"> 706</span>&#160; msg += it-&gt;first-&gt;toString() + <span class="stringliteral">&quot;, Offset: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(it-&gt;second) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
771
- <div class="line"><a name="l00707"></a><span class="lineno"> 707</span>&#160; }</div>
772
- <div class="line"><a name="l00708"></a><span class="lineno"> 708</span>&#160; msg += <span class="stringliteral">&quot;]]. \nAlloc Site: &quot;</span> + gvalue-&gt;toString() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
773
- <div class="line"><a name="l00709"></a><span class="lineno"> 709</span>&#160; </div>
774
- <div class="line"><a name="l00710"></a><span class="lineno"> 710</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<a class="code" href="namespaceSVF_1_1SVFUtil.html#ac71522e8c55f84cfc6c13a0ddff18436">SVFUtil::wrnMsg</a>(msg), arr_type_size, arr_type_size,</div>
775
- <div class="line"><a name="l00711"></a><span class="lineno"> 711</span>&#160; total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(), total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(), firstValue);</div>
776
- <div class="line"><a name="l00712"></a><span class="lineno"> 712</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, curNode);</div>
777
- <div class="line"><a name="l00713"></a><span class="lineno"> 713</span>&#160; <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
778
- <div class="line"><a name="l00714"></a><span class="lineno"> 714</span>&#160; }</div>
779
- <div class="line"><a name="l00715"></a><span class="lineno"> 715</span>&#160; <span class="keywordflow">else</span></div>
780
- <div class="line"><a name="l00716"></a><span class="lineno"> 716</span>&#160; {</div>
781
- <div class="line"><a name="l00717"></a><span class="lineno"> 717</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
782
- <div class="line"><a name="l00718"></a><span class="lineno"> 718</span>&#160; }</div>
783
- <div class="line"><a name="l00719"></a><span class="lineno"> 719</span>&#160; }</div>
784
- <div class="line"><a name="l00720"></a><span class="lineno"> 720</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFArgument.html">SVF::SVFArgument</a> *arg = SVFUtil::dyn_cast&lt;SVF::SVFArgument&gt;(value))</div>
785
- <div class="line"><a name="l00721"></a><span class="lineno"> 721</span>&#160; {</div>
786
- <div class="line"><a name="l00722"></a><span class="lineno"> 722</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a048e203517ac727e6fe0653e1f24052c">AccessMemoryViaCallArgs</a>(arg, worklist, visited);</div>
787
- <div class="line"><a name="l00723"></a><span class="lineno"> 723</span>&#160; }</div>
788
- <div class="line"><a name="l00724"></a><span class="lineno"> 724</span>&#160; <span class="keywordflow">else</span></div>
789
- <div class="line"><a name="l00725"></a><span class="lineno"> 725</span>&#160; {</div>
790
- <div class="line"><a name="l00726"></a><span class="lineno"> 726</span>&#160; <span class="comment">// maybe SVFConstant</span></div>
791
- <div class="line"><a name="l00727"></a><span class="lineno"> 727</span>&#160; <span class="comment">// it may be cannot find the source, maybe we start from non-main function,</span></div>
792
- <div class="line"><a name="l00728"></a><span class="lineno"> 728</span>&#160; <span class="comment">// therefore it loses the value flow track</span></div>
793
- <div class="line"><a name="l00729"></a><span class="lineno"> 729</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
794
- <div class="line"><a name="l00730"></a><span class="lineno"> 730</span>&#160; }</div>
795
- <div class="line"><a name="l00731"></a><span class="lineno"> 731</span>&#160; }</div>
796
- <div class="line"><a name="l00732"></a><span class="lineno"> 732</span>&#160; <span class="comment">// it may be cannot find the source, maybe we start from non-main function,</span></div>
797
- <div class="line"><a name="l00733"></a><span class="lineno"> 733</span>&#160; <span class="comment">// therefore it loses the value flow track</span></div>
798
- <div class="line"><a name="l00734"></a><span class="lineno"> 734</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
799
- <div class="line"><a name="l00735"></a><span class="lineno"> 735</span>&#160;}</div>
800
- <div class="line"><a name="l00736"></a><span class="lineno"> 736</span>&#160; </div>
801
- <div class="line"><a name="l00737"></a><span class="lineno"> 737</span>&#160; </div>
802
- <div class="line"><a name="l00738"></a><span class="lineno"> 738</span>&#160; </div>
803
- <div class="line"><a name="l00739"></a><span class="lineno"> 739</span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#afa6b30220b0b3261205a909def9ca44e">BufOverflowChecker::handleICFGNode</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1ICFGNode.html">SVF::ICFGNode</a> *node)</div>
804
- <div class="line"><a name="l00740"></a><span class="lineno"> 740</span>&#160;{</div>
805
- <div class="line"><a name="l00741"></a><span class="lineno"> 741</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9b179466955023f275b6692b59048846">AbstractInterpretation::handleICFGNode</a>(node);</div>
806
- <div class="line"><a name="l00742"></a><span class="lineno"> 742</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a52de7d619e8746a70718719306d7c5a1">detectBufOverflow</a>(node);</div>
807
- <div class="line"><a name="l00743"></a><span class="lineno"> 743</span>&#160;}</div>
808
- <div class="line"><a name="l00744"></a><span class="lineno"> 744</span>&#160; </div>
809
- <div class="line"><a name="l00745"></a><span class="lineno"> 745</span>&#160;<span class="comment">//</span></div>
810
- <div class="line"><a name="l00746"></a><span class="lineno"> 746</span>&#160;<span class="keywordtype">bool</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#a52de7d619e8746a70718719306d7c5a1">BufOverflowChecker::detectBufOverflow</a>(<span class="keyword">const</span> ICFGNode *node)</div>
811
- <div class="line"><a name="l00747"></a><span class="lineno"> 747</span>&#160;{</div>
812
- <div class="line"><a name="l00748"></a><span class="lineno"> 748</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span>* stmt: node-&gt;getSVFStmts())</div>
813
- <div class="line"><a name="l00749"></a><span class="lineno"> 749</span>&#160; {</div>
814
- <div class="line"><a name="l00750"></a><span class="lineno"> 750</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> GepStmt *gep = SVFUtil::dyn_cast&lt;GepStmt&gt;(stmt))</div>
815
- <div class="line"><a name="l00751"></a><span class="lineno"> 751</span>&#160; {</div>
816
- <div class="line"><a name="l00752"></a><span class="lineno"> 752</span>&#160; <span class="keyword">const</span> SVFVar* gepRhs = gep-&gt;getRHSVar();</div>
817
- <div class="line"><a name="l00753"></a><span class="lineno"> 753</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> SVFInstruction* inst = SVFUtil::dyn_cast&lt;SVFInstruction&gt;(gepRhs-&gt;getValue()))</div>
818
- <div class="line"><a name="l00754"></a><span class="lineno"> 754</span>&#160; {</div>
819
- <div class="line"><a name="l00755"></a><span class="lineno"> 755</span>&#160; <span class="keyword">const</span> ICFGNode* icfgNode = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(inst);</div>
820
- <div class="line"><a name="l00756"></a><span class="lineno"> 756</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">const</span> SVFStmt* stmt2: icfgNode-&gt;getSVFStmts())</div>
821
- <div class="line"><a name="l00757"></a><span class="lineno"> 757</span>&#160; {</div>
822
- <div class="line"><a name="l00758"></a><span class="lineno"> 758</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> GepStmt *gep2 = SVFUtil::dyn_cast&lt;GepStmt&gt;(stmt2))</div>
823
- <div class="line"><a name="l00759"></a><span class="lineno"> 759</span>&#160; {</div>
824
- <div class="line"><a name="l00760"></a><span class="lineno"> 760</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(gep2-&gt;getLHSVar()-&gt;getValue(), IntervalValue(0, 0), node);</div>
825
- <div class="line"><a name="l00761"></a><span class="lineno"> 761</span>&#160; }</div>
826
- <div class="line"><a name="l00762"></a><span class="lineno"> 762</span>&#160; }</div>
827
- <div class="line"><a name="l00763"></a><span class="lineno"> 763</span>&#160; }</div>
828
- <div class="line"><a name="l00764"></a><span class="lineno"> 764</span>&#160; }</div>
829
- <div class="line"><a name="l00765"></a><span class="lineno"> 765</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> LoadStmt* load = SVFUtil::dyn_cast&lt;LoadStmt&gt;(stmt))</div>
830
- <div class="line"><a name="l00766"></a><span class="lineno"> 766</span>&#160; {</div>
831
- <div class="line"><a name="l00767"></a><span class="lineno"> 767</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a62baa9403069a9b1e010eaeb2f6b9b34">inVarToAddrsTable</a>(load-&gt;getRHSVarID()))</div>
832
- <div class="line"><a name="l00768"></a><span class="lineno"> 768</span>&#160; {</div>
833
- <div class="line"><a name="l00769"></a><span class="lineno"> 769</span>&#160; AbstractValue Addrs =</div>
834
- <div class="line"><a name="l00770"></a><span class="lineno"> 770</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#aa3e62b9ef912def502b95992199f5d8c">getAddrs</a>(load-&gt;getRHSVarID());</div>
835
- <div class="line"><a name="l00771"></a><span class="lineno"> 771</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> vaddr: Addrs.getAddrs())</div>
836
- <div class="line"><a name="l00772"></a><span class="lineno"> 772</span>&#160; {</div>
837
- <div class="line"><a name="l00773"></a><span class="lineno"> 773</span>&#160; <a class="code" href="CommandLine_8h.html#a2429346d37bd4c40889bd7c6d319d9da">u32_t</a> objId = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#ac37760566b534d89a61d789b00efb993">getInternalID</a>(vaddr);</div>
838
- <div class="line"><a name="l00774"></a><span class="lineno"> 774</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.find(objId) != <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.end())</div>
839
- <div class="line"><a name="l00775"></a><span class="lineno"> 775</span>&#160; {</div>
840
- <div class="line"><a name="l00776"></a><span class="lineno"> 776</span>&#160; <span class="keyword">const</span> GepStmt* gep = <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.at(objId);</div>
841
- <div class="line"><a name="l00777"></a><span class="lineno"> 777</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(gep-&gt;getLHSVar()-&gt;getValue(), IntervalValue(0, 0), node);</div>
842
- <div class="line"><a name="l00778"></a><span class="lineno"> 778</span>&#160; }</div>
843
- <div class="line"><a name="l00779"></a><span class="lineno"> 779</span>&#160; }</div>
844
- <div class="line"><a name="l00780"></a><span class="lineno"> 780</span>&#160; }</div>
845
- <div class="line"><a name="l00781"></a><span class="lineno"> 781</span>&#160; }</div>
846
- <div class="line"><a name="l00782"></a><span class="lineno"> 782</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> StoreStmt* store = SVFUtil::dyn_cast&lt;StoreStmt&gt;(stmt))</div>
847
- <div class="line"><a name="l00783"></a><span class="lineno"> 783</span>&#160; {</div>
848
- <div class="line"><a name="l00784"></a><span class="lineno"> 784</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a62baa9403069a9b1e010eaeb2f6b9b34">inVarToAddrsTable</a>(store-&gt;getLHSVarID()))</div>
849
- <div class="line"><a name="l00785"></a><span class="lineno"> 785</span>&#160; {</div>
850
- <div class="line"><a name="l00786"></a><span class="lineno"> 786</span>&#160; AbstractValue Addrs =</div>
851
- <div class="line"><a name="l00787"></a><span class="lineno"> 787</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#aa3e62b9ef912def502b95992199f5d8c">getAddrs</a>(store-&gt;getLHSVarID());</div>
852
- <div class="line"><a name="l00788"></a><span class="lineno"> 788</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> vaddr: Addrs.getAddrs())</div>
853
- <div class="line"><a name="l00789"></a><span class="lineno"> 789</span>&#160; {</div>
854
- <div class="line"><a name="l00790"></a><span class="lineno"> 790</span>&#160; <a class="code" href="CommandLine_8h.html#a2429346d37bd4c40889bd7c6d319d9da">u32_t</a> objId = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#ac37760566b534d89a61d789b00efb993">getInternalID</a>(vaddr);</div>
855
- <div class="line"><a name="l00791"></a><span class="lineno"> 791</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.find(objId) != <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.end())</div>
856
- <div class="line"><a name="l00792"></a><span class="lineno"> 792</span>&#160; {</div>
857
- <div class="line"><a name="l00793"></a><span class="lineno"> 793</span>&#160; <span class="keyword">const</span> GepStmt* gep = <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.at(objId);</div>
858
- <div class="line"><a name="l00794"></a><span class="lineno"> 794</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(gep-&gt;getLHSVar()-&gt;getValue(), IntervalValue(0, 0), node);</div>
859
- <div class="line"><a name="l00795"></a><span class="lineno"> 795</span>&#160; }</div>
860
- <div class="line"><a name="l00796"></a><span class="lineno"> 796</span>&#160; }</div>
861
- <div class="line"><a name="l00797"></a><span class="lineno"> 797</span>&#160; }</div>
862
- <div class="line"><a name="l00798"></a><span class="lineno"> 798</span>&#160; }</div>
863
- <div class="line"><a name="l00799"></a><span class="lineno"> 799</span>&#160; }</div>
864
- <div class="line"><a name="l00800"></a><span class="lineno"> 800</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
865
- <div class="line"><a name="l00801"></a><span class="lineno"> 801</span>&#160;}</div>
866
- <div class="line"><a name="l00802"></a><span class="lineno"> 802</span>&#160; </div>
867
- <div class="line"><a name="l00803"></a><span class="lineno"> 803</span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">BufOverflowChecker::addBugToRecoder</a>(<span class="keyword">const</span> BufOverflowException&amp; e, <span class="keyword">const</span> ICFGNode* node)</div>
868
- <div class="line"><a name="l00804"></a><span class="lineno"> 804</span>&#160;{</div>
869
- <div class="line"><a name="l00805"></a><span class="lineno"> 805</span>&#160; <span class="keyword">const</span> SVFInstruction* inst = <span class="keyword">nullptr</span>;</div>
870
- <div class="line"><a name="l00806"></a><span class="lineno"> 806</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> CallICFGNode* call = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(node))</div>
871
- <div class="line"><a name="l00807"></a><span class="lineno"> 807</span>&#160; {</div>
872
- <div class="line"><a name="l00808"></a><span class="lineno"> 808</span>&#160; inst = call-&gt;getCallSite();</div>
572
+ <div class="line"><a name="l00501"></a><span class="lineno"><a class="line" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf"> 501</a></span>&#160;<span class="keywordtype">bool</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">BufOverflowChecker::canSafelyAccessMemory</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a> *value, <span class="keyword">const</span> <a class="code" href="structSVF_1_1AbstractValue.html">AbstractValue</a> &amp;len, <span class="keyword">const</span> <a class="code" href="classSVF_1_1ICFGNode.html">ICFGNode</a> *curNode)</div>
573
+ <div class="line"><a name="l00502"></a><span class="lineno"> 502</span>&#160;{</div>
574
+ <div class="line"><a name="l00503"></a><span class="lineno"> 503</span>&#160; <a class="code" href="classSVF_1_1AbstractState.html">AbstractState</a>&amp; as = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a57e4ee3fde79c408dffe98894210d7c9">getAbsState</a>(curNode);</div>
575
+ <div class="line"><a name="l00504"></a><span class="lineno"> 504</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a> *firstValue = value;</div>
576
+ <div class="line"><a name="l00510"></a><span class="lineno"> 510</span>&#160; </div>
577
+ <div class="line"><a name="l00513"></a><span class="lineno"> 513</span>&#160; <a class="code" href="classSVF_1_1FILOWorkList.html">SVF::FILOWorkList&lt;const SVFValue *&gt;</a> worklist;</div>
578
+ <div class="line"><a name="l00514"></a><span class="lineno"> 514</span>&#160; <a class="code" href="namespaceSVF.html#af739db846e47ba6b2fd15eaad31ab7fb">Set&lt;const SVFValue *&gt;</a> visited;</div>
579
+ <div class="line"><a name="l00515"></a><span class="lineno"> 515</span>&#160; visited.insert(value);</div>
580
+ <div class="line"><a name="l00516"></a><span class="lineno"> 516</span>&#160; <a class="code" href="namespaceSVF.html#a8234d4b959abc9123993bcff4eee34c1">Map&lt;const ICFGNode *, IntervalValue&gt;</a> gep_offsets;</div>
581
+ <div class="line"><a name="l00517"></a><span class="lineno"> 517</span>&#160; <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a> total_bytes = len.<a class="code" href="structSVF_1_1AbstractValue.html#acbcec6f55d23e6cd278fe8572a68f393">getInterval</a>();</div>
582
+ <div class="line"><a name="l00518"></a><span class="lineno"> 518</span>&#160; worklist.<a class="code" href="classSVF_1_1FILOWorkList.html#afcf3fcda18e8d3e2bad70a51376c0ce1">push</a>(value);</div>
583
+ <div class="line"><a name="l00519"></a><span class="lineno"> 519</span>&#160; std::vector&lt;const CallICFGNode *&gt; callstack = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9885b50cf28b65bebb488442085fab26">_callSiteStack</a>;</div>
584
+ <div class="line"><a name="l00520"></a><span class="lineno"> 520</span>&#160; <span class="keywordflow">while</span> (!worklist.<a class="code" href="classSVF_1_1FILOWorkList.html#a071a624c91def82a4bbbf3806c7b7eea">empty</a>())</div>
585
+ <div class="line"><a name="l00521"></a><span class="lineno"> 521</span>&#160; {</div>
586
+ <div class="line"><a name="l00522"></a><span class="lineno"> 522</span>&#160; value = worklist.<a class="code" href="classSVF_1_1FILOWorkList.html#a3fd9acb6d09fd142bfd402fdf8cac93b">pop</a>();</div>
587
+ <div class="line"><a name="l00523"></a><span class="lineno"> 523</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFInstruction.html">SVFInstruction</a> *ins = SVFUtil::dyn_cast&lt;SVFInstruction&gt;(value))</div>
588
+ <div class="line"><a name="l00524"></a><span class="lineno"> 524</span>&#160; {</div>
589
+ <div class="line"><a name="l00525"></a><span class="lineno"> 525</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1ICFGNode.html">ICFGNode</a> *node = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(ins);</div>
590
+ <div class="line"><a name="l00526"></a><span class="lineno"> 526</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1CallICFGNode.html">CallICFGNode</a> *callnode = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(node))</div>
591
+ <div class="line"><a name="l00527"></a><span class="lineno"> 527</span>&#160; {</div>
592
+ <div class="line"><a name="l00528"></a><span class="lineno"> 528</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a29fe7c63c61a7aec8ae1477a061f5bf2">AccessMemoryViaRetNode</a>(callnode, worklist, visited);</div>
593
+ <div class="line"><a name="l00529"></a><span class="lineno"> 529</span>&#160; }</div>
594
+ <div class="line"><a name="l00530"></a><span class="lineno"> 530</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFStmt.html">SVFStmt</a> *stmt: node-&gt;<a class="code" href="classSVF_1_1ICFGNode.html#a6c68f52dd90728073fb79141df9b0661">getSVFStmts</a>())</div>
595
+ <div class="line"><a name="l00531"></a><span class="lineno"> 531</span>&#160; {</div>
596
+ <div class="line"><a name="l00532"></a><span class="lineno"> 532</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1CopyStmt.html">CopyStmt</a> *<a class="code" href="cJSON_8cpp.html#a7669ee67a0563250c1efaa24d130e1ac">copy</a> = SVFUtil::dyn_cast&lt;CopyStmt&gt;(stmt))</div>
597
+ <div class="line"><a name="l00533"></a><span class="lineno"> 533</span>&#160; {</div>
598
+ <div class="line"><a name="l00534"></a><span class="lineno"> 534</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a550c12360c2149ba0e55bdf4cf7b8dd0">AccessMemoryViaCopyStmt</a>(<a class="code" href="cJSON_8cpp.html#a7669ee67a0563250c1efaa24d130e1ac">copy</a>, worklist, visited);</div>
599
+ <div class="line"><a name="l00535"></a><span class="lineno"> 535</span>&#160; }</div>
600
+ <div class="line"><a name="l00536"></a><span class="lineno"> 536</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1LoadStmt.html">LoadStmt</a> *load = SVFUtil::dyn_cast&lt;LoadStmt&gt;(stmt))</div>
601
+ <div class="line"><a name="l00537"></a><span class="lineno"> 537</span>&#160; {</div>
602
+ <div class="line"><a name="l00538"></a><span class="lineno"> 538</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#af7f57fc112a86d2710d011d37b496350">AccessMemoryViaLoadStmt</a>(as, load, worklist, visited);</div>
603
+ <div class="line"><a name="l00539"></a><span class="lineno"> 539</span>&#160; }</div>
604
+ <div class="line"><a name="l00540"></a><span class="lineno"> 540</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1GepStmt.html">GepStmt</a> *gep = SVFUtil::dyn_cast&lt;GepStmt&gt;(stmt))</div>
605
+ <div class="line"><a name="l00541"></a><span class="lineno"> 541</span>&#160; {</div>
606
+ <div class="line"><a name="l00542"></a><span class="lineno"> 542</span>&#160; <span class="comment">// there are 3 type of gepStmt</span></div>
607
+ <div class="line"><a name="l00543"></a><span class="lineno"> 543</span>&#160; <span class="comment">// 1. ptr get offset</span></div>
608
+ <div class="line"><a name="l00544"></a><span class="lineno"> 544</span>&#160; <span class="comment">// 2. struct get field</span></div>
609
+ <div class="line"><a name="l00545"></a><span class="lineno"> 545</span>&#160; <span class="comment">// 3. array get element</span></div>
610
+ <div class="line"><a name="l00546"></a><span class="lineno"> 546</span>&#160; <span class="comment">// for array gep, there are two kind of overflow checking</span></div>
611
+ <div class="line"><a name="l00547"></a><span class="lineno"> 547</span>&#160; <span class="comment">// Arr [Struct.C * 10] arr, Struct.C {i32 a, i32 b}</span></div>
612
+ <div class="line"><a name="l00548"></a><span class="lineno"> 548</span>&#160; <span class="comment">// arr[11].a = **, it is &quot;lhs = gep *arr, 0 (ptr), 11 (arrIdx), 0 (ptr), 0(struct field)&quot;</span></div>
613
+ <div class="line"><a name="l00549"></a><span class="lineno"> 549</span>&#160; <span class="comment">// 1) in this case arrIdx 11 is overflow.</span></div>
614
+ <div class="line"><a name="l00550"></a><span class="lineno"> 550</span>&#160; <span class="comment">// Other case,</span></div>
615
+ <div class="line"><a name="l00551"></a><span class="lineno"> 551</span>&#160; <span class="comment">// Struct.C {i32 a, [i32*10] b, i32 c}, C.b[11] = 1</span></div>
616
+ <div class="line"><a name="l00552"></a><span class="lineno"> 552</span>&#160; <span class="comment">// it is &quot;lhs - gep *C, 0(ptr), 1(struct field), 0(ptr), 11(arrIdx)&quot;</span></div>
617
+ <div class="line"><a name="l00553"></a><span class="lineno"> 553</span>&#160; <span class="comment">// 2) in this case arrIdx 11 is larger than its getOffsetVar.Type Array([i32*10])</span></div>
618
+ <div class="line"><a name="l00554"></a><span class="lineno"> 554</span>&#160; </div>
619
+ <div class="line"><a name="l00555"></a><span class="lineno"> 555</span>&#160; <span class="comment">// therefore, if last getOffsetVar.Type is not the Array, just check the overall offset and its</span></div>
620
+ <div class="line"><a name="l00556"></a><span class="lineno"> 556</span>&#160; <span class="comment">// gep source type size (together with totalOffset along the value flow).</span></div>
621
+ <div class="line"><a name="l00557"></a><span class="lineno"> 557</span>&#160; <span class="comment">// so if curgepOffset + totalOffset &gt;= gepSrc (overflow)</span></div>
622
+ <div class="line"><a name="l00558"></a><span class="lineno"> 558</span>&#160; <span class="comment">// else totalOffset += curgepOffset</span></div>
623
+ <div class="line"><a name="l00559"></a><span class="lineno"> 559</span>&#160; </div>
624
+ <div class="line"><a name="l00560"></a><span class="lineno"> 560</span>&#160; <span class="comment">// otherwise, if last getOffsetVar.Type is the Array, check the last idx and array. (just offset,</span></div>
625
+ <div class="line"><a name="l00561"></a><span class="lineno"> 561</span>&#160; <span class="comment">// not with totalOffset during check)</span></div>
626
+ <div class="line"><a name="l00562"></a><span class="lineno"> 562</span>&#160; <span class="comment">// so if getOffsetVarVal &gt; getOffsetVar.TypeSize (overflow)</span></div>
627
+ <div class="line"><a name="l00563"></a><span class="lineno"> 563</span>&#160; <span class="comment">// else safe and return.</span></div>
628
+ <div class="line"><a name="l00564"></a><span class="lineno"> 564</span>&#160; <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a> byteOffset;</div>
629
+ <div class="line"><a name="l00565"></a><span class="lineno"> 565</span>&#160; <span class="keywordflow">if</span> (gep-&gt;isConstantOffset())</div>
630
+ <div class="line"><a name="l00566"></a><span class="lineno"> 566</span>&#160; {</div>
631
+ <div class="line"><a name="l00567"></a><span class="lineno"> 567</span>&#160; byteOffset = <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(gep-&gt;accumulateConstantByteOffset());</div>
632
+ <div class="line"><a name="l00568"></a><span class="lineno"> 568</span>&#160; }</div>
633
+ <div class="line"><a name="l00569"></a><span class="lineno"> 569</span>&#160; <span class="keywordflow">else</span></div>
634
+ <div class="line"><a name="l00570"></a><span class="lineno"> 570</span>&#160; {</div>
635
+ <div class="line"><a name="l00571"></a><span class="lineno"> 571</span>&#160; byteOffset =</div>
636
+ <div class="line"><a name="l00572"></a><span class="lineno"> 572</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#aec9a351850857fa3c6fb23c58317cb0d">getByteOffset</a>(as, gep).<a class="code" href="structSVF_1_1AbstractValue.html#acbcec6f55d23e6cd278fe8572a68f393">getInterval</a>();</div>
637
+ <div class="line"><a name="l00573"></a><span class="lineno"> 573</span>&#160; }</div>
638
+ <div class="line"><a name="l00574"></a><span class="lineno"> 574</span>&#160; <span class="comment">// for variable offset, join with accumulate gep offset</span></div>
639
+ <div class="line"><a name="l00575"></a><span class="lineno"> 575</span>&#160; gep_offsets[gep-&gt;getICFGNode()] = byteOffset;</div>
640
+ <div class="line"><a name="l00576"></a><span class="lineno"> 576</span>&#160; <span class="keywordflow">if</span> (byteOffset.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &gt;= <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>() &amp;&amp; <a class="code" href="classSVF_1_1Options.html#a6450b984f67d3cfa3f44892e8eea555e">Options::GepUnknownIdx</a>())</div>
641
+ <div class="line"><a name="l00577"></a><span class="lineno"> 577</span>&#160; {</div>
642
+ <div class="line"><a name="l00578"></a><span class="lineno"> 578</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
643
+ <div class="line"><a name="l00579"></a><span class="lineno"> 579</span>&#160; }</div>
644
+ <div class="line"><a name="l00580"></a><span class="lineno"> 580</span>&#160; </div>
645
+ <div class="line"><a name="l00581"></a><span class="lineno"> 581</span>&#160; <span class="keywordflow">if</span> (gep-&gt;getOffsetVarAndGepTypePairVec().size() &gt; 0)</div>
646
+ <div class="line"><a name="l00582"></a><span class="lineno"> 582</span>&#160; {</div>
647
+ <div class="line"><a name="l00583"></a><span class="lineno"> 583</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFVar.html">SVFVar</a> *gepVal = gep-&gt;getOffsetVarAndGepTypePairVec().back().first;</div>
648
+ <div class="line"><a name="l00584"></a><span class="lineno"> 584</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFType.html">SVFType</a> *gepType = gep-&gt;getOffsetVarAndGepTypePairVec().back().second;</div>
649
+ <div class="line"><a name="l00585"></a><span class="lineno"> 585</span>&#160; </div>
650
+ <div class="line"><a name="l00586"></a><span class="lineno"> 586</span>&#160; <span class="keywordflow">if</span> (gepType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a330084f9a3deb6e5acb52a8ee3eb7fe4">isArrayTy</a>())</div>
651
+ <div class="line"><a name="l00587"></a><span class="lineno"> 587</span>&#160; {</div>
652
+ <div class="line"><a name="l00588"></a><span class="lineno"> 588</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFArrayType.html">SVFArrayType</a> *gepArrType = SVFUtil::dyn_cast&lt;SVFArrayType&gt;(gepType);</div>
653
+ <div class="line"><a name="l00589"></a><span class="lineno"> 589</span>&#160; <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a> gepArrTotalByte(0);</div>
654
+ <div class="line"><a name="l00590"></a><span class="lineno"> 590</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFValue.html">SVFValue</a> *idxValue = gepVal-&gt;<a class="code" href="classSVF_1_1SVFVar.html#ac2db6304ea5526fb446ae882983beeb0">getValue</a>();</div>
655
+ <div class="line"><a name="l00591"></a><span class="lineno"> 591</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> arrElemSize = gepArrType-&gt;<a class="code" href="classSVF_1_1SVFArrayType.html#a28da1169748e38b891133b76568a2759">getTypeOfElement</a>()-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
656
+ <div class="line"><a name="l00592"></a><span class="lineno"> 592</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFConstantInt.html">SVFConstantInt</a> *op = SVFUtil::dyn_cast&lt;SVFConstantInt&gt;(idxValue))</div>
657
+ <div class="line"><a name="l00593"></a><span class="lineno"> 593</span>&#160; {</div>
658
+ <div class="line"><a name="l00594"></a><span class="lineno"> 594</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> lb = (double) <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>() / arrElemSize &gt;= op-&gt;getSExtValue() ?</div>
659
+ <div class="line"><a name="l00595"></a><span class="lineno"> 595</span>&#160; op-&gt;getSExtValue() * arrElemSize : <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>();</div>
660
+ <div class="line"><a name="l00596"></a><span class="lineno"> 596</span>&#160; gepArrTotalByte = gepArrTotalByte + <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(lb, lb);</div>
661
+ <div class="line"><a name="l00597"></a><span class="lineno"> 597</span>&#160; }</div>
662
+ <div class="line"><a name="l00598"></a><span class="lineno"> 598</span>&#160; <span class="keywordflow">else</span></div>
663
+ <div class="line"><a name="l00599"></a><span class="lineno"> 599</span>&#160; {</div>
664
+ <div class="line"><a name="l00600"></a><span class="lineno"> 600</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> idx = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(idxValue);</div>
665
+ <div class="line"><a name="l00601"></a><span class="lineno"> 601</span>&#160; <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a> idxVal = as[idx].getInterval();</div>
666
+ <div class="line"><a name="l00602"></a><span class="lineno"> 602</span>&#160; <span class="keywordflow">if</span> (idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#a674f9bb98053f8658e246863d6561072">isBottom</a>())</div>
667
+ <div class="line"><a name="l00603"></a><span class="lineno"> 603</span>&#160; {</div>
668
+ <div class="line"><a name="l00604"></a><span class="lineno"> 604</span>&#160; gepArrTotalByte = gepArrTotalByte + <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(0, 0);</div>
669
+ <div class="line"><a name="l00605"></a><span class="lineno"> 605</span>&#160; }</div>
670
+ <div class="line"><a name="l00606"></a><span class="lineno"> 606</span>&#160; <span class="keywordflow">else</span></div>
671
+ <div class="line"><a name="l00607"></a><span class="lineno"> 607</span>&#160; {</div>
672
+ <div class="line"><a name="l00608"></a><span class="lineno"> 608</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> ub = (idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &lt; 0) ? 0 :</div>
673
+ <div class="line"><a name="l00609"></a><span class="lineno"> 609</span>&#160; (<span class="keywordtype">double</span>) <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>() / arrElemSize &gt;=</div>
674
+ <div class="line"><a name="l00610"></a><span class="lineno"> 610</span>&#160; idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() ?</div>
675
+ <div class="line"><a name="l00611"></a><span class="lineno"> 611</span>&#160; arrElemSize * idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() : <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>();</div>
676
+ <div class="line"><a name="l00612"></a><span class="lineno"> 612</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> lb = (idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &lt; 0) ? 0 :</div>
677
