38 const std::map<GenericBug::BugType, std::string> GenericBug::BugType2Str =
40 {GenericBug::FULLBUFOVERFLOW,
"Full Buffer Overflow"},
41 {GenericBug::PARTIALBUFOVERFLOW,
"Partial Buffer Overflow"},
42 {GenericBug::NEVERFREE,
"Never Free"},
43 {GenericBug::PARTIALLEAK,
"Partial Leak"},
44 {GenericBug::FILENEVERCLOSE,
"File Never Close"},
45 {GenericBug::FILEPARTIALCLOSE,
"File Partial Close"},
46 {GenericBug::DOUBLEFREE,
"Double Free"},
47 {GenericBug::FULLNULLPTRDEREFERENCE,
"Full Null Ptr Dereference"},
48 {GenericBug::PARTIALNULLPTRDEREFERENCE,
"Partial Null Ptr Dereference"}
53 const SVFBugEvent&sourceInstEvent = bugEventStack.at(bugEventStack.size() -1);
59 const SVFBugEvent&sourceInstEvent = bugEventStack.at(bugEventStack.size() -1);
63 cJSON *BufferOverflowBug::getBugDescription()
const
65 cJSON *bugDescription = cJSON_CreateObject();
66 cJSON *allocLB = cJSON_CreateNumber(allocLowerBound);
67 cJSON *allocUB = cJSON_CreateNumber(allocUpperBound);
68 cJSON *accessLB = cJSON_CreateNumber(accessLowerBound);
69 cJSON *accessUB = cJSON_CreateNumber(accessUpperBound);
71 cJSON_AddItemToObject(bugDescription,
"AllocLowerBound", allocLB);
72 cJSON_AddItemToObject(bugDescription,
"AllocUpperBound", allocUB);
73 cJSON_AddItemToObject(bugDescription,
"AccessLowerBound", accessLB);
74 cJSON_AddItemToObject(bugDescription,
"AccessUpperBound", accessUB);
76 return bugDescription;
79 void BufferOverflowBug::printBugToTerminal()
const
82 if(FullBufferOverflowBug::classof(
this))
85 << GenericBug::getLoc() <<
")\n";
91 << GenericBug::getLoc() <<
")\n";
93 bugInfo <<
"\t\t allocate size : [" << allocLowerBound <<
", " << allocUpperBound <<
"], ";
94 bugInfo <<
"access size : [" << accessLowerBound <<
", " << accessUpperBound <<
"]\n";
98 for(
auto event : bugEventStack)
100 switch(event.getEventType())
102 case SVFBugEvent::CallSite:
104 SVFUtil::errs() <<
"\t\t callsite at : ( " <<
event.getEventLoc() <<
" )\n";
116 cJSON * NeverFreeBug::getBugDescription()
const
118 cJSON *bugDescription = cJSON_CreateObject();
119 return bugDescription;
122 void NeverFreeBug::printBugToTerminal()
const
125 << GenericBug::getLoc() <<
")\n";
128 cJSON * PartialLeakBug::getBugDescription()
const
130 cJSON *bugDescription = cJSON_CreateObject();
131 cJSON *pathInfo = cJSON_CreateArray();
132 auto lastBranchEventIt = bugEventStack.end() - 1;
133 for(
auto eventIt = bugEventStack.begin(); eventIt != lastBranchEventIt; eventIt++)
135 cJSON *newBranch = cJSON_CreateObject();
136 cJSON *branchLoc = cJSON_Parse((*eventIt).getEventLoc().c_str());
137 if(branchLoc ==
nullptr) branchLoc = cJSON_CreateObject();
139 cJSON *branchCondition = cJSON_CreateString((*eventIt).getEventDescription().c_str());
141 cJSON_AddItemToObject(newBranch,
"BranchLoc", branchLoc);
142 cJSON_AddItemToObject(newBranch,
"BranchCond", branchCondition);
144 cJSON_AddItemToArray(pathInfo, newBranch);
147 cJSON_AddItemToObject(bugDescription,
"ConditionalFreePath", pathInfo);
149 return bugDescription;
152 void PartialLeakBug::printBugToTerminal()
const
155 << GenericBug::getLoc() <<
")\n";
158 auto lastBranchEventIt = bugEventStack.end() - 1;
159 for(
auto eventIt = bugEventStack.begin(); eventIt != lastBranchEventIt; eventIt++)
161 SVFUtil::errs() <<
"\t\t --> (" << (*eventIt).getEventLoc() <<
"|" << (*eventIt).getEventDescription() <<
") \n";
166 cJSON * DoubleFreeBug::getBugDescription()
const
168 cJSON *bugDescription = cJSON_CreateObject();
170 cJSON *pathInfo = cJSON_CreateArray();
171 auto lastBranchEventIt = bugEventStack.end() - 1;
172 for(
auto eventIt = bugEventStack.begin(); eventIt != lastBranchEventIt; eventIt++)
174 cJSON *newBranch = cJSON_CreateObject();
175 cJSON *branchLoc = cJSON_Parse((*eventIt).getEventLoc().c_str());
176 if(branchLoc ==
nullptr) branchLoc = cJSON_CreateObject();
177 cJSON *branchCondition = cJSON_CreateString((*eventIt).getEventDescription().c_str());
179 cJSON_AddItemToObject(newBranch,
"BranchLoc", branchLoc);
180 cJSON_AddItemToObject(newBranch,
"BranchCond", branchCondition);
182 cJSON_AddItemToArray(pathInfo, newBranch);
184 cJSON_AddItemToObject(bugDescription,
"DoubleFreePath", pathInfo);
186 return bugDescription;
189 void DoubleFreeBug::printBugToTerminal()
const
192 << GenericBug::getLoc() <<
")\n";
195 auto lastBranchEventIt = bugEventStack.end() - 1;
196 for(
auto eventIt = bugEventStack.begin(); eventIt != lastBranchEventIt; eventIt++)
198 SVFUtil::errs() <<
"\t\t --> (" << (*eventIt).getEventLoc() <<
"|" << (*eventIt).getEventDescription() <<
") \n";
203 cJSON * FileNeverCloseBug::getBugDescription()
const
205 cJSON *bugDescription = cJSON_CreateObject();
206 return bugDescription;
209 void FileNeverCloseBug::printBugToTerminal()
const
212 << GenericBug::getLoc() <<
")\n";
215 cJSON * FilePartialCloseBug::getBugDescription()
const
217 cJSON *bugDescription = cJSON_CreateObject();
219 cJSON *pathInfo = cJSON_CreateArray();
221 auto lastBranