46 if (!SVFUtil::isa<CallICFGNode>(node))
117 std::string funcName =
callNode->getCalledFunction()->getName();
118 if (funcName ==
"SAFE_BUFACCESS")
132 assert(
false &&
"SAFE_BUFACCESS size is bottom");
139 <<
" — " <<
callNode->toString() <<
"\n";
145 <<
" — Position: " <<
callNode->getSourceLoc() <<
"\n";
149 else if (funcName ==
"UNSAFE_BUFACCESS")
153 if (
callNode->arg_size() < 2)
return;
159 assert(
false &&
"UNSAFE_BUFACCESS size is bottom");
166 <<
" — " <<
callNode->toString() <<
"\n";
172 <<
" — Position: " <<
callNode->getSourceLoc() <<
"\n";
228 if (
annotation.find(
"MEMCPY") != std::string::npos)
230 if (
annotation.find(
"MEMSET") != std::string::npos)
232 if (
annotation.find(
"STRCPY") != std::string::npos)
234 if (
annotation.find(
"STRCAT") != std::string::npos)
246 std::vector<std::pair<u32_t, u32_t>>
args =
266 std::vector<std::pair<u32_t, u32_t>>
args =
317 if (SVFUtil::isa<BaseObjVar>(
obj))
321 return as.getByteOffset(
gep);
323 else if (SVFUtil::isa<GepObjVar>(
obj))
331 assert(SVFUtil::isa<DummyObjVar>(
obj) &&
"Unknown object type");
355 if (SVFUtil::isa<BaseObjVar>(
obj))
373 else if (SVFUtil::isa<GepObjVar>(
obj))
395 "GEP RHS object has no offset from base");
437 const std::vector<std::string>
strcatGroup = {
"__strcat_chk",
"strcat",
"__wcscat_chk",
"wcscat"};
438 const std::vector<std::string>
strncatGroup = {
"__strncat_chk",
"strncat",
"__wcsncat_chk",
"wcsncat"};
460 assert(
false &&
"Unknown strcat function, please add it to strcatGroup or strncatGroup");
517 if (
offset.ub().getIntNumeral() >= size)
527 if (SVFUtil::isa<CallICFGNode>(node))
552 else if (
const LoadStmt* load = SVFUtil::dyn_cast<LoadStmt>(
stmt))
570 std::string funcName =
callNode->getCalledFunction()->getName();
571 if (funcName ==
"UNSAFE_LOAD")
585 <<
" — " <<
callNode->toString() <<
"\n";
591 <<
" — Position: " <<
callNode->getSourceLoc() <<
"\n";
595 else if (funcName ==
"SAFE_LOAD")
599 if (
callNode->arg_size() < 1)
return;
607 <<
" — " <<
callNode->toString() <<
"\n";
613 <<
" — Position: " <<
callNode->getSourceLoc() <<
"\n";
627 if (
annotation.find(
"MEMCPY") != std::string::npos)
644 else if (
annotation.find(
"MEMSET") != std::string::npos)
649 else if (
annotation.find(
"STRCPY") != std::string::npos)
655 else if (
annotation.find(
"STRCAT") != std::string::npos)
685 if (!
AbsVal.isAddr())
return true;
695 else if (
as.isFreedMem(
addr))
Exception class for handling errors in Abstract Execution.
IntervalValue getStrlen(AbstractState &as, const SVF::SVFVar *strValue)
Calculates the length of a string.
ExtAPIType
Enumeration of external API types.
static AbstractInterpretation & getAEInstance()
AbstractState & getAbsStateFromTrace(const ICFGNode *node)
Retrieves the abstract state from the trace for a given ICFG node.
Set< const CallICFGNode * > checkpoints
static bool isNullMem(u32_t addr)
static bool isInvalidMem(u32_t addr)
const ICFGNode * getICFGNode() const
Get the ICFGNode related to the creation of this object.
bool isConstantByteSize() const
Check if byte size is a const value.
u32_t getByteSizeOfObj() const
Get the byte size of this object.
IntervalValue getAccessOffset(AbstractState &as, NodeID objId, const GepStmt *gep)
Retrieves the access offset for a given object and GEP statement.
void addToGepObjOffsetFromBase(const GepObjVar *obj, const IntervalValue &offset)
Adds an offset to a GEP object.
Map< std::string, std::vector< std::pair< u32_t, u32_t > > > extAPIBufOverflowCheckRules
Rules for checking buffer overflows in external APIs.
void detect(AbstractState &as, const ICFGNode *)
Detect buffer overflow issues within a node.
bool detectStrcpy(AbstractState &as, const CallICFGNode *call)
Detects buffer overflow in 'strcpy' function calls.
bool detectStrcat(AbstractState &as, const CallICFGNode *call)
Detects buffer overflow in 'strcat' function calls.
IntervalValue getGepObjOffsetFromBase(const GepObjVar *obj) const
Retrieves the offset of a GEP object from its base.
void handleStubFunctions(const CallICFGNode *)
Handles external API calls related to buffer overflow detection.
bool hasGepObjOffsetFromBase(const GepObjVar *obj) const
Checks if a GEP object has an associated offset.
bool canSafelyAccessMemory(AbstractState &as, const SVFVar *value, const IntervalValue &len)
Checks if memory can be safely accessed.
void initExtAPIBufOverflowCheckRules()
Initializes external API buffer overflow check rules.
void detectExtAPI(AbstractState &as, const CallICFGNode *call)
Handles external API calls related to buffer overflow detection.
void updateGepObjOffsetFromBase(AbstractState &as, AddressValue gepAddrs, AddressValue objAddrs, IntervalValue offset)
Updates the offset of a GEP object from its base.
void addBugToReporter(const AEException &e, const ICFGNode *node)
Adds a bug to the reporter based on an exception.
const std::string toString() const override
const ValVar * getArgument(u32_t ArgNo) const
Parameter operations.
const FunObjVar * getCalledFunction() const
static ExtAPI * getExtAPI()
const std::vector< std::string > & getExtFuncAnnotations(const FunObjVar *fun)
NodeType * getGNode(NodeID id) const
Get a node.
const SVFStmtList & getSVFStmts() const
static IntervalValue bottom()
Create the bottom IntervalValue [+inf, -inf].
static IntervalValue top()
Create the IntervalValue [-inf, +inf].
bool canSafelyDerefPtr(AbstractState &as, const SVFVar *ptr)
bool isUninit(AbstractValue v)
Checks if an Abstract Value is uninitialized.
void detect(AbstractState &as, const ICFGNode *node)
Detects nullptr dereferences issues within a node.
void addBugToReporter(const AEException &e, const ICFGNode *node)
Adds a bug to the reporter based on an exception.
void handleStubFunctions(const CallICFGNode *call)
Handles external API calls related to nullptr dereferences.
void detectExtAPI(AbstractState &as, const CallICFGNode *call)
Handle external API calls related to nullptr dereferences.
const BaseObjVar * getBaseObject(NodeID id) const
static SVFIR * getPAG(bool buildFromFile=false)
Singleton design here to make sure we only have one instance during any analysis.
NodeID getId() const
Get ID.
virtual const std::string & getName() const
std::string sucMsg(const std::string &msg)
Returns successful message by converting a string into green string output.
std::string errMsg(const std::string &msg)
Print error message by converting a string into red string output.
std::ostream & errs()
Overwrite llvm::errs()
bool isExtCall(const FunObjVar *fun)
std::ostream & outs()
Overwrite llvm::outs()
llvm::IRBuilder IRBuilder