+ <div class="line"><a name="l00613"></a><span class="lineno"> 613</span>&#160; ((<span class="keywordtype">double</span>) <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>() / arrElemSize &gt;=</div>
678
+ <div class="line"><a name="l00614"></a><span class="lineno"> 614</span>&#160; idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>()) ?</div>
679
+ <div class="line"><a name="l00615"></a><span class="lineno"> 615</span>&#160; arrElemSize * idxVal.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() : <a class="code" href="classSVF_1_1Options.html#aaab923c093730b1670a54f09340b1bd5">Options::MaxFieldLimit</a>();</div>
680
+ <div class="line"><a name="l00616"></a><span class="lineno"> 616</span>&#160; gepArrTotalByte = gepArrTotalByte + <a class="code" href="classSVF_1_1IntervalValue.html">IntervalValue</a>(lb, ub);</div>
681
+ <div class="line"><a name="l00617"></a><span class="lineno"> 617</span>&#160; }</div>
682
+ <div class="line"><a name="l00618"></a><span class="lineno"> 618</span>&#160; }</div>
683
+ <div class="line"><a name="l00619"></a><span class="lineno"> 619</span>&#160; total_bytes = total_bytes + gepArrTotalByte;</div>
684
+ <div class="line"><a name="l00620"></a><span class="lineno"> 620</span>&#160; <span class="keywordflow">if</span> (total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &gt;= gepArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>())</div>
685
+ <div class="line"><a name="l00621"></a><span class="lineno"> 621</span>&#160; {</div>
686
+ <div class="line"><a name="l00622"></a><span class="lineno"> 622</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> msg =</div>
687
+ <div class="line"><a name="l00623"></a><span class="lineno"> 623</span>&#160; <span class="stringliteral">&quot;Buffer overflow!! Accessing buffer range: &quot;</span> +</div>
688
+ <div class="line"><a name="l00624"></a><span class="lineno"> 624</span>&#160; <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(total_bytes) +</div>
689
+ <div class="line"><a name="l00625"></a><span class="lineno"> 625</span>&#160; <span class="stringliteral">&quot;\nAllocated Gep buffer size: &quot;</span> +</div>
690
+ <div class="line"><a name="l00626"></a><span class="lineno"> 626</span>&#160; std::to_string(gepArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>()) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
691
+ <div class="line"><a name="l00627"></a><span class="lineno"> 627</span>&#160; msg += <span class="stringliteral">&quot;Position: &quot;</span> + firstValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a4a0cfe3a8f37d33ffcdca3d66026dcc3">toString</a>() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
692
+ <div class="line"><a name="l00628"></a><span class="lineno"> 628</span>&#160; msg += <span class="stringliteral">&quot; The following is the value flow. [[\n&quot;</span>;</div>
693
+ <div class="line"><a name="l00629"></a><span class="lineno"> 629</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> it = gep_offsets.begin(); it != gep_offsets.end(); ++it)</div>
694
+ <div class="line"><a name="l00630"></a><span class="lineno"> 630</span>&#160; {</div>
695
+ <div class="line"><a name="l00631"></a><span class="lineno"> 631</span>&#160; msg += it-&gt;first-&gt;toString() + <span class="stringliteral">&quot;, Offset: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(it-&gt;second) +</div>
696
+ <div class="line"><a name="l00632"></a><span class="lineno"> 632</span>&#160; <span class="stringliteral">&quot;\n&quot;</span>;</div>
697
+ <div class="line"><a name="l00633"></a><span class="lineno"> 633</span>&#160; }</div>
698
+ <div class="line"><a name="l00634"></a><span class="lineno"> 634</span>&#160; msg += <span class="stringliteral">&quot;]].\nAlloc Site: &quot;</span> + gep-&gt;toString() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
699
+ <div class="line"><a name="l00635"></a><span class="lineno"> 635</span>&#160; </div>
700
+ <div class="line"><a name="l00636"></a><span class="lineno"> 636</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<a class="code" href="namespaceSVF_1_1SVFUtil.html#a7655b13bbfe720ca2b8a25e0a72528e6">SVFUtil::errMsg</a>(msg), gepArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>(),</div>
701
+ <div class="line"><a name="l00637"></a><span class="lineno"> 637</span>&#160; gepArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>(),</div>
702
+ <div class="line"><a name="l00638"></a><span class="lineno"> 638</span>&#160; total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(), total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(),</div>
703
+ <div class="line"><a name="l00639"></a><span class="lineno"> 639</span>&#160; firstValue);</div>
704
+ <div class="line"><a name="l00640"></a><span class="lineno"> 640</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, curNode);</div>
705
+ <div class="line"><a name="l00641"></a><span class="lineno"> 641</span>&#160; <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
706
+ <div class="line"><a name="l00642"></a><span class="lineno"> 642</span>&#160; }</div>
707
+ <div class="line"><a name="l00643"></a><span class="lineno"> 643</span>&#160; <span class="keywordflow">else</span></div>
708
+ <div class="line"><a name="l00644"></a><span class="lineno"> 644</span>&#160; {</div>
709
+ <div class="line"><a name="l00645"></a><span class="lineno"> 645</span>&#160; <span class="comment">// for gep last index&#39;s type is arr, stop here.</span></div>
710
+ <div class="line"><a name="l00646"></a><span class="lineno"> 646</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
711
+ <div class="line"><a name="l00647"></a><span class="lineno"> 647</span>&#160; }</div>
712
+ <div class="line"><a name="l00648"></a><span class="lineno"> 648</span>&#160; }</div>
713
+ <div class="line"><a name="l00649"></a><span class="lineno"> 649</span>&#160; <span class="keywordflow">else</span></div>
714
+ <div class="line"><a name="l00650"></a><span class="lineno"> 650</span>&#160; {</div>
715
+ <div class="line"><a name="l00651"></a><span class="lineno"> 651</span>&#160; total_bytes = total_bytes + byteOffset;</div>
716
+ <div class="line"><a name="l00652"></a><span class="lineno"> 652</span>&#160; }</div>
717
+ <div class="line"><a name="l00653"></a><span class="lineno"> 653</span>&#160; </div>
718
+ <div class="line"><a name="l00654"></a><span class="lineno"> 654</span>&#160; }</div>
719
+ <div class="line"><a name="l00655"></a><span class="lineno"> 655</span>&#160; <span class="keywordflow">if</span> (!visited.count(gep-&gt;getRHSVar()-&gt;getValue()))</div>
720
+ <div class="line"><a name="l00656"></a><span class="lineno"> 656</span>&#160; {</div>
721
+ <div class="line"><a name="l00657"></a><span class="lineno"> 657</span>&#160; visited.insert(gep-&gt;getRHSVar()-&gt;getValue());</div>
722
+ <div class="line"><a name="l00658"></a><span class="lineno"> 658</span>&#160; worklist.<a class="code" href="classSVF_1_1FILOWorkList.html#afcf3fcda18e8d3e2bad70a51376c0ce1">push</a>(gep-&gt;getRHSVar()-&gt;getValue());</div>
723
+ <div class="line"><a name="l00659"></a><span class="lineno"> 659</span>&#160; }</div>
724
+ <div class="line"><a name="l00660"></a><span class="lineno"> 660</span>&#160; }</div>
725
+ <div class="line"><a name="l00661"></a><span class="lineno"> 661</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1AddrStmt.html">AddrStmt</a> *addr = SVFUtil::dyn_cast&lt;AddrStmt&gt;(stmt))</div>
726
+ <div class="line"><a name="l00662"></a><span class="lineno"> 662</span>&#160; {</div>
727
+ <div class="line"><a name="l00663"></a><span class="lineno"> 663</span>&#160; <span class="comment">// addrStmt is source node.</span></div>
728
+ <div class="line"><a name="l00664"></a><span class="lineno"> 664</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> arr_type_size = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a60a21908a08864f01a66a3ac113c4a35">getAllocaInstByteSize</a>(as, addr);</div>
729
+ <div class="line"><a name="l00665"></a><span class="lineno"> 665</span>&#160; <span class="keywordflow">if</span> (total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &gt;= arr_type_size ||</div>
730
+ <div class="line"><a name="l00666"></a><span class="lineno"> 666</span>&#160; total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &lt; 0)</div>
731
+ <div class="line"><a name="l00667"></a><span class="lineno"> 667</span>&#160; {</div>
732
+ <div class="line"><a name="l00668"></a><span class="lineno"> 668</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> msg =</div>
733
+ <div class="line"><a name="l00669"></a><span class="lineno"> 669</span>&#160; <span class="stringliteral">&quot;Buffer overflow!! Accessing buffer range: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(total_bytes) +</div>
734
+ <div class="line"><a name="l00670"></a><span class="lineno"> 670</span>&#160; <span class="stringliteral">&quot;\nAllocated buffer size: &quot;</span> + std::to_string(arr_type_size) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
735
+ <div class="line"><a name="l00671"></a><span class="lineno"> 671</span>&#160; msg += <span class="stringliteral">&quot;Position: &quot;</span> + firstValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a4a0cfe3a8f37d33ffcdca3d66026dcc3">toString</a>() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
736
+ <div class="line"><a name="l00672"></a><span class="lineno"> 672</span>&#160; msg += <span class="stringliteral">&quot; The following is the value flow. [[\n&quot;</span>;</div>
737
+ <div class="line"><a name="l00673"></a><span class="lineno"> 673</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> it = gep_offsets.begin(); it != gep_offsets.end(); ++it)</div>
738
+ <div class="line"><a name="l00674"></a><span class="lineno"> 674</span>&#160; {</div>
739
+ <div class="line"><a name="l00675"></a><span class="lineno"> 675</span>&#160; msg += it-&gt;first-&gt;toString() + <span class="stringliteral">&quot;, Offset: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(it-&gt;second) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
740
+ <div class="line"><a name="l00676"></a><span class="lineno"> 676</span>&#160; }</div>
741
+ <div class="line"><a name="l00677"></a><span class="lineno"> 677</span>&#160; msg += <span class="stringliteral">&quot;]].\n Alloc Site: &quot;</span> + addr-&gt;toString() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
742
+ <div class="line"><a name="l00678"></a><span class="lineno"> 678</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<a class="code" href="namespaceSVF_1_1SVFUtil.html#ac71522e8c55f84cfc6c13a0ddff18436">SVFUtil::wrnMsg</a>(msg), arr_type_size, arr_type_size,</div>
743
+ <div class="line"><a name="l00679"></a><span class="lineno"> 679</span>&#160; total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(), total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(),</div>
744
+ <div class="line"><a name="l00680"></a><span class="lineno"> 680</span>&#160; firstValue);</div>
745
+ <div class="line"><a name="l00681"></a><span class="lineno"> 681</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, curNode);</div>
746
+ <div class="line"><a name="l00682"></a><span class="lineno"> 682</span>&#160; <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
747
+ <div class="line"><a name="l00683"></a><span class="lineno"> 683</span>&#160; }</div>
748
+ <div class="line"><a name="l00684"></a><span class="lineno"> 684</span>&#160; <span class="keywordflow">else</span></div>
749
+ <div class="line"><a name="l00685"></a><span class="lineno"> 685</span>&#160; {</div>
750
+ <div class="line"><a name="l00686"></a><span class="lineno"> 686</span>&#160; </div>
751
+ <div class="line"><a name="l00687"></a><span class="lineno"> 687</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
752
+ <div class="line"><a name="l00688"></a><span class="lineno"> 688</span>&#160; }</div>
753
+ <div class="line"><a name="l00689"></a><span class="lineno"> 689</span>&#160; }</div>
754
+ <div class="line"><a name="l00690"></a><span class="lineno"> 690</span>&#160; }</div>
755
+ <div class="line"><a name="l00691"></a><span class="lineno"> 691</span>&#160; }</div>
756
+ <div class="line"><a name="l00692"></a><span class="lineno"> 692</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFGlobalValue.html">SVF::SVFGlobalValue</a> *gvalue = SVFUtil::dyn_cast&lt;SVF::SVFGlobalValue&gt;(value))</div>
757
+ <div class="line"><a name="l00693"></a><span class="lineno"> 693</span>&#160; {</div>
758
+ <div class="line"><a name="l00694"></a><span class="lineno"> 694</span>&#160; <a class="code" href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">u32_t</a> arr_type_size = 0;</div>
759
+ <div class="line"><a name="l00695"></a><span class="lineno"> 695</span>&#160; <span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFType.html">SVFType</a> *svftype = gvalue-&gt;getType();</div>
760
+ <div class="line"><a name="l00696"></a><span class="lineno"> 696</span>&#160; <span class="keywordflow">if</span> (SVFUtil::isa&lt;SVFPointerType&gt;(svftype))</div>
761
+ <div class="line"><a name="l00697"></a><span class="lineno"> 697</span>&#160; {</div>
762
+ <div class="line"><a name="l00698"></a><span class="lineno"> 698</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFArrayType.html">SVFArrayType</a> *ptrArrType = SVFUtil::dyn_cast&lt;SVFArrayType&gt;(</div>
763
+ <div class="line"><a name="l00699"></a><span class="lineno"> 699</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#abb8dd7424d62b56b899d3f4d218eeaac">getPointeeElement</a>(as, <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">getValueNode</a>(gvalue))))</div>
764
+ <div class="line"><a name="l00700"></a><span class="lineno"> 700</span>&#160; arr_type_size = ptrArrType-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
765
+ <div class="line"><a name="l00701"></a><span class="lineno"> 701</span>&#160; <span class="keywordflow">else</span></div>
766
+ <div class="line"><a name="l00702"></a><span class="lineno"> 702</span>&#160; arr_type_size = svftype-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
767
+ <div class="line"><a name="l00703"></a><span class="lineno"> 703</span>&#160; }</div>
768
+ <div class="line"><a name="l00704"></a><span class="lineno"> 704</span>&#160; <span class="keywordflow">else</span></div>
769
+ <div class="line"><a name="l00705"></a><span class="lineno"> 705</span>&#160; arr_type_size = svftype-&gt;<a class="code" href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">getByteSize</a>();</div>
770
+ <div class="line"><a name="l00706"></a><span class="lineno"> 706</span>&#160; </div>
771
+ <div class="line"><a name="l00707"></a><span class="lineno"> 707</span>&#160; <span class="keywordflow">if</span> (total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &gt;= arr_type_size || total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>() &lt; 0)</div>
772
+ <div class="line"><a name="l00708"></a><span class="lineno"> 708</span>&#160; {</div>
773
+ <div class="line"><a name="l00709"></a><span class="lineno"> 709</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> msg = <span class="stringliteral">&quot;Buffer overflow!! Accessing buffer range: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(total_bytes) +</div>
774
+ <div class="line"><a name="l00710"></a><span class="lineno"> 710</span>&#160; <span class="stringliteral">&quot;\nAllocated buffer size: &quot;</span> + std::to_string(arr_type_size) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
775
+ <div class="line"><a name="l00711"></a><span class="lineno"> 711</span>&#160; msg += <span class="stringliteral">&quot;Position: &quot;</span> + firstValue-&gt;<a class="code" href="classSVF_1_1SVFValue.html#a4a0cfe3a8f37d33ffcdca3d66026dcc3">toString</a>() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
776
+ <div class="line"><a name="l00712"></a><span class="lineno"> 712</span>&#160; msg += <span class="stringliteral">&quot; The following is the value flow.\n[[&quot;</span>;</div>
777
+ <div class="line"><a name="l00713"></a><span class="lineno"> 713</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> it = gep_offsets.begin(); it != gep_offsets.end(); ++it)</div>
778
+ <div class="line"><a name="l00714"></a><span class="lineno"> 714</span>&#160; {</div>
779
+ <div class="line"><a name="l00715"></a><span class="lineno"> 715</span>&#160; msg += it-&gt;first-&gt;toString() + <span class="stringliteral">&quot;, Offset: &quot;</span> + <a class="code" href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">IntervalToIntStr</a>(it-&gt;second) + <span class="stringliteral">&quot;\n&quot;</span>;</div>
