42#define SSE_FUNC_PROCESS(LLVM_NAME ,FUNC_NAME) \
43 auto sse_##FUNC_NAME = [this](const CallICFGNode *callNode) { \
45 AbstractState& as = getAbsStateFromTrace(callNode); \
46 u32_t rhs_id = callNode->getArgument(0)->getId(); \
47 if (!as.inVarToValTable(rhs_id)) return; \
48 u32_t rhs = as[rhs_id].getInterval().lb().getIntNumeral(); \
49 s32_t res = FUNC_NAME(rhs); \
50 u32_t lhsId = callNode->getRetICFGNode()->getActualRet()->getId(); \
51 as[lhsId] = IntervalValue(res); \
54 func_map[#FUNC_NAME] = sse_##FUNC_NAME;
98 if (
as[
arg0].getInterval().equals(
as[
arg1].getInterval()))
113 if (
callNode->arg_size() < 2)
return;
117 assert(
as.inVarToValTable(
num_id) &&
"print() should pass integer");
120 <<
", PrintVal: " <<
itv.toString() <<
", Loc:" <<
callNode->getSourceLoc() << std::endl;
127 if (
callNode->arg_size() < 2)
return;
133 num.getInterval().set_to_top();
135 const ICFGNode* node = SVFUtil::cast<ValVar>(
callNode->getArgument(0))->getICFGNode();
138 if (SVFUtil::isa<LoadStmt>(
stmt))
153 if (
callNode->arg_size() < 2)
return;
174 if (
callNode->arg_size() < 3)
return;
203 if (
callNode->arg_size() < 3)
return;
220 if (
callNode->arg_size() < 2)
return;
226 if (
callNode->getArgument(2)->getType()->isArrayTy())
228 elemSize = SVFUtil::dyn_cast<SVFArrayType>(
229 callNode->getArgument(2)->getType())->getTypeOfElement()->getByteSize();
231 else if (
callNode->getArgument(2)->getType()->isPointerTy())
261 if (
callNode->arg_size() < 3)
return;
266 std::string
snum = std::to_string(
num);
274 if (
callNode->arg_size() < 1)
return;
301 if (
as.inVarToAddrsTable(
dstid))
312 if (
val.getInterval().is_numeral() && (
char)
val.getInterval().getIntNumeral() ==
'\0')
334 if (
callNode->arg_size() < 4)
return;
346 if (
callNode->arg_size() < 1)
return;
365 "VOS_MemFree",
"cfree",
"free",
"free_all_mem",
"freeaddrinfo",
366 "gcry_mpi_release",
"gcry_sexp_release",
"globfree",
"nhfree",
367 "obstack_free",
"safe_cfree",
"safe_free",
"safefree",
"safexfree",
368 "sm_free",
"vim_free",
"xfree",
"SSL_CTX_free",
"SSL_free",
"XFree"
382 assert(0 &&
"No preAbsTrace for this node");
398 if (!
as.inVarToAddrsTable(
rhs->getId()))
continue;
407 if (!
val.getInterval().is_numeral())
411 if ((
char)
val.getInterval().getIntNumeral() ==
'\0')
415 str0.push_back((
char)
val.getInterval().getIntNumeral());
424 assert(fun &&
"FunObjVar* is nullptr");
429 if (
annotation.find(
"MEMCPY") != std::string::npos)
431 if (
annotation.find(
"MEMSET") != std::string::npos)
433 if (
annotation.find(
"STRCPY") != std::string::npos)
435 if (
annotation.find(
"STRCAT") != std::string::npos)
449 if (
as.inVarToAddrsTable(
lhsId))
538 if (
val.getInterval().is_numeral() && (
char)
val.getInterval().getIntNumeral() ==
'\0')
544 if (
strValue->getType()->isArrayTy())
546 elemSize = SVFUtil::dyn_cast<SVFArrayType>(
strValue->getType())->getTypeOfElement()->getByteSize();
548 else if (
strValue->getType()->isPointerTy())
553 elemSize = SVFUtil::dyn_cast<SVFArrayType>(
elemType)->getTypeOfElement()->getByteSize();
564 assert(
false &&
"we cannot support this type");
584 const std::vector<std::string>
strcatGroup = {
"__strcat_chk",
"strcat",
"__wcscat_chk",
"wcscat"};
585 const std::vector<std::string>
strncatGroup = {
"__strncat_chk",
"strncat",
"__wcsncat_chk",
"wcsncat"};
609 assert(
false &&
"unknown strcat function, please add it to strcatGroup or strncatGroup");
620 elemSize = SVFUtil::dyn_cast<SVFArrayType>(dst->
getType())->getTypeOfElement()->getByteSize();
628 elemSize = SVFUtil::dyn_cast<SVFArrayType>(
elemType)->getTypeOfElement()->getByteSize();
639 assert(
false &&
"we cannot support this type");
652 for (
const auto &dst:
expr_dst.getAddrs())
654 for (
const auto &src:
expr_src.getAddrs())
657 if (
as.inAddrToValTable(
objId))
659 as.store(dst,
as.load(src));
661 else if (
as.inAddrToAddrsTable(
objId))
663 as.store(dst,
as.load(src));
678 elemSize = SVFUtil::dyn_cast<SVFArrayType>(dst->
getType())->getTypeOfElement()->getByteSize();
693 assert(
false &&
"we cannot support this type");
700 if (
as.inVarToAddrsTable(
dstId))
706 if (
as.inAddrToValTable(
objId))
745 ub =
static_cast<s64_t>(std::numeric_limits<s32_t>::max());
746 lb =
static_cast<s64_t>(std::numeric_limits<s32_t>::min());