780
+ <div class="line"><a name="l00716"></a><span class="lineno"> 716</span>&#160; }</div>
781
+ <div class="line"><a name="l00717"></a><span class="lineno"> 717</span>&#160; msg += <span class="stringliteral">&quot;]]. \nAlloc Site: &quot;</span> + gvalue-&gt;toString() + <span class="stringliteral">&quot;\n&quot;</span>;</div>
782
+ <div class="line"><a name="l00718"></a><span class="lineno"> 718</span>&#160; </div>
783
+ <div class="line"><a name="l00719"></a><span class="lineno"> 719</span>&#160; <a class="code" href="structSVF_1_1BufOverflowException.html">BufOverflowException</a> bug(<a class="code" href="namespaceSVF_1_1SVFUtil.html#ac71522e8c55f84cfc6c13a0ddff18436">SVFUtil::wrnMsg</a>(msg), arr_type_size, arr_type_size,</div>
784
+ <div class="line"><a name="l00720"></a><span class="lineno"> 720</span>&#160; total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">lb</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(), total_bytes.<a class="code" href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">ub</a>().<a class="code" href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">getNumeral</a>(), firstValue);</div>
785
+ <div class="line"><a name="l00721"></a><span class="lineno"> 721</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">addBugToRecoder</a>(bug, curNode);</div>
786
+ <div class="line"><a name="l00722"></a><span class="lineno"> 722</span>&#160; <span class="keywordflow">return</span> <span class="keyword">false</span>;</div>
787
+ <div class="line"><a name="l00723"></a><span class="lineno"> 723</span>&#160; }</div>
788
+ <div class="line"><a name="l00724"></a><span class="lineno"> 724</span>&#160; <span class="keywordflow">else</span></div>
789
+ <div class="line"><a name="l00725"></a><span class="lineno"> 725</span>&#160; {</div>
790
+ <div class="line"><a name="l00726"></a><span class="lineno"> 726</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
791
+ <div class="line"><a name="l00727"></a><span class="lineno"> 727</span>&#160; }</div>
792
+ <div class="line"><a name="l00728"></a><span class="lineno"> 728</span>&#160; }</div>
793
+ <div class="line"><a name="l00729"></a><span class="lineno"> 729</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> <a class="code" href="classSVF_1_1SVFArgument.html">SVF::SVFArgument</a> *arg = SVFUtil::dyn_cast&lt;SVF::SVFArgument&gt;(value))</div>
794
+ <div class="line"><a name="l00730"></a><span class="lineno"> 730</span>&#160; {</div>
795
+ <div class="line"><a name="l00731"></a><span class="lineno"> 731</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a048e203517ac727e6fe0653e1f24052c">AccessMemoryViaCallArgs</a>(arg, worklist, visited);</div>
796
+ <div class="line"><a name="l00732"></a><span class="lineno"> 732</span>&#160; }</div>
797
+ <div class="line"><a name="l00733"></a><span class="lineno"> 733</span>&#160; <span class="keywordflow">else</span></div>
798
+ <div class="line"><a name="l00734"></a><span class="lineno"> 734</span>&#160; {</div>
799
+ <div class="line"><a name="l00735"></a><span class="lineno"> 735</span>&#160; <span class="comment">// maybe SVFConstant</span></div>
800
+ <div class="line"><a name="l00736"></a><span class="lineno"> 736</span>&#160; <span class="comment">// it may be cannot find the source, maybe we start from non-main function,</span></div>
801
+ <div class="line"><a name="l00737"></a><span class="lineno"> 737</span>&#160; <span class="comment">// therefore it loses the value flow track</span></div>
802
+ <div class="line"><a name="l00738"></a><span class="lineno"> 738</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
803
+ <div class="line"><a name="l00739"></a><span class="lineno"> 739</span>&#160; }</div>
804
+ <div class="line"><a name="l00740"></a><span class="lineno"> 740</span>&#160; }</div>
805
+ <div class="line"><a name="l00741"></a><span class="lineno"> 741</span>&#160; <span class="comment">// it may be cannot find the source, maybe we start from non-main function,</span></div>
806
+ <div class="line"><a name="l00742"></a><span class="lineno"> 742</span>&#160; <span class="comment">// therefore it loses the value flow track</span></div>
807
+ <div class="line"><a name="l00743"></a><span class="lineno"> 743</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
808
+ <div class="line"><a name="l00744"></a><span class="lineno"> 744</span>&#160;}</div>
809
+ <div class="line"><a name="l00745"></a><span class="lineno"> 745</span>&#160; </div>
810
+ <div class="line"><a name="l00746"></a><span class="lineno"> 746</span>&#160; </div>
811
+ <div class="line"><a name="l00747"></a><span class="lineno"> 747</span>&#160; </div>
812
+ <div class="line"><a name="l00748"></a><span class="lineno"> 748</span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#afa6b30220b0b3261205a909def9ca44e">BufOverflowChecker::handleICFGNode</a>(<span class="keyword">const</span> <a class="code" href="classSVF_1_1ICFGNode.html">SVF::ICFGNode</a> *node)</div>
813
+ <div class="line"><a name="l00749"></a><span class="lineno"> 749</span>&#160;{</div>
814
+ <div class="line"><a name="l00750"></a><span class="lineno"> 750</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9b179466955023f275b6692b59048846">AbstractInterpretation::handleICFGNode</a>(node);</div>
815
+ <div class="line"><a name="l00751"></a><span class="lineno"> 751</span>&#160; <a class="code" href="classSVF_1_1BufOverflowChecker.html#a52de7d619e8746a70718719306d7c5a1">detectBufOverflow</a>(node);</div>
816
+ <div class="line"><a name="l00752"></a><span class="lineno"> 752</span>&#160;}</div>
817
+ <div class="line"><a name="l00753"></a><span class="lineno"> 753</span>&#160; </div>
818
+ <div class="line"><a name="l00754"></a><span class="lineno"> 754</span>&#160;<span class="comment">//</span></div>
819
+ <div class="line"><a name="l00755"></a><span class="lineno"> 755</span>&#160;<span class="keywordtype">bool</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#a52de7d619e8746a70718719306d7c5a1">BufOverflowChecker::detectBufOverflow</a>(<span class="keyword">const</span> ICFGNode *node)</div>
820
+ <div class="line"><a name="l00756"></a><span class="lineno"> 756</span>&#160;{</div>
821
+ <div class="line"><a name="l00757"></a><span class="lineno"> 757</span>&#160; AbstractState &amp;as = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a57e4ee3fde79c408dffe98894210d7c9">getAbsState</a>(node);</div>
822
+ <div class="line"><a name="l00758"></a><span class="lineno"> 758</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span>* stmt: node-&gt;getSVFStmts())</div>
823
+ <div class="line"><a name="l00759"></a><span class="lineno"> 759</span>&#160; {</div>
824
+ <div class="line"><a name="l00760"></a><span class="lineno"> 760</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> GepStmt *gep = SVFUtil::dyn_cast&lt;GepStmt&gt;(stmt))</div>
825
+ <div class="line"><a name="l00761"></a><span class="lineno"> 761</span>&#160; {</div>
826
+ <div class="line"><a name="l00762"></a><span class="lineno"> 762</span>&#160; <span class="keyword">const</span> SVFVar* gepRhs = gep-&gt;getRHSVar();</div>
827
+ <div class="line"><a name="l00763"></a><span class="lineno"> 763</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> SVFInstruction* inst = SVFUtil::dyn_cast&lt;SVFInstruction&gt;(gepRhs-&gt;getValue()))</div>
828
+ <div class="line"><a name="l00764"></a><span class="lineno"> 764</span>&#160; {</div>
829
+ <div class="line"><a name="l00765"></a><span class="lineno"> 765</span>&#160; <span class="keyword">const</span> ICFGNode* icfgNode = <a class="code" href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">_svfir</a>-&gt;<a class="code" href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">getICFG</a>()-&gt;<a class="code" href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">getICFGNode</a>(inst);</div>
830
+ <div class="line"><a name="l00766"></a><span class="lineno"> 766</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">const</span> SVFStmt* stmt2: icfgNode-&gt;getSVFStmts())</div>
831
+ <div class="line"><a name="l00767"></a><span class="lineno"> 767</span>&#160; {</div>
832
+ <div class="line"><a name="l00768"></a><span class="lineno"> 768</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> GepStmt *gep2 = SVFUtil::dyn_cast&lt;GepStmt&gt;(stmt2))</div>
833
+ <div class="line"><a name="l00769"></a><span class="lineno"> 769</span>&#160; {</div>
834
+ <div class="line"><a name="l00770"></a><span class="lineno"> 770</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(gep2-&gt;getLHSVar()-&gt;getValue(), IntervalValue(0, 0), node);</div>
835
+ <div class="line"><a name="l00771"></a><span class="lineno"> 771</span>&#160; }</div>
836
+ <div class="line"><a name="l00772"></a><span class="lineno"> 772</span>&#160; }</div>
837
+ <div class="line"><a name="l00773"></a><span class="lineno"> 773</span>&#160; }</div>
838
+ <div class="line"><a name="l00774"></a><span class="lineno"> 774</span>&#160; }</div>
839
+ <div class="line"><a name="l00775"></a><span class="lineno"> 775</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> LoadStmt* load = SVFUtil::dyn_cast&lt;LoadStmt&gt;(stmt))</div>
840
+ <div class="line"><a name="l00776"></a><span class="lineno"> 776</span>&#160; {</div>
841
+ <div class="line"><a name="l00777"></a><span class="lineno"> 777</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#ad42ca3cab47612c78a5d99cedea2f4ba">inVarToAddrsTable</a>(as, load-&gt;getRHSVarID()))</div>
842
+ <div class="line"><a name="l00778"></a><span class="lineno"> 778</span>&#160; {</div>
843
+ <div class="line"><a name="l00779"></a><span class="lineno"> 779</span>&#160; AbstractValue Addrs =</div>
844
+ <div class="line"><a name="l00780"></a><span class="lineno"> 780</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a611ac228efd661b301ea1dd675cd1c0c">getAddrs</a>(as, load-&gt;getRHSVarID());</div>
845
+ <div class="line"><a name="l00781"></a><span class="lineno"> 781</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> vaddr: Addrs.getAddrs())</div>
846
+ <div class="line"><a name="l00782"></a><span class="lineno"> 782</span>&#160; {</div>
847
+ <div class="line"><a name="l00783"></a><span class="lineno"> 783</span>&#160; <a class="code" href="CommandLine_8h.html#a2429346d37bd4c40889bd7c6d319d9da">u32_t</a> objId = <a class="code" href="classSVF_1_1AbstractState.html#aaabe5850dbf1620c6058f5ac6cb169b6">AbstractState::getInternalID</a>(vaddr);</div>
848
+ <div class="line"><a name="l00784"></a><span class="lineno"> 784</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.find(objId) != <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.end())</div>
849
+ <div class="line"><a name="l00785"></a><span class="lineno"> 785</span>&#160; {</div>
850
+ <div class="line"><a name="l00786"></a><span class="lineno"> 786</span>&#160; <span class="keyword">const</span> GepStmt* gep = <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.at(objId);</div>
851
+ <div class="line"><a name="l00787"></a><span class="lineno"> 787</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(gep-&gt;getLHSVar()-&gt;getValue(), IntervalValue(0, 0), node);</div>
852
+ <div class="line"><a name="l00788"></a><span class="lineno"> 788</span>&#160; }</div>
853
+ <div class="line"><a name="l00789"></a><span class="lineno"> 789</span>&#160; }</div>
854
+ <div class="line"><a name="l00790"></a><span class="lineno"> 790</span>&#160; }</div>
855
+ <div class="line"><a name="l00791"></a><span class="lineno"> 791</span>&#160; }</div>
856
+ <div class="line"><a name="l00792"></a><span class="lineno"> 792</span>&#160; <span class="keywordflow">else</span> <span class="keywordflow">if</span> (<span class="keyword">const</span> StoreStmt* store = SVFUtil::dyn_cast&lt;StoreStmt&gt;(stmt))</div>
857
+ <div class="line"><a name="l00793"></a><span class="lineno"> 793</span>&#160; {</div>
858
+ <div class="line"><a name="l00794"></a><span class="lineno"> 794</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#ad42ca3cab47612c78a5d99cedea2f4ba">inVarToAddrsTable</a>(as, store-&gt;getLHSVarID()))</div>
859
+ <div class="line"><a name="l00795"></a><span class="lineno"> 795</span>&#160; {</div>
860
+ <div class="line"><a name="l00796"></a><span class="lineno"> 796</span>&#160; AbstractValue Addrs =</div>
861
+ <div class="line"><a name="l00797"></a><span class="lineno"> 797</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">_svfir2AbsState</a>-&gt;<a class="code" href="classSVF_1_1SVFIR2AbsState.html#a611ac228efd661b301ea1dd675cd1c0c">getAddrs</a>(as, store-&gt;getLHSVarID());</div>
862
+ <div class="line"><a name="l00798"></a><span class="lineno"> 798</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">auto</span> vaddr: Addrs.getAddrs())</div>
863
+ <div class="line"><a name="l00799"></a><span class="lineno"> 799</span>&#160; {</div>
864
+ <div class="line"><a name="l00800"></a><span class="lineno"> 800</span>&#160; <a class="code" href="CommandLine_8h.html#a2429346d37bd4c40889bd7c6d319d9da">u32_t</a> objId = <a class="code" href="classSVF_1_1AbstractState.html#aaabe5850dbf1620c6058f5ac6cb169b6">AbstractState::getInternalID</a>(vaddr);</div>
865
+ <div class="line"><a name="l00801"></a><span class="lineno"> 801</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.find(objId) != <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.end())</div>
866
+ <div class="line"><a name="l00802"></a><span class="lineno"> 802</span>&#160; {</div>
867
+ <div class="line"><a name="l00803"></a><span class="lineno"> 803</span>&#160; <span class="keyword">const</span> GepStmt* gep = <a class="code" href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">_addrToGep</a>.at(objId);</div>
868
+ <div class="line"><a name="l00804"></a><span class="lineno"> 804</span>&#160; <span class="keywordflow">return</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">canSafelyAccessMemory</a>(gep-&gt;getLHSVar()-&gt;getValue(), IntervalValue(0, 0), node);</div>
869
+ <div class="line"><a name="l00805"></a><span class="lineno"> 805</span>&#160; }</div>
870
+ <div class="line"><a name="l00806"></a><span class="lineno"> 806</span>&#160; }</div>
871
+ <div class="line"><a name="l00807"></a><span class="lineno"> 807</span>&#160; }</div>
872
+ <div class="line"><a name="l00808"></a><span class="lineno"> 808</span>&#160; }</div>
873
873
  <div class="line"><a name="l00809"></a><span class="lineno"> 809</span>&#160; }</div>
874
- <div class="line"><a name="l00810"></a><span class="lineno"> 810</span>&#160; <span class="keywordflow">else</span></div>
875
- <div class="line"><a name="l00811"></a><span class="lineno"> 811</span>&#160; {</div>
876
- <div class="line"><a name="l00812"></a><span class="lineno"> 812</span>&#160; inst = node-&gt;getSVFStmts().back()-&gt;getInst();</div>
877
- <div class="line"><a name="l00813"></a><span class="lineno"> 813</span>&#160; }</div>
878
- <div class="line"><a name="l00814"></a><span class="lineno"> 814</span>&#160; <a class="code" href="classSVF_1_1GenericBug.html#acc65b033bfd61257d5b6fdbf932dfafe">GenericBug::EventStack</a> eventStack;</div>
879
- <div class="line"><a name="l00815"></a><span class="lineno"> 815</span>&#160; SVFBugEvent sourceInstEvent(SVFBugEvent::EventType::SourceInst, inst);</div>
880
- <div class="line"><a name="l00816"></a><span class="lineno"> 816</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">const</span> <span class="keyword">auto</span> &amp;callsite: <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9885b50cf28b65bebb488442085fab26">_callSiteStack</a>)</div>
874
+ <div class="line"><a name="l00810"></a><span class="lineno"> 810</span>&#160; <span class="keywordflow">return</span> <span class="keyword">true</span>;</div>
875
+ <div class="line"><a name="l00811"></a><span class="lineno"> 811</span>&#160;}</div>
876
+ <div class="line"><a name="l00812"></a><span class="lineno"> 812</span>&#160; </div>
877
+ <div class="line"><a name="l00813"></a><span class="lineno"> 813</span>&#160;<span class="keywordtype">void</span> <a class="code" href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">BufOverflowChecker::addBugToRecoder</a>(<span class="keyword">const</span> BufOverflowException&amp; e, <span class="keyword">const</span> ICFGNode* node)</div>
878
+ <div class="line"><a name="l00814"></a><span class="lineno"> 814</span>&#160;{</div>
879
+ <div class="line"><a name="l00815"></a><span class="lineno"> 815</span>&#160; <span class="keyword">const</span> SVFInstruction* inst = <span class="keyword">nullptr</span>;</div>
880
+ <div class="line"><a name="l00816"></a><span class="lineno"> 816</span>&#160; <span class="keywordflow">if</span> (<span class="keyword">const</span> CallICFGNode* call = SVFUtil::dyn_cast&lt;CallICFGNode&gt;(node))</div>
881
881
  <div class="line"><a name="l00817"></a><span class="lineno"> 817</span>&#160; {</div>
882
- <div class="line"><a name="l00818"></a><span class="lineno"> 818</span>&#160; SVFBugEvent callSiteEvent(SVFBugEvent::EventType::CallSite, callsite-&gt;getCallSite());</div>
883
- <div class="line"><a name="l00819"></a><span class="lineno"> 819</span>&#160; eventStack.push_back(callSiteEvent);</div>
884
- <div class="line"><a name="l00820"></a><span class="lineno"> 820</span>&#160; }</div>
885
- <div class="line"><a name="l00821"></a><span class="lineno"> 821</span>&#160; eventStack.push_back(sourceInstEvent);</div>
886
- <div class="line"><a name="l00822"></a><span class="lineno"> 822</span>&#160; <span class="keywordflow">if</span> (eventStack.size() == 0) <span class="keywordflow">return</span>;</div>
887
- <div class="line"><a name="l00823"></a><span class="lineno"> 823</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> loc = eventStack.back().getEventLoc();</div>
888
- <div class="line"><a name="l00824"></a><span class="lineno"> 824</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a5e0a88ebef4ae740983726e7f1b5eb">_bugLoc</a>.find(loc) != <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a5e0a88ebef4ae740983726e7f1b5eb">_bugLoc</a>.end())</div>
889
- <div class="line"><a name="l00825"></a><span class="lineno"> 825</span>&#160; {</div>
890
- <div class="line"><a name="l00826"></a><span class="lineno"> 826</span>&#160; <span class="keywordflow">return</span>;</div>
891
- <div class="line"><a name="l00827"></a><span class="lineno"> 827</span>&#160; }</div>
892
- <div class="line"><a name="l00828"></a><span class="lineno"> 828</span>&#160; <span class="keywordflow">else</span></div>
893
- <div class="line"><a name="l00829"></a><span class="lineno"> 829</span>&#160; {</div>
894
- <div class="line"><a name="l00830"></a><span class="lineno"> 830</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a5e0a88ebef4ae740983726e7f1b5eb">_bugLoc</a>.insert(loc);</div>
895
- <div class="line"><a name="l00831"></a><span class="lineno"> 831</span>&#160; }</div>
896
- <div class="line"><a name="l00832"></a><span class="lineno"> 832</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a8e4f0c5f527e321369a19a0b37124079">_recoder</a>.<a class="code" href="classSVF_1_1SVFBugReport.html#a05f395eff23619ed10c31c0acda949e2">addAbsExecBug</a>(<a class="code" href="classSVF_1_1GenericBug.html#a7aeeb33097bca5f7fe6747f90f5cecacac88ddac03bb8ae09a72058e4ad7af747">GenericBug::FULLBUFOVERFLOW</a>, eventStack, e.getAllocLb(), e.getAllocUb(), e.getAccessLb(),</div>
897
- <div class="line"><a name="l00833"></a><span class="lineno"> 833</span>&#160; e.getAccessUb());</div>
898
- <div class="line"><a name="l00834"></a><span class="lineno"> 834</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a09aa739395388f64fcb3d539d58d2041">_nodeToBugInfo</a>[node] = e.what();</div>
899
- <div class="line"><a name="l00835"></a><span class="lineno"> 835</span>&#160;}</div>
900
- <div class="line"><a name="l00836"></a><span class="lineno"> 836</span>&#160; </div>
901
- <div class="line"><a name="l00837"></a><span class="lineno"> 837</span>&#160;}</div>
882
+ <div class="line"><a name="l00818"></a><span class="lineno"> 818</span>&#160; inst = call-&gt;getCallSite();</div>
883
+ <div class="line"><a name="l00819"></a><span class="lineno"> 819</span>&#160; }</div>
884
+ <div class="line"><a name="l00820"></a><span class="lineno"> 820</span>&#160; <span class="keywordflow">else</span></div>
885
+ <div class="line"><a name="l00821"></a><span class="lineno"> 821</span>&#160; {</div>
886
+ <div class="line"><a name="l00822"></a><span class="lineno"> 822</span>&#160; inst = node-&gt;getSVFStmts().back()-&gt;getInst();</div>
887
+ <div class="line"><a name="l00823"></a><span class="lineno"> 823</span>&#160; }</div>
888
+ <div class="line"><a name="l00824"></a><span class="lineno"> 824</span>&#160; <a class="code" href="classSVF_1_1GenericBug.html#acc65b033bfd61257d5b6fdbf932dfafe">GenericBug::EventStack</a> eventStack;</div>
889
+ <div class="line"><a name="l00825"></a><span class="lineno"> 825</span>&#160; SVFBugEvent sourceInstEvent(SVFBugEvent::EventType::SourceInst, inst);</div>
890
+ <div class="line"><a name="l00826"></a><span class="lineno"> 826</span>&#160; <span class="keywordflow">for</span> (<span class="keyword">const</span> <span class="keyword">auto</span> &amp;callsite: <a class="code" href="classSVF_1_1AbstractInterpretation.html#a9885b50cf28b65bebb488442085fab26">_callSiteStack</a>)</div>
891
+ <div class="line"><a name="l00827"></a><span class="lineno"> 827</span>&#160; {</div>
892
+ <div class="line"><a name="l00828"></a><span class="lineno"> 828</span>&#160; SVFBugEvent callSiteEvent(SVFBugEvent::EventType::CallSite, callsite-&gt;getCallSite());</div>
893
+ <div class="line"><a name="l00829"></a><span class="lineno"> 829</span>&#160; eventStack.push_back(callSiteEvent);</div>
894
+ <div class="line"><a name="l00830"></a><span class="lineno"> 830</span>&#160; }</div>
895
+ <div class="line"><a name="l00831"></a><span class="lineno"> 831</span>&#160; eventStack.push_back(sourceInstEvent);</div>
896
+ <div class="line"><a name="l00832"></a><span class="lineno"> 832</span>&#160; <span class="keywordflow">if</span> (eventStack.size() == 0) <span class="keywordflow">return</span>;</div>
897
+ <div class="line"><a name="l00833"></a><span class="lineno"> 833</span>&#160; <a class="code" href="cJSON_8h.html#ad4c68ea99a26b0a98ad9a79982960458">std::string</a> loc = eventStack.back().getEventLoc();</div>
898
+ <div class="line"><a name="l00834"></a><span class="lineno"> 834</span>&#160; <span class="keywordflow">if</span> (<a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a5e0a88ebef4ae740983726e7f1b5eb">_bugLoc</a>.find(loc) != <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a5e0a88ebef4ae740983726e7f1b5eb">_bugLoc</a>.end())</div>
899
+ <div class="line"><a name="l00835"></a><span class="lineno"> 835</span>&#160; {</div>
900
+ <div class="line"><a name="l00836"></a><span class="lineno"> 836</span>&#160; <span class="keywordflow">return</span>;</div>
901
+ <div class="line"><a name="l00837"></a><span class="lineno"> 837</span>&#160; }</div>
902
+ <div class="line"><a name="l00838"></a><span class="lineno"> 838</span>&#160; <span class="keywordflow">else</span></div>
903
+ <div class="line"><a name="l00839"></a><span class="lineno"> 839</span>&#160; {</div>
904
+ <div class="line"><a name="l00840"></a><span class="lineno"> 840</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a2a5e0a88ebef4ae740983726e7f1b5eb">_bugLoc</a>.insert(loc);</div>
905
+ <div class="line"><a name="l00841"></a><span class="lineno"> 841</span>&#160; }</div>
906
+ <div class="line"><a name="l00842"></a><span class="lineno"> 842</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a8e4f0c5f527e321369a19a0b37124079">_recoder</a>.<a class="code" href="classSVF_1_1SVFBugReport.html#a05f395eff23619ed10c31c0acda949e2">addAbsExecBug</a>(<a class="code" href="classSVF_1_1GenericBug.html#a7aeeb33097bca5f7fe6747f90f5cecacac88ddac03bb8ae09a72058e4ad7af747">GenericBug::FULLBUFOVERFLOW</a>, eventStack, e.getAllocLb(), e.getAllocUb(), e.getAccessLb(),</div>
907
+ <div class="line"><a name="l00843"></a><span class="lineno"> 843</span>&#160; e.getAccessUb());</div>
908
+ <div class="line"><a name="l00844"></a><span class="lineno"> 844</span>&#160; <a class="code" href="classSVF_1_1AbstractInterpretation.html#a09aa739395388f64fcb3d539d58d2041">_nodeToBugInfo</a>[node] = e.what();</div>
909
+ <div class="line"><a name="l00845"></a><span class="lineno"> 845</span>&#160;}</div>
910
+ <div class="line"><a name="l00846"></a><span class="lineno"> 846</span>&#160; </div>
911
+ <div class="line"><a name="l00847"></a><span class="lineno"> 847</span>&#160;}</div>
902
912
  </div><!-- fragment --></div><!-- contents -->
903
913
  <div class="ttc" id="aclassSVF_1_1SVFBugReport_html_a05f395eff23619ed10c31c0acda949e2"><div class="ttname"><a href="classSVF_1_1SVFBugReport.html#a05f395eff23619ed10c31c0acda949e2">SVF::SVFBugReport::addAbsExecBug</a></div><div class="ttdeci">void addAbsExecBug(GenericBug::BugType bugType, const GenericBug::EventStack &amp;eventStack, s64_t allocLowerBound, s64_t allocUpperBound, s64_t accessLowerBound, s64_t accessUpperBound)</div><div class="ttdef"><b>Definition:</b> <a href="SVFBugReport_8h_source.html#l00367">SVFBugReport.h:367</a></div></div>
904
914
  <div class="ttc" id="aclassSVF_1_1SVFValue_html_a2401b022638769f59f86ab424a189b6e"><div class="ttname"><a href="classSVF_1_1SVFValue.html#a2401b022638769f59f86ab424a189b6e">SVF::SVFValue::getName</a></div><div class="ttdeci">const std::string &amp; getName() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFValue_8h_source.html#l00243">SVFValue.h:243</a></div></div>
905
915
  <div class="ttc" id="aclassSVF_1_1CopyStmt_html"><div class="ttname"><a href="classSVF_1_1CopyStmt.html">SVF::CopyStmt</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFStatements_8h_source.html#l00364">SVFStatements.h:364</a></div></div>
906
916
  <div class="ttc" id="aclassSVF_1_1SVFType_html_a95b8031f1e15d49c7d68628be1d05aae"><div class="ttname"><a href="classSVF_1_1SVFType.html#a95b8031f1e15d49c7d68628be1d05aae">SVF::SVFType::getByteSize</a></div><div class="ttdeci">u32_t getByteSize() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFType_8h_source.html#l00244">SVFType.h:244</a></div></div>
907
- <div class="ttc" id="aclassSVF_1_1SVFIR2AbsState_html_a62baa9403069a9b1e010eaeb2f6b9b34"><div class="ttname"><a href="classSVF_1_1SVFIR2AbsState.html#a62baa9403069a9b1e010eaeb2f6b9b34">SVF::SVFIR2AbsState::inVarToAddrsTable</a></div><div class="ttdeci">bool inVarToAddrsTable(u32_t id) const</div><div class="ttdoc">whether the variable is in varToAddrs table</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR2AbsState_8h_source.html#l00129">SVFIR2AbsState.h:129</a></div></div>
908
917
  <div class="ttc" id="anamespaceSVF_1_1SVFUtil_html_a7655b13bbfe720ca2b8a25e0a72528e6"><div class="ttname"><a href="namespaceSVF_1_1SVFUtil.html#a7655b13bbfe720ca2b8a25e0a72528e6">SVF::SVFUtil::errMsg</a></div><div class="ttdeci">std::string errMsg(const std::string &amp;msg)</div><div class="ttdoc">Print error message by converting a string into red string output.</div><div class="ttdef"><b>Definition:</b> <a href="SVFUtil_8cpp_source.html#l00076">SVFUtil.cpp:76</a></div></div>
918
+ <div class="ttc" id="aclassSVF_1_1SVFStmt_html_aa809a57c8cdaaa35dfc3cc0f3b33b52b"><div class="ttname"><a href="classSVF_1_1SVFStmt.html#aa809a57c8cdaaa35dfc3cc0f3b33b52b">SVF::SVFStmt::getICFGNode</a></div><div class="ttdeci">ICFGNode * getICFGNode() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFStatements_8h_source.html#l00163">SVFStatements.h:163</a></div></div>
909
919
  <div class="ttc" id="aCommandLine_8h_html_a2429346d37bd4c40889bd7c6d319d9da"><div class="ttname"><a href="CommandLine_8h.html#a2429346d37bd4c40889bd7c6d319d9da">u32_t</a></div><div class="ttdeci">unsigned u32_t</div><div class="ttdef"><b>Definition:</b> <a href="CommandLine_8h_source.html#l00018">CommandLine.h:18</a></div></div>
910
920
  <div class="ttc" id="aclassSVF_1_1AddrStmt_html"><div class="ttname"><a href="classSVF_1_1AddrStmt.html">SVF::AddrStmt</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFStatements_8h_source.html#l00313">SVFStatements.h:313</a></div></div>
911
921
  <div class="ttc" id="astructSVF_1_1AbstractValue_html_ab1fe6a57f784971b3bc603dbfda746e8"><div class="ttname"><a href="structSVF_1_1AbstractValue.html#ab1fe6a57f784971b3bc603dbfda746e8">SVF::AbstractValue::getAddrs</a></div><div class="ttdeci">AddressValue &amp; getAddrs()</div><div class="ttdef"><b>Definition:</b> <a href="AbstractValue_8h_source.html#l00171">AbstractValue.h:171</a></div></div>
912
922
  <div class="ttc" id="aBufOverflowChecker_8h_html"><div class="ttname"><a href="BufOverflowChecker_8h.html">BufOverflowChecker.h</a></div></div>
913
- <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_ad68fa02efad8b628e4542dc9ab6c58bf"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">SVF::BufOverflowChecker::canSafelyAccessMemory</a></div><div class="ttdeci">bool canSafelyAccessMemory(const SVFValue *value, const AbstractValue &amp;len, const ICFGNode *curNode)</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00492">BufOverflowChecker.cpp:492</a></div></div>
923
+ <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_ad68fa02efad8b628e4542dc9ab6c58bf"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#ad68fa02efad8b628e4542dc9ab6c58bf">SVF::BufOverflowChecker::canSafelyAccessMemory</a></div><div class="ttdeci">bool canSafelyAccessMemory(const SVFValue *value, const AbstractValue &amp;len, const ICFGNode *curNode)</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00501">BufOverflowChecker.cpp:501</a></div></div>
914
924
  <div class="ttc" id="aclassSVF_1_1IRGraph_html_a43514023a4f4d0c32f536f51443b0efc"><div class="ttname"><a href="classSVF_1_1IRGraph.html#a43514023a4f4d0c32f536f51443b0efc">SVF::IRGraph::getValueNode</a></div><div class="ttdeci">NodeID getValueNode(const SVFValue *V)</div><div class="ttdef"><b>Definition:</b> <a href="IRGraph_8h_source.html#l00137">IRGraph.h:137</a></div></div>
915
925
  <div class="ttc" id="anamespaceSVF_html_af739db846e47ba6b2fd15eaad31ab7fb"><div class="ttname"><a href="namespaceSVF.html#af739db846e47ba6b2fd15eaad31ab7fb">SVF::Set</a></div><div class="ttdeci">std::unordered_set&lt; Key, Hash, KeyEqual, Allocator &gt; Set</div><div class="ttdef"><b>Definition:</b> <a href="GeneralType_8h_source.html#l00096">GeneralType.h:96</a></div></div>
916
926
  <div class="ttc" id="aclassSVF_1_1CallICFGNode_html_a90fd0b8e44fba1a7eb76d15bce085d66"><div class="ttname"><a href="classSVF_1_1CallICFGNode.html#a90fd0b8e44fba1a7eb76d15bce085d66">SVF::CallICFGNode::getCallSite</a></div><div class="ttdeci">const SVFInstruction * getCallSite() const</div><div class="ttdoc">Return callsite.</div><div class="ttdef"><b>Definition:</b> <a href="ICFGNode_8h_source.html#l00409">ICFGNode.h:409</a></div></div>
917
927
  <div class="ttc" id="aclassSVF_1_1IntervalValue_html_a0df07a2659cbf3a918de5b0d7c407264"><div class="ttname"><a href="classSVF_1_1IntervalValue.html#a0df07a2659cbf3a918de5b0d7c407264">SVF::IntervalValue::lb</a></div><div class="ttdeci">const NumericLiteral &amp; lb() const</div><div class="ttdoc">Return the lower bound.</div><div class="ttdef"><b>Definition:</b> <a href="IntervalValue_8h_source.html#l00206">IntervalValue.h:206</a></div></div>
918
928
  <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_afa6b30220b0b3261205a909def9ca44e"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#afa6b30220b0b3261205a909def9ca44e">SVF::BufOverflowChecker::handleICFGNode</a></div><div class="ttdeci">virtual void handleICFGNode(const SVF::ICFGNode *node) override</div></div>
919
929
  <div class="ttc" id="anamespaceSVF_html"><div class="ttname"><a href="namespaceSVF.html">SVF</a></div><div class="ttdoc">for isBitcode</div><div class="ttdef"><b>Definition:</b> <a href="BasicTypes_8h_source.html#l00067">BasicTypes.h:67</a></div></div>
920
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a5bba3c0570d73acc743742a30af1b0b4"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a5bba3c0570d73acc743742a30af1b0b4">SVF::AbstractInterpretation::getStrlen</a></div><div class="ttdeci">AbstractValue getStrlen(const SVF::SVFValue *strValue)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01464">AbstractInterpretation.cpp:1464</a></div></div>
921
930
  <div class="ttc" id="anamespaceSVF_1_1SVFUtil_html_a9815a5b31ac7dc21239d08e5b9f61106"><div class="ttname"><a href="namespaceSVF_1_1SVFUtil.html#a9815a5b31ac7dc21239d08e5b9f61106">SVF::SVFUtil::getSVFCallSite</a></div><div class="ttdeci">CallSite getSVFCallSite(const SVFInstruction *inst)</div><div class="ttdoc">Return LLVM callsite given an instruction.</div><div class="ttdef"><b>Definition:</b> <a href="SVFUtil_8h_source.html#l00196">SVFUtil.h:196</a></div></div>
922
931