750 ub =
static_cast<s64_t>(std::numeric_limits<u32_t>::max());
751 lb =
static_cast<s64_t>(std::numeric_limits<u32_t>::min());
758 ub =
static_cast<s64_t>(std::numeric_limits<s16_t>::max());
759 lb =
static_cast<s64_t>(std::numeric_limits<s16_t>::min());
763 ub =
static_cast<s64_t>(std::numeric_limits<u16_t>::max());
764 lb =
static_cast<s64_t>(std::numeric_limits<u16_t>::min());
771 ub =
static_cast<s64_t>(std::numeric_limits<int8_t>::max());
772 lb =
static_cast<s64_t>(std::numeric_limits<int8_t>::min());
776 ub =
static_cast<s64_t>(std::numeric_limits<u_int8_t>::max());
777 lb =
static_cast<s64_t>(std::numeric_limits<u_int8_t>::min());
782 else if (SVFUtil::isa<SVFOtherType>(
type))
785 s64_t ub =
static_cast<s64_t>(std::numeric_limits<s32_t>::max());
786 s64_t lb =
static_cast<s64_t>(std::numeric_limits<s32_t>::min());
#define SSE_FUNC_PROCESS(LLVM_NAME,FUNC_NAME)
std::string strRead(AbstractState &as, const SVFVar *rhs)
Reads a string from the abstract state.
void handleMemset(AbstractState &as, const SVFVar *dst, IntervalValue elem, IntervalValue len)
Handles the memset API call.
void initExtFunMap()
Initializes the external function map.
IntervalValue getStrlen(AbstractState &as, const SVF::SVFVar *strValue)
Calculates the length of a string.
Map< const ICFGNode *, AbstractState > & abstractTrace
Map of ICFG nodes to abstract states.
void handleExtAPI(const CallICFGNode *call)
Handles an external API call.
AbsExtAPI(Map< const ICFGNode *, AbstractState > &traces)
Constructor for AbsExtAPI.
AbstractState & getAbsStateFromTrace(const ICFGNode *node)
Retrieves the abstract state from the trace for a given ICFG node.
void handleMemcpy(AbstractState &as, const SVF::SVFVar *dst, const SVF::SVFVar *src, IntervalValue len, u32_t start_idx)
Handles the memcpy API call.
SVFIR * svfir
Pointer to the SVF intermediate representation.
void handleStrcat(const SVF::CallICFGNode *call)
Handles the strcat API call.
ExtAPIType
Enumeration of external API types.
IntervalValue getRangeLimitFromType(const SVFType *type)
Gets the range limit from a type.
ICFG * icfg
Pointer to the interprocedural control flow graph.
void handleStrcpy(const CallICFGNode *call)
Handles the strcpy API call.
Map< std::string, std::function< void(const CallICFGNode *)> > func_map
Map of function names to handlers.
static AbstractInterpretation & getAEInstance()
Set< const CallICFGNode * > checkpoints
static bool isInvalidMem(u32_t addr)
void join_with(const AbstractValue &other)
IntervalValue & getInterval()
NodeID getRHSVarID() const
const ICFGNode * getICFGNode() const
Get the ICFGNode related to the creation of this object.
bool isConstantByteSize() const
Check if byte size is a const value.
u32_t getByteSizeOfObj() const
Get the byte size of this object.
const ValVar * getArgument(u32_t ArgNo) const
Parameter operations.
const FunObjVar * getCalledFunction() const
const RetICFGNode * getRetICFGNode() const
Return callsite.
static ExtAPI * getExtAPI()
const std::vector< std::string > & getExtFuncAnnotations(const FunObjVar *fun)
NodeType * getGNode(NodeID id) const
Get a node.
const SVFStmtList & getSVFStmts() const
const ICFGNode * getRepNode(const ICFGNode *node) const
const BoundedInt & ub() const
Return the upper bound.
bool is_numeral() const
Return true if the IntervalValue is a number [num, num].
const std::string toString() const
static IntervalValue top()
Create the IntervalValue [-inf, +inf].
const BoundedInt & lb() const
Return the lower bound.
static const Option< u32_t > MaxFieldLimit
Maximum number of field derivations for an object.
const SVFVar * getActualRet() const
Return actual return parameter.
const BaseObjVar * getBaseObject(NodeID id) const
static SVFIR * getPAG(bool buildFromFile=false)
Singleton design here to make sure we only have one instance during any analysis.
NodeID getId() const
Get ID.
virtual const SVFType * getType() const
virtual const std::string & getName() const
int ispunct(int argument)
int isblank(int character)
int isalnum(int character)
int isalpha(int character)
std::string sucMsg(const std::string &msg)
Returns successful message by converting a string into green string output.
std::ostream & errs()
Overwrite llvm::errs()
llvm::IRBuilder IRBuilder