  <div class="ttc" id="aclassSVF_1_1ICFGNode_html_a6c68f52dd90728073fb79141df9b0661"><div class="ttname"><a href="classSVF_1_1ICFGNode.html#a6c68f52dd90728073fb79141df9b0661">SVF::ICFGNode::getSVFStmts</a></div><div class="ttdeci">const SVFStmtList &amp; getSVFStmts() const</div><div class="ttdef"><b>Definition:</b> <a href="ICFGNode_8h_source.html#l00127">ICFGNode.h:127</a></div></div>
923
932
  <div class="ttc" id="astructSVF_1_1BufOverflowException_html"><div class="ttname"><a href="structSVF_1_1BufOverflowException.html">SVF::BufOverflowException</a></div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8h_source.html#l00036">BufOverflowChecker.h:36</a></div></div>
924
933
  <div class="ttc" id="anamespaceSVF_1_1SVFUtil_html_ac71522e8c55f84cfc6c13a0ddff18436"><div class="ttname"><a href="namespaceSVF_1_1SVFUtil.html#ac71522e8c55f84cfc6c13a0ddff18436">SVF::SVFUtil::wrnMsg</a></div><div class="ttdeci">std::string wrnMsg(const std::string &amp;msg)</div><div class="ttdoc">Returns warning message by converting a string into yellow string output.</div><div class="ttdef"><b>Definition:</b> <a href="SVFUtil_8cpp_source.html#l00061">SVFUtil.cpp:61</a></div></div>
925
934
  <div class="ttc" id="aclassSVF_1_1SVFValue_html_a11f2d9b6e969ede6fca2c204cc15b821"><div class="ttname"><a href="classSVF_1_1SVFValue.html#a11f2d9b6e969ede6fca2c204cc15b821">SVF::SVFValue::getType</a></div><div class="ttdeci">virtual const SVFType * getType() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFValue_8h_source.html#l00256">SVFValue.h:256</a></div></div>
926
- <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_ad8b2f2fa6f22b9d1655135c819cbad8a"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#ad8b2f2fa6f22b9d1655135c819cbad8a">SVF::BufOverflowChecker::detectStrcpy</a></div><div class="ttdeci">bool detectStrcpy(const CallICFGNode *call)</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00124">BufOverflowChecker.cpp:124</a></div></div>
935
+ <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_ad8b2f2fa6f22b9d1655135c819cbad8a"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#ad8b2f2fa6f22b9d1655135c819cbad8a">SVF::BufOverflowChecker::detectStrcpy</a></div><div class="ttdeci">bool detectStrcpy(const CallICFGNode *call)</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00125">BufOverflowChecker.cpp:125</a></div></div>
927
936
  <div class="ttc" id="aclassSVF_1_1SVFVar_html_ac2db6304ea5526fb446ae882983beeb0"><div class="ttname"><a href="classSVF_1_1SVFVar.html#ac2db6304ea5526fb446ae882983beeb0">SVF::SVFVar::getValue</a></div><div class="ttdeci">const SVFValue * getValue() const</div><div class="ttdoc">Get/has methods of the components.</div><div class="ttdef"><b>Definition:</b> <a href="SVFVariables_8h_source.html#l00094">SVFVariables.h:94</a></div></div>
928
937
  <div class="ttc" id="aclassSVF_1_1GenericBug_html_acc65b033bfd61257d5b6fdbf932dfafe"><div class="ttname"><a href="classSVF_1_1GenericBug.html#acc65b033bfd61257d5b6fdbf932dfafe">SVF::GenericBug::EventStack</a></div><div class="ttdeci">std::vector&lt; SVFBugEvent &gt; EventStack</div><div class="ttdef"><b>Definition:</b> <a href="SVFBugReport_8h_source.html#l00083">SVFBugReport.h:83</a></div></div>
929
938
  <div class="ttc" id="aclassSVF_1_1ICFGNode_html"><div class="ttname"><a href="classSVF_1_1ICFGNode.html">SVF::ICFGNode</a></div><div class="ttdef"><b>Definition:</b> <a href="ICFGNode_8h_source.html#l00054">ICFGNode.h:54</a></div></div>
930
939
  <div class="ttc" id="aclassSVF_1_1SVFType_html_a330084f9a3deb6e5acb52a8ee3eb7fe4"><div class="ttname"><a href="classSVF_1_1SVFType.html#a330084f9a3deb6e5acb52a8ee3eb7fe4">SVF::SVFType::isArrayTy</a></div><div class="ttdeci">bool isArrayTy() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFType_8h_source.html#l00254">SVFType.h:254</a></div></div>
940
+ <div class="ttc" id="aclassSVF_1_1SVFIR2AbsState_html_a611ac228efd661b301ea1dd675cd1c0c"><div class="ttname"><a href="classSVF_1_1SVFIR2AbsState.html#a611ac228efd661b301ea1dd675cd1c0c">SVF::SVFIR2AbsState::getAddrs</a></div><div class="ttdeci">AbstractValue &amp; getAddrs(AbstractState &amp;es, u32_t id)</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR2AbsState_8h_source.html#l00104">SVFIR2AbsState.h:104</a></div></div>
931
941
  <div class="ttc" id="aclassSVF_1_1IntervalValue_html_a5d73cc2aa0a6ed49e8301fa7b0cd5045"><div class="ttname"><a href="classSVF_1_1IntervalValue.html#a5d73cc2aa0a6ed49e8301fa7b0cd5045">SVF::IntervalValue::toString</a></div><div class="ttdeci">const std::string toString() const</div><div class="ttdef"><b>Definition:</b> <a href="IntervalValue_8h_source.html#l00479">IntervalValue.h:479</a></div></div>
932
942
  <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a13fdb4a6a6d09e3504fdad16b88616daad20658cd0f68b92583461b0b1f68d543"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daad20658cd0f68b92583461b0b1f68d543">SVF::AbstractInterpretation::UNCLASSIFIED</a></div><div class="ttdeci">@ UNCLASSIFIED</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00113">AbstractInterpretation.h:113</a></div></div>
933
943
  <div class="ttc" id="aclassSVF_1_1AbstractState_html_aa34516a95191c5ec56ce44a117e8b018"><div class="ttname"><a href="classSVF_1_1AbstractState.html#aa34516a95191c5ec56ce44a117e8b018">SVF::AbstractState::inVarToAddrsTable</a></div><div class="ttdeci">bool inVarToAddrsTable(u32_t id) const</div><div class="ttdoc">whether the variable is in varToAddrs table</div><div class="ttdef"><b>Definition:</b> <a href="AbstractState_8h_source.html#l00201">AbstractState.h:201</a></div></div>
@@ -935,15 +945,14 @@ $(function() {
935
945
  <div class="ttc" id="aclassSVF_1_1SVFIR2AbsState_html_a4e032a5e0898f0e349927d5a86c8477c"><div class="ttname"><a href="classSVF_1_1SVFIR2AbsState.html#a4e032a5e0898f0e349927d5a86c8477c">SVF::SVFIR2AbsState::getRangeLimitFromType</a></div><div class="ttdeci">AbstractValue getRangeLimitFromType(const SVFType *type)</div><div class="ttdoc">Return the value range of Integer SVF Type, e.g. unsigned i8 Type-&gt;[0, 255], signed i8 Type-&gt;[-128,...</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR2AbsState_8cpp_source.html#l00049">SVFIR2AbsState.cpp:49</a></div></div>
936
946
  <div class="ttc" id="aclassSVF_1_1IntervalValue_html_a3dba35c84607bd3ed4e62a90ae2799cf"><div class="ttname"><a href="classSVF_1_1IntervalValue.html#a3dba35c84607bd3ed4e62a90ae2799cf">SVF::IntervalValue::is_infinite</a></div><div class="ttdeci">static bool is_infinite(const NumericLiteral &amp;e)</div><div class="ttdef"><b>Definition:</b> <a href="IntervalValue_8h_source.html#l00077">IntervalValue.h:77</a></div></div>
937
947
  <div class="ttc" id="aclassSVF_1_1Options_html_a6450b984f67d3cfa3f44892e8eea555e"><div class="ttname"><a href="classSVF_1_1Options.html#a6450b984f67d3cfa3f44892e8eea555e">SVF::Options::GepUnknownIdx</a></div><div class="ttdeci">static const Option&lt; bool &gt; GepUnknownIdx</div><div class="ttdoc">if the access index of gepstmt is unknown, skip it, Default: false</div><div class="ttdef"><b>Definition:</b> <a href="Options_8h_source.html#l00281">Options.h:281</a></div></div>
938
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a09aa739395388f64fcb3d539d58d2041"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a09aa739395388f64fcb3d539d58d2041">SVF::AbstractInterpretation::_nodeToBugInfo</a></div><div class="ttdeci">Map&lt; const ICFGNode *, std::string &gt; _nodeToBugInfo</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00355">AbstractInterpretation.h:355</a></div></div>
939
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a618fc324a6c205d7e1b471bd850377a9"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">SVF::AbstractInterpretation::_svfir</a></div><div class="ttdeci">SVFIR * _svfir</div><div class="ttdoc">protected data members, also used in subclasses</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00342">AbstractInterpretation.h:342</a></div></div>
940
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a2a1e1b72ed740cef4c3e57e3e32c3f75"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a2a1e1b72ed740cef4c3e57e3e32c3f75">SVF::AbstractInterpretation::_checkpoint_names</a></div><div class="ttdeci">Set&lt; std::string &gt; _checkpoint_names</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00382">AbstractInterpretation.h:382</a></div></div>
941
- <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_aed959fce840cbea32d3567ee1ac01e82"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#aed959fce840cbea32d3567ee1ac01e82">SVF::BufOverflowChecker::initExtAPIBufOverflowCheckRules</a></div><div class="ttdeci">void initExtAPIBufOverflowCheckRules()</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00077">BufOverflowChecker.cpp:77</a></div></div>
948
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a09aa739395388f64fcb3d539d58d2041"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a09aa739395388f64fcb3d539d58d2041">SVF::AbstractInterpretation::_nodeToBugInfo</a></div><div class="ttdeci">Map&lt; const ICFGNode *, std::string &gt; _nodeToBugInfo</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00349">AbstractInterpretation.h:349</a></div></div>
949
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a618fc324a6c205d7e1b471bd850377a9"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a618fc324a6c205d7e1b471bd850377a9">SVF::AbstractInterpretation::_svfir</a></div><div class="ttdeci">SVFIR * _svfir</div><div class="ttdoc">protected data members, also used in subclasses</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00336">AbstractInterpretation.h:336</a></div></div>
950
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a2a1e1b72ed740cef4c3e57e3e32c3f75"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a2a1e1b72ed740cef4c3e57e3e32c3f75">SVF::AbstractInterpretation::_checkpoint_names</a></div><div class="ttdeci">Set&lt; std::string &gt; _checkpoint_names</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00389">AbstractInterpretation.h:389</a></div></div>
951
+ <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_aed959fce840cbea32d3567ee1ac01e82"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#aed959fce840cbea32d3567ee1ac01e82">SVF::BufOverflowChecker::initExtAPIBufOverflowCheckRules</a></div><div class="ttdeci">void initExtAPIBufOverflowCheckRules()</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00078">BufOverflowChecker.cpp:78</a></div></div>
942
952
  <div class="ttc" id="aOptions_8h_html"><div class="ttname"><a href="Options_8h.html">Options.h</a></div></div>
943
953
  <div class="ttc" id="aclassSVF_1_1GenericBug_html_a7aeeb33097bca5f7fe6747f90f5cecacac88ddac03bb8ae09a72058e4ad7af747"><div class="ttname"><a href="classSVF_1_1GenericBug.html#a7aeeb33097bca5f7fe6747f90f5cecacac88ddac03bb8ae09a72058e4ad7af747">SVF::GenericBug::FULLBUFOVERFLOW</a></div><div class="ttdeci">@ FULLBUFOVERFLOW</div><div class="ttdef"><b>Definition:</b> <a href="SVFBugReport_8h_source.html#l00086">SVFBugReport.h:86</a></div></div>
944
954
  <div class="ttc" id="aclassSVF_1_1SVFFunction_html_a067bd6dbaf74a028d546fa56b095791b"><div class="ttname"><a href="classSVF_1_1SVFFunction.html#a067bd6dbaf74a028d546fa56b095791b">SVF::SVFFunction::getAnnotations</a></div><div class="ttdeci">const std::vector&lt; std::string &gt; &amp; getAnnotations() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFValue_8h_source.html#l00466">SVFValue.h:466</a></div></div>
945
- <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_aa68f8aef09481d7c07dc59d7dfb83822"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#aa68f8aef09481d7c07dc59d7dfb83822">SVF::BufOverflowChecker::detectStrcat</a></div><div class="ttdeci">bool detectStrcat(const CallICFGNode *call)</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00376">BufOverflowChecker.cpp:376</a></div></div>
946
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a0e8b546f608417e218c2fab5a5893135"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a0e8b546f608417e218c2fab5a5893135">SVF::AbstractInterpretation::getAllocaInstByteSize</a></div><div class="ttdeci">u32_t getAllocaInstByteSize(const AddrStmt *addr)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01296">AbstractInterpretation.cpp:1296</a></div></div>
955
+ <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_aa68f8aef09481d7c07dc59d7dfb83822"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#aa68f8aef09481d7c07dc59d7dfb83822">SVF::BufOverflowChecker::detectStrcat</a></div><div class="ttdeci">bool detectStrcat(const CallICFGNode *call)</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00386">BufOverflowChecker.cpp:386</a></div></div>
947
956
  <div class="ttc" id="anamespaceSVF_1_1SVFUtil_html_a145abbd2958629718fbca41d25c3124d"><div class="ttname"><a href="namespaceSVF_1_1SVFUtil.html#a145abbd2958629718fbca41d25c3124d">SVF::SVFUtil::getCallee</a></div><div class="ttdeci">const SVFFunction * getCallee(const CallSite cs)</div><div class="ttdoc">Return callee of a callsite. Return null if this is an indirect call.</div><div class="ttdef"><b>Definition:</b> <a href="SVFUtil_8h_source.html#l00241">SVFUtil.h:241</a></div></div>
948
957
  <div class="ttc" id="aSVFType_8h_html"><div class="ttname"><a href="SVFType_8h.html">SVFType.h</a></div></div>
949
958
  <div class="ttc" id="aclassSVF_1_1NumericLiteral_html_a4181e5e15e10304ea524e5f8b2a3f576"><div class="ttname"><a href="classSVF_1_1NumericLiteral.html#a4181e5e15e10304ea524e5f8b2a3f576">SVF::NumericLiteral::getNumeral</a></div><div class="ttdeci">s64_t getNumeral() const</div><div class="ttdoc">Return Numeral, default type is double in case to support both int and float.</div><div class="ttdef"><b>Definition:</b> <a href="NumericLiteral_8h_source.html#l00132">NumericLiteral.h:132</a></div></div>
@@ -953,16 +962,17 @@ $(function() {
953
962
  <div class="ttc" id="aclassSVF_1_1AbstractState_html_a1f935ea8ab16b04699284bf92bbbb23c"><div class="ttname"><a href="classSVF_1_1AbstractState.html#a1f935ea8ab16b04699284bf92bbbb23c">SVF::AbstractState::store</a></div><div class="ttdeci">void store(u32_t addr, const AbstractValue &amp;val)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractState_8h_source.html#l00321">AbstractState.h:321</a></div></div>
954
963
  <div class="ttc" id="aclassSVF_1_1SVFArrayType_html"><div class="ttname"><a href="classSVF_1_1SVFArrayType.html">SVF::SVFArrayType</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFType_8h_source.html#l00377">SVFType.h:377</a></div></div>
955
964
  <div class="ttc" id="anamespaceSVF_html_a5d28d0818391747924478e86b9033431"><div class="ttname"><a href="namespaceSVF.html#a5d28d0818391747924478e86b9033431">SVF::IntervalToIntStr</a></div><div class="ttdeci">std::string IntervalToIntStr(const IntervalValue &amp;inv)</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00037">BufOverflowChecker.cpp:37</a></div></div>
956
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a2a5e0a88ebef4ae740983726e7f1b5eb"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a2a5e0a88ebef4ae740983726e7f1b5eb">SVF::AbstractInterpretation::_bugLoc</a></div><div class="ttdeci">Set&lt; std::string &gt; _bugLoc</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00352">AbstractInterpretation.h:352</a></div></div>
957
- <div class="ttc" id="aclassSVF_1_1SVFIR2AbsState_html_a21e927af79c73460ff5629cbd4961163"><div class="ttname"><a href="classSVF_1_1SVFIR2AbsState.html#a21e927af79c73460ff5629cbd4961163">SVF::SVFIR2AbsState::getByteOffset</a></div><div class="ttdeci">AbstractValue getByteOffset(const GepStmt *gep)</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR2AbsState_8cpp_source.html#l00415">SVFIR2AbsState.cpp:415</a></div></div>
965
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a2a5e0a88ebef4ae740983726e7f1b5eb"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a2a5e0a88ebef4ae740983726e7f1b5eb">SVF::AbstractInterpretation::_bugLoc</a></div><div class="ttdeci">Set&lt; std::string &gt; _bugLoc</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00346">AbstractInterpretation.h:346</a></div></div>
958
966
  <div class="ttc" id="aclassSVF_1_1CallICFGNode_html"><div class="ttname"><a href="classSVF_1_1CallICFGNode.html">SVF::CallICFGNode</a></div><div class="ttdef"><b>Definition:</b> <a href="ICFGNode_8h_source.html#l00385">ICFGNode.h:385</a></div></div>
959
967
  <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a13fdb4a6a6d09e3504fdad16b88616daa9cc269dadf9cff7d399c54d9570a6614"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa9cc269dadf9cff7d399c54d9570a6614">SVF::AbstractInterpretation::MEMCPY</a></div><div class="ttdeci">@ MEMCPY</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00113">AbstractInterpretation.h:113</a></div></div>
960
968
  <div class="ttc" id="aclassSVF_1_1SVFType_html"><div class="ttname"><a href="classSVF_1_1SVFType.html">SVF::SVFType</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFType_8h_source.html#l00156">SVFType.h:156</a></div></div>
961
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a048e203517ac727e6fe0653e1f24052c"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a048e203517ac727e6fe0653e1f24052c">SVF::AbstractInterpretation::AccessMemoryViaCallArgs</a></div><div class="ttdeci">void AccessMemoryViaCallArgs(const SVF::SVFArgument *arg, SVF::FILOWorkList&lt; const SVFValue * &gt; &amp;worklist, Set&lt; const SVFValue * &gt; &amp;visited)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01751">AbstractInterpretation.cpp:1751</a></div></div>
969
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a048e203517ac727e6fe0653e1f24052c"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a048e203517ac727e6fe0653e1f24052c">SVF::AbstractInterpretation::AccessMemoryViaCallArgs</a></div><div class="ttdeci">void AccessMemoryViaCallArgs(const SVF::SVFArgument *arg, SVF::FILOWorkList&lt; const SVFValue * &gt; &amp;worklist, Set&lt; const SVFValue * &gt; &amp;visited)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01735">AbstractInterpretation.cpp:1735</a></div></div>
970
+ <div class="ttc" id="aclassSVF_1_1SVFIR2AbsState_html_aec9a351850857fa3c6fb23c58317cb0d"><div class="ttname"><a href="classSVF_1_1SVFIR2AbsState.html#aec9a351850857fa3c6fb23c58317cb0d">SVF::SVFIR2AbsState::getByteOffset</a></div><div class="ttdeci">AbstractValue getByteOffset(AbstractState &amp;es, const GepStmt *gep)</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR2AbsState_8cpp_source.html#l00403">SVFIR2AbsState.cpp:403</a></div></div>
962
971
  <div class="ttc" id="aclassSVF_1_1ICFG_html_a5f2c0aaba07d6fdd63058da0fb60ca8b"><div class="ttname"><a href="classSVF_1_1ICFG.html#a5f2c0aaba07d6fdd63058da0fb60ca8b">SVF::ICFG::getICFGNode</a></div><div class="ttdeci">ICFGNode * getICFGNode(NodeID id) const</div><div class="ttdoc">Get a ICFG node.</div><div class="ttdef"><b>Definition:</b> <a href="ICFG_8h_source.html#l00092">ICFG.h:92</a></div></div>
963
972
  <div class="ttc" id="aclassSVF_1_1SVFFunction_html"><div class="ttname"><a href="classSVF_1_1SVFFunction.html">SVF::SVFFunction</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFValue_8h_source.html#l00297">SVFValue.h:297</a></div></div>
973
+ <div class="ttc" id="aclassSVF_1_1SVFIR2AbsState_html_ad42ca3cab47612c78a5d99cedea2f4ba"><div class="ttname"><a href="classSVF_1_1SVFIR2AbsState.html#ad42ca3cab47612c78a5d99cedea2f4ba">SVF::SVFIR2AbsState::inVarToAddrsTable</a></div><div class="ttdeci">bool inVarToAddrsTable(AbstractState &amp;es, u32_t id) const</div><div class="ttdoc">whether the variable is in varToAddrs table</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR2AbsState_8h_source.html#l00120">SVFIR2AbsState.h:120</a></div></div>
964
974
  <div class="ttc" id="aclassSVF_1_1FILOWorkList_html_afcf3fcda18e8d3e2bad70a51376c0ce1"><div class="ttname"><a href="classSVF_1_1FILOWorkList.html#afcf3fcda18e8d3e2bad70a51376c0ce1">SVF::FILOWorkList::push</a></div><div class="ttdeci">bool push(const Data &amp;data)</div><div class="ttdef"><b>Definition:</b> <a href="WorkList_8h_source.html#l00257">WorkList.h:257</a></div></div>
965
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a550c12360c2149ba0e55bdf4cf7b8dd0"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a550c12360c2149ba0e55bdf4cf7b8dd0">SVF::AbstractInterpretation::AccessMemoryViaCopyStmt</a></div><div class="ttdeci">void AccessMemoryViaCopyStmt(const CopyStmt *copy, SVF::FILOWorkList&lt; const SVFValue * &gt; &amp;worklist, Set&lt; const SVFValue * &gt; &amp;visited)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01721">AbstractInterpretation.cpp:1721</a></div></div>
975
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a550c12360c2149ba0e55bdf4cf7b8dd0"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a550c12360c2149ba0e55bdf4cf7b8dd0">SVF::AbstractInterpretation::AccessMemoryViaCopyStmt</a></div><div class="ttdeci">void AccessMemoryViaCopyStmt(const CopyStmt *copy, SVF::FILOWorkList&lt; const SVFValue * &gt; &amp;worklist, Set&lt; const SVFValue * &gt; &amp;visited)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01705">AbstractInterpretation.cpp:1705</a></div></div>
966
976
  <div class="ttc" id="aclassSVF_1_1SVFConstantInt_html"><div class="ttname"><a href="classSVF_1_1SVFConstantInt.html">SVF::SVFConstantInt</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFValue_8h_source.html#l00966">SVFValue.h:966</a></div></div>
967
977
  <div class="ttc" id="aclassSVF_1_1IntervalValue_html_adac2dc2c9f744a071ad3f0175ed40cd9"><div class="ttname"><a href="classSVF_1_1IntervalValue.html#adac2dc2c9f744a071ad3f0175ed40cd9">SVF::IntervalValue::ub</a></div><div class="ttdeci">const NumericLiteral &amp; ub() const</div><div class="ttdoc">Return the upper bound.</div><div class="ttdef"><b>Definition:</b> <a href="IntervalValue_8h_source.html#l00213">IntervalValue.h:213</a></div></div>
968
978
  <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_a52de7d619e8746a70718719306d7c5a1"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#a52de7d619e8746a70718719306d7c5a1">SVF::BufOverflowChecker::detectBufOverflow</a></div><div class="ttdeci">bool detectBufOverflow(const ICFGNode *node)</div></div>
@@ -970,35 +980,38 @@ $(function() {
970
980
  <div class="ttc" id="aclassSVF_1_1SVFStmt_html"><div class="ttname"><a href="classSVF_1_1SVFStmt.html">SVF::SVFStmt</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFStatements_8h_source.html#l00051">SVFStatements.h:51</a></div></div>
971
981
  <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_af83b65ed98cd4e0f6cd92962e7392d4d"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#af83b65ed98cd4e0f6cd92962e7392d4d">SVF::BufOverflowChecker::_extAPIBufOverflowCheckRules</a></div><div class="ttdeci">Map&lt; std::string, std::vector&lt; std::pair&lt; u32_t, u32_t &gt; &gt; &gt; _extAPIBufOverflowCheckRules</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8h_source.html#l00202">BufOverflowChecker.h:202</a></div></div>
972
982
  <div class="ttc" id="aclassSVF_1_1SVFVar_html"><div class="ttname"><a href="classSVF_1_1SVFVar.html">SVF::SVFVar</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFVariables_8h_source.html#l00045">SVFVariables.h:45</a></div></div>
973
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a9c592b91a1e3d72ada730387232a2fcf"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">SVF::AbstractInterpretation::_svfir2AbsState</a></div><div class="ttdeci">SVFIR2AbsState * _svfir2AbsState</div><div class="ttdoc">Execution State, used to store the Interval Value of every SVF variable.</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00345">AbstractInterpretation.h:345</a></div></div>
983
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a9c592b91a1e3d72ada730387232a2fcf"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a9c592b91a1e3d72ada730387232a2fcf">SVF::AbstractInterpretation::_svfir2AbsState</a></div><div class="ttdeci">SVFIR2AbsState * _svfir2AbsState</div><div class="ttdoc">Execution State, used to store the Interval Value of every SVF variable.</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00339">AbstractInterpretation.h:339</a></div></div>
984
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a57e4ee3fde79c408dffe98894210d7c9"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a57e4ee3fde79c408dffe98894210d7c9">SVF::AbstractInterpretation::getAbsState</a></div><div class="ttdeci">AbstractState &amp; getAbsState(const ICFGNode *node)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00372">AbstractInterpretation.h:372</a></div></div>
974
985
  <div class="ttc" id="aclassSVF_1_1LoadStmt_html"><div class="ttname"><a href="classSVF_1_1LoadStmt.html">SVF::LoadStmt</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFStatements_8h_source.html#l00489">SVFStatements.h:489</a></div></div>
975
986
  <div class="ttc" id="aclassSVF_1_1IntervalValue_html"><div class="ttname"><a href="classSVF_1_1IntervalValue.html">SVF::IntervalValue</a></div><div class="ttdef"><b>Definition:</b> <a href="IntervalValue_8h_source.html#l00043">IntervalValue.h:43</a></div></div>
976
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a6cac9b69d85111a5a26373ec848a3282"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a6cac9b69d85111a5a26373ec848a3282">SVF::AbstractInterpretation::handleExtAPI</a></div><div class="ttdeci">virtual void handleExtAPI(const CallICFGNode *call)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01174">AbstractInterpretation.cpp:1174</a></div></div>
987
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a60a21908a08864f01a66a3ac113c4a35"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a60a21908a08864f01a66a3ac113c4a35">SVF::AbstractInterpretation::getAllocaInstByteSize</a></div><div class="ttdeci">u32_t getAllocaInstByteSize(AbstractState &amp;as, const AddrStmt *addr)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01284">AbstractInterpretation.cpp:1284</a></div></div>
988
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a6cac9b69d85111a5a26373ec848a3282"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a6cac9b69d85111a5a26373ec848a3282">SVF::AbstractInterpretation::handleExtAPI</a></div><div class="ttdeci">virtual void handleExtAPI(const CallICFGNode *call)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01166">AbstractInterpretation.cpp:1166</a></div></div>
977
989
  <div class="ttc" id="aclassSVF_1_1GenericGraph_html_a43c9c773bfa17abf481c33073e30d01b"><div class="ttname"><a href="classSVF_1_1GenericGraph.html#a43c9c773bfa17abf481c33073e30d01b">SVF::GenericGraph::getGNode</a></div><div class="ttdeci">NodeType * getGNode(NodeID id) const</div><div class="ttdoc">Get a node.</div><div class="ttdef"><b>Definition:</b> <a href="GenericGraph_8h_source.html#l00406">GenericGraph.h:406</a></div></div>
978
990
  <div class="ttc" id="aclassSVF_1_1Options_html_afbe432aabda95308e2c190a04d227a6d"><div class="ttname"><a href="classSVF_1_1Options.html#afbe432aabda95308e2c190a04d227a6d">SVF::Options::BufferOverflowCheck</a></div><div class="ttdeci">static const Option&lt; bool &gt; BufferOverflowCheck</div><div class="ttdoc">buffer overflow checker, Default: false</div><div class="ttdef"><b>Definition:</b> <a href="Options_8h_source.html#l00271">Options.h:271</a></div></div>
979
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a29fe7c63c61a7aec8ae1477a061f5bf2"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a29fe7c63c61a7aec8ae1477a061f5bf2">SVF::AbstractInterpretation::AccessMemoryViaRetNode</a></div><div class="ttdeci">void AccessMemoryViaRetNode(const CallICFGNode *callnode, SVF::FILOWorkList&lt; const SVFValue * &gt; &amp;worklist, Set&lt; const SVFValue * &gt; &amp;visited)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01696">AbstractInterpretation.cpp:1696</a></div></div>
991
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a29fe7c63c61a7aec8ae1477a061f5bf2"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a29fe7c63c61a7aec8ae1477a061f5bf2">SVF::AbstractInterpretation::AccessMemoryViaRetNode</a></div><div class="ttdeci">void AccessMemoryViaRetNode(const CallICFGNode *callnode, SVF::FILOWorkList&lt; const SVFValue * &gt; &amp;worklist, Set&lt; const SVFValue * &gt; &amp;visited)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01680">AbstractInterpretation.cpp:1680</a></div></div>
980
992
  <div class="ttc" id="aclassSVF_1_1AbstractState_html"><div class="ttname"><a href="classSVF_1_1AbstractState.html">SVF::AbstractState</a></div><div class="ttdef"><b>Definition:</b> <a href="AbstractState_8h_source.html#l00054">AbstractState.h:54</a></div></div>
981
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_ac60581a57407fa4c65b1975f5be687b8"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#ac60581a57407fa4c65b1975f5be687b8">SVF::AbstractInterpretation::AccessMemoryViaLoadStmt</a></div><div class="ttdeci">void AccessMemoryViaLoadStmt(const LoadStmt *load, SVF::FILOWorkList&lt; const SVFValue * &gt; &amp;worklist, Set&lt; const SVFValue * &gt; &amp;visited)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01730">AbstractInterpretation.cpp:1730</a></div></div>
982
993
  <div class="ttc" id="anamespaceSVF_html_a9b707002523ece2ac54ca893ee9a2d4e"><div class="ttname"><a href="namespaceSVF.html#a9b707002523ece2ac54ca893ee9a2d4e">SVF::s32_t</a></div><div class="ttdeci">signed s32_t</div><div class="ttdef"><b>Definition:</b> <a href="GeneralType_8h_source.html#l00047">GeneralType.h:47</a></div></div>
983
994
  <div class="ttc" id="aclassSVF_1_1GepStmt_html"><div class="ttname"><a href="classSVF_1_1GepStmt.html">SVF::GepStmt</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFStatements_8h_source.html#l00526">SVFStatements.h:526</a></div></div>
984
- <div class="ttc" id="aclassSVF_1_1SVFIR2AbsState_html_a99b526db536fb241ff755a82a45123fa"><div class="ttname"><a href="classSVF_1_1SVFIR2AbsState.html#a99b526db536fb241ff755a82a45123fa">SVF::SVFIR2AbsState::getAbsState</a></div><div class="ttdeci">AbstractState &amp; getAbsState()</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR2AbsState_8h_source.html#l00054">SVFIR2AbsState.h:54</a></div></div>
985
995
  <div class="ttc" id="aclassSVF_1_1SVFIR_html_abda052b73e869ed6d7c139ad1528da11"><div class="ttname"><a href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">SVF::SVFIR::getICFG</a></div><div class="ttdeci">ICFG * getICFG() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR_8h_source.html#l00170">SVFIR.h:170</a></div></div>
986
996
  <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a13fdb4a6a6d09e3504fdad16b88616da"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616da">SVF::AbstractInterpretation::ExtAPIType</a></div><div class="ttdeci">ExtAPIType</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00113">AbstractInterpretation.h:113</a></div></div>
987
- <div class="ttc" id="aclassSVF_1_1SVFIR2AbsState_html_aa3e62b9ef912def502b95992199f5d8c"><div class="ttname"><a href="classSVF_1_1SVFIR2AbsState.html#aa3e62b9ef912def502b95992199f5d8c">SVF::SVFIR2AbsState::getAddrs</a></div><div class="ttdeci">AbstractValue &amp; getAddrs(u32_t id)</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR2AbsState_8h_source.html#l00113">SVFIR2AbsState.h:113</a></div></div>
988
997
  <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_a0b79c3694a08100d2d8d1b8109998131"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#a0b79c3694a08100d2d8d1b8109998131">SVF::BufOverflowChecker::handleSVFStatement</a></div><div class="ttdeci">virtual void handleSVFStatement(const SVFStmt *stmt) override</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00062">BufOverflowChecker.cpp:62</a></div></div>
989
998
  <div class="ttc" id="acJSON_8cpp_html_a95bf816579e97b6f33bdb5e25ed6d5de"><div class="ttname"><a href="cJSON_8cpp.html#a95bf816579e97b6f33bdb5e25ed6d5de">offset</a></div><div class="ttdeci">buffer offset</div><div class="ttdef"><b>Definition:</b> <a href="cJSON_8cpp_source.html#l01113">cJSON.cpp:1113</a></div></div>
990
- <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_af0e2276001df7d51c45b22d5d11ca09b"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#af0e2276001df7d51c45b22d5d11ca09b">SVF::BufOverflowChecker::initExtFunMap</a></div><div class="ttdeci">virtual void initExtFunMap() override</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00134">BufOverflowChecker.cpp:134</a></div></div>
991
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a9885b50cf28b65bebb488442085fab26"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a9885b50cf28b65bebb488442085fab26">SVF::AbstractInterpretation::_callSiteStack</a></div><div class="ttdeci">std::vector&lt; const CallICFGNode * &gt; _callSiteStack</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00354">AbstractInterpretation.h:354</a></div></div>
999
+ <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_af0e2276001df7d51c45b22d5d11ca09b"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#af0e2276001df7d51c45b22d5d11ca09b">SVF::BufOverflowChecker::initExtFunMap</a></div><div class="ttdeci">virtual void initExtFunMap() override</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00136">BufOverflowChecker.cpp:136</a></div></div>
1000
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a9885b50cf28b65bebb488442085fab26"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a9885b50cf28b65bebb488442085fab26">SVF::AbstractInterpretation::_callSiteStack</a></div><div class="ttdeci">std::vector&lt; const CallICFGNode * &gt; _callSiteStack</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00348">AbstractInterpretation.h:348</a></div></div>
1001
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_ab076eddb7908768126c190c23b91eb85"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#ab076eddb7908768126c190c23b91eb85">SVF::AbstractInterpretation::getStrlen</a></div><div class="ttdeci">AbstractValue getStrlen(AbstractState &amp;as, const SVF::SVFValue *strValue)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01451">AbstractInterpretation.cpp:1451</a></div></div>
1002
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_af7f57fc112a86d2710d011d37b496350"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#af7f57fc112a86d2710d011d37b496350">SVF::AbstractInterpretation::AccessMemoryViaLoadStmt</a></div><div class="ttdeci">void AccessMemoryViaLoadStmt(AbstractState &amp;as, const LoadStmt *load, SVF::FILOWorkList&lt; const SVFValue * &gt; &amp;worklist, Set&lt; const SVFValue * &gt; &amp;visited)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01714">AbstractInterpretation.cpp:1714</a></div></div>
992
1003
  <div class="ttc" id="aclassSVF_1_1IntervalValue_html_a674f9bb98053f8658e246863d6561072"><div class="ttname"><a href="classSVF_1_1IntervalValue.html#a674f9bb98053f8658e246863d6561072">SVF::IntervalValue::isBottom</a></div><div class="ttdeci">bool isBottom() const</div><div class="ttdef"><b>Definition:</b> <a href="IntervalValue_8h_source.html#l00060">IntervalValue.h:60</a></div></div>
993
1004
  <div class="ttc" id="aclassSVF_1_1CallSite_html"><div class="ttname"><a href="classSVF_1_1CallSite.html">SVF::CallSite</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFValue_8h_source.html#l01113">SVFValue.h:1113</a></div></div>
994
1005
  <div class="ttc" id="aclassSVF_1_1FILOWorkList_html_a071a624c91def82a4bbbf3806c7b7eea"><div class="ttname"><a href="classSVF_1_1FILOWorkList.html#a071a624c91def82a4bbbf3806c7b7eea">SVF::FILOWorkList::empty</a></div><div class="ttdeci">bool empty() const</div><div class="ttdef"><b>Definition:</b> <a href="WorkList_8h_source.html#l00238">WorkList.h:238</a></div></div>
995
1006
  <div class="ttc" id="aclassSVF_1_1SVFValue_html_a4a0cfe3a8f37d33ffcdca3d66026dcc3"><div class="ttname"><a href="classSVF_1_1SVFValue.html#a4a0cfe3a8f37d33ffcdca3d66026dcc3">SVF::SVFValue::toString</a></div><div class="ttdeci">std::string toString() const</div><div class="ttdoc">Needs to be implemented by a SVF front end.</div><div class="ttdef"><b>Definition:</b> <a href="LLVMUtil_8cpp_source.html#l00943">LLVMUtil.cpp:943</a></div></div>
996
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a8e4f0c5f527e321369a19a0b37124079"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a8e4f0c5f527e321369a19a0b37124079">SVF::AbstractInterpretation::_recoder</a></div><div class="ttdeci">SVFBugReport _recoder</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00353">AbstractInterpretation.h:353</a></div></div>
997
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a896d04a02951947bc228bf97b2c00313"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a896d04a02951947bc228bf97b2c00313">SVF::AbstractInterpretation::handleSVFStatement</a></div><div class="ttdeci">virtual void handleSVFStatement(const SVFStmt *stmt)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l00830">AbstractInterpretation.cpp:830</a></div></div>
1007
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a8e4f0c5f527e321369a19a0b37124079"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a8e4f0c5f527e321369a19a0b37124079">SVF::AbstractInterpretation::_recoder</a></div><div class="ttdeci">SVFBugReport _recoder</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00347">AbstractInterpretation.h:347</a></div></div>
1008
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a896d04a02951947bc228bf97b2c00313"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a896d04a02951947bc228bf97b2c00313">SVF::AbstractInterpretation::handleSVFStatement</a></div><div class="ttdeci">virtual void handleSVFStatement(const SVFStmt *stmt)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l00827">AbstractInterpretation.cpp:827</a></div></div>
998
1009
  <div class="ttc" id="aWorkList_8h_html"><div class="ttname"><a href="WorkList_8h.html">WorkList.h</a></div></div>
1010
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_abb8dd7424d62b56b899d3f4d218eeaac"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#abb8dd7424d62b56b899d3f4d218eeaac">SVF::AbstractInterpretation::getPointeeElement</a></div><div class="ttdeci">const SVFType * getPointeeElement(AbstractState &amp;as, NodeID id)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01605">AbstractInterpretation.cpp:1605</a></div></div>
999
1011
  <div class="ttc" id="acJSON_8cpp_html_a7669ee67a0563250c1efaa24d130e1ac"><div class="ttname"><a href="cJSON_8cpp.html#a7669ee67a0563250c1efaa24d130e1ac">copy</a></div><div class="ttdeci">copy</div><div class="ttdef"><b>Definition:</b> <a href="cJSON_8cpp_source.html#l00414">cJSON.cpp:414</a></div></div>
1000
1012
  <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a13fdb4a6a6d09e3504fdad16b88616daae8dad405c06383859d8db715fd455317"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daae8dad405c06383859d8db715fd455317">SVF::AbstractInterpretation::STRCAT</a></div><div class="ttdeci">@ STRCAT</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00113">AbstractInterpretation.h:113</a></div></div>
1001
- <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_a1ed3cb0a1a118d9e505b192841a58dde"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#a1ed3cb0a1a118d9e505b192841a58dde">SVF::BufOverflowChecker::handleExtAPI</a></div><div class="ttdeci">void handleExtAPI(const CallICFGNode *call) override</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00415">BufOverflowChecker.cpp:415</a></div></div>
1013
+ <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_a1ed3cb0a1a118d9e505b192841a58dde"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#a1ed3cb0a1a118d9e505b192841a58dde">SVF::BufOverflowChecker::handleExtAPI</a></div><div class="ttdeci">void handleExtAPI(const CallICFGNode *call) override</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8cpp_source.html#l00425">BufOverflowChecker.cpp:425</a></div></div>
1014
+ <div class="ttc" id="aclassSVF_1_1AbstractState_html_aaabe5850dbf1620c6058f5ac6cb169b6"><div class="ttname"><a href="classSVF_1_1AbstractState.html#aaabe5850dbf1620c6058f5ac6cb169b6">SVF::AbstractState::getInternalID</a></div><div class="ttdeci">static u32_t getInternalID(u32_t idx)</div><div class="ttdoc">Return the internal index if idx is an address otherwise return the value of idx.</div><div class="ttdef"><b>Definition:</b> <a href="AbstractState_8h_source.html#l00093">AbstractState.h:93</a></div></div>
1002
1015
  <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a13fdb4a6a6d09e3504fdad16b88616daa5aec33226dc590ec951d0f12bf35f15f"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a13fdb4a6a6d09e3504fdad16b88616daa5aec33226dc590ec951d0f12bf35f15f">SVF::AbstractInterpretation::MEMSET</a></div><div class="ttdeci">@ MEMSET</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00113">AbstractInterpretation.h:113</a></div></div>
1003
1016
  <div class="ttc" id="aclassSVF_1_1FILOWorkList_html_a3fd9acb6d09fd142bfd402fdf8cac93b"><div class="ttname"><a href="classSVF_1_1FILOWorkList.html#a3fd9acb6d09fd142bfd402fdf8cac93b">SVF::FILOWorkList::pop</a></div><div class="ttdeci">Data pop()</div><div class="ttdef"><b>Definition:</b> <a href="WorkList_8h_source.html#l00272">WorkList.h:272</a></div></div>
1004
1017
  <div class="ttc" id="aclassSVF_1_1FILOWorkList_html"><div class="ttname"><a href="classSVF_1_1FILOWorkList.html">SVF::FILOWorkList</a></div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00042">AbstractInterpretation.h:42</a></div></div>
@@ -1006,9 +1019,8 @@ $(function() {
1006
1019
  <div class="ttc" id="anamespaceSVF_html_a43a65e0d33af3c743294f7a1139d2301"><div class="ttname"><a href="namespaceSVF.html#a43a65e0d33af3c743294f7a1139d2301">SVF::NodeID</a></div><div class="ttdeci">unsigned NodeID</div><div class="ttdef"><b>Definition:</b> <a href="svf-llvm_2tools_2MTA_2MTAResultValidator_8h_source.html#l00020">MTAResultValidator.h:20</a></div></div>
1007
1020
  <div class="ttc" id="aclassSVF_1_1SVFType_html_a870b63af2bf9fe43cdf1df3d56b20f6c"><div class="ttname"><a href="classSVF_1_1SVFType.html#a870b63af2bf9fe43cdf1df3d56b20f6c">SVF::SVFType::isPointerTy</a></div><div class="ttdeci">bool isPointerTy() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFType_8h_source.html#l00249">SVFType.h:249</a></div></div>
1008
1021
  <div class="ttc" id="aclassSVF_1_1SVFVar_html_ab6f95d3e7e099d75cfc9645ebc037047"><div class="ttname"><a href="classSVF_1_1SVFVar.html#ab6f95d3e7e099d75cfc9645ebc037047">SVF::SVFVar::getType</a></div><div class="ttdeci">virtual const SVFType * getType() const</div><div class="ttdoc">Return type of the value.</div><div class="ttdef"><b>Definition:</b> <a href="SVFVariables_8h_source.html#l00107">SVFVariables.h:107</a></div></div>
1009
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a9b179466955023f275b6692b59048846"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a9b179466955023f275b6692b59048846">SVF::AbstractInterpretation::handleICFGNode</a></div><div class="ttdeci">virtual void handleICFGNode(const ICFGNode *node)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l00674">AbstractInterpretation.cpp:674</a></div></div>
1022
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a9b179466955023f275b6692b59048846"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a9b179466955023f275b6692b59048846">SVF::AbstractInterpretation::handleICFGNode</a></div><div class="ttdeci">virtual void handleICFGNode(const ICFGNode *node)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l00671">AbstractInterpretation.cpp:671</a></div></div>
1010
1023
  <div class="ttc" id="aclassSVF_1_1SVFArgument_html"><div class="ttname"><a href="classSVF_1_1SVFArgument.html">SVF::SVFArgument</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFValue_8h_source.html#l00897">SVFValue.h:897</a></div></div>
1011
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a2057e8e1c0aaf39e74f0a8fb2a1b580c"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a2057e8e1c0aaf39e74f0a8fb2a1b580c">SVF::AbstractInterpretation::getPointeeElement</a></div><div class="ttdeci">const SVFType * getPointeeElement(NodeID id)</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8cpp_source.html#l01620">AbstractInterpretation.cpp:1620</a></div></div>
1012
1024
  <div class="ttc" id="aclassSVF_1_1SVFArrayType_html_a28da1169748e38b891133b76568a2759"><div class="ttname"><a href="classSVF_1_1SVFArrayType.html#a28da1169748e38b891133b76568a2759">SVF::SVFArrayType::getTypeOfElement</a></div><div class="ttdeci">const SVFType * getTypeOfElement() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFType_8h_source.html#l00399">SVFType.h:399</a></div></div>
1013
1025
  <div class="ttc" id="aclassSVF_1_1SVFInstruction_html"><div class="ttname"><a href="classSVF_1_1SVFInstruction.html">SVF::SVFInstruction</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFValue_8h_source.html#l00631">SVFValue.h:631</a></div></div>
1014
1026
  <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_a0088456e712c555cbfba6203aec38037"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#a0088456e712c555cbfba6203aec38037">SVF::BufOverflowChecker::_addrToGep</a></div><div class="ttdeci">Map&lt; NodeID, const GepStmt * &gt; _addrToGep</div><div class="ttdef"><b>Definition:</b> <a href="BufOverflowChecker_8h_source.html#l00201">BufOverflowChecker.h:201</a></div></div>
@@ -1017,12 +1029,11 @@ $(function() {
1017
1029
  <div class="ttc" id="anamespaceSVF_html_a8234d4b959abc9123993bcff4eee34c1"><div class="ttname"><a href="namespaceSVF.html#a8234d4b959abc9123993bcff4eee34c1">SVF::Map</a></div><div class="ttdeci">std::unordered_map&lt; Key, Value, Hash, KeyEqual, Allocator &gt; Map</div><div class="ttdef"><b>Definition:</b> <a href="GeneralType_8h_source.html#l00101">GeneralType.h:101</a></div></div>
1018
1030
  <div class="ttc" id="astructSVF_1_1AbstractValue_html"><div class="ttname"><a href="structSVF_1_1AbstractValue.html">SVF::AbstractValue</a></div><div class="ttdef"><b>Definition:</b> <a href="AbstractValue_8h_source.html#l00029">AbstractValue.h:29</a></div></div>
1019
1031
  <div class="ttc" id="aclassSVF_1_1CallSite_html_a9e7c94ee7f689466111487e03b2cebcc"><div class="ttname"><a href="classSVF_1_1CallSite.html#a9e7c94ee7f689466111487e03b2cebcc">SVF::CallSite::getArgument</a></div><div class="ttdeci">const SVFValue * getArgument(u32_t ArgNo) const</div><div class="ttdef"><b>Definition:</b> <a href="SVFValue_8h_source.html#l01132">SVFValue.h:1132</a></div></div>
1020
- <div class="ttc" id="aclassSVF_1_1SVFIR2AbsState_html_ac37760566b534d89a61d789b00efb993"><div class="ttname"><a href="classSVF_1_1SVFIR2AbsState.html#ac37760566b534d89a61d789b00efb993">SVF::SVFIR2AbsState::getInternalID</a></div><div class="ttdeci">static u32_t getInternalID(u32_t idx)</div><div class="ttdoc">Return the internal index if idx is an address otherwise return the value of idx.</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR2AbsState_8h_source.html#l00170">SVFIR2AbsState.h:170</a></div></div>
1021
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_aa27d0ef684deec1f5385fdb0d4c64827"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">SVF::AbstractInterpretation::_func_map</a></div><div class="ttdeci">Map&lt; std::string, std::function&lt; void(const CallSite &amp;)&gt; &gt; _func_map</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00380">AbstractInterpretation.h:380</a></div></div>
1032
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_aa27d0ef684deec1f5385fdb0d4c64827"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#aa27d0ef684deec1f5385fdb0d4c64827">SVF::AbstractInterpretation::_func_map</a></div><div class="ttdeci">Map&lt; std::string, std::function&lt; void(const CallSite &amp;)&gt; &gt; _func_map</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00387">AbstractInterpretation.h:387</a></div></div>
1022
1033
  <div class="ttc" id="anamespaceSVF_html_ad42bff8d0a7d60a085aa32d10f4955af"><div class="ttname"><a href="namespaceSVF.html#ad42bff8d0a7d60a085aa32d10f4955af">SVF::u32_t</a></div><div class="ttdeci">unsigned u32_t</div><div class="ttdef"><b>Definition:</b> <a href="GeneralType_8h_source.html#l00046">GeneralType.h:46</a></div></div>
1023
1034
  <div class="ttc" id="anamespaceSVF_1_1SVFUtil_html_ab65033f068bfbeb0a1c52dcec3beb6bc"><div class="ttname"><a href="namespaceSVF_1_1SVFUtil.html#ab65033f068bfbeb0a1c52dcec3beb6bc">SVF::SVFUtil::errs</a></div><div class="ttdeci">std::ostream &amp; errs()</div><div class="ttdoc">Overwrite llvm::errs()</div><div class="ttdef"><b>Definition:</b> <a href="SVFUtil_8h_source.html#l00056">SVFUtil.h:56</a></div></div>
1024
1035
  <div class="ttc" id="aclassSVF_1_1BufOverflowChecker_html_a7c11b81809cb087317cbea654a589f75"><div class="ttname"><a href="classSVF_1_1BufOverflowChecker.html#a7c11b81809cb087317cbea654a589f75">SVF::BufOverflowChecker::addBugToRecoder</a></div><div class="ttdeci">void addBugToRecoder(const BufOverflowException &amp;e, const ICFGNode *node)</div></div>
1025
- <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a219313e979d779221116c1bc45becc1b"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a219313e979d779221116c1bc45becc1b">SVF::AbstractInterpretation::_checkpoints</a></div><div class="ttdeci">Set&lt; const CallICFGNode * &gt; _checkpoints</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00381">AbstractInterpretation.h:381</a></div></div>
1036
+ <div class="ttc" id="aclassSVF_1_1AbstractInterpretation_html_a219313e979d779221116c1bc45becc1b"><div class="ttname"><a href="classSVF_1_1AbstractInterpretation.html#a219313e979d779221116c1bc45becc1b">SVF::AbstractInterpretation::_checkpoints</a></div><div class="ttdeci">Set&lt; const CallICFGNode * &gt; _checkpoints</div><div class="ttdef"><b>Definition:</b> <a href="AbstractInterpretation_8h_source.html#l00388">AbstractInterpretation.h:388</a></div></div>
1026
1037
  <!-- start footer part -->
1027
1038
  <hr class="footer"/><address class="footer"><small>
1028
1039
  Generated by &#160;<a href="http://www.doxygen.org/index.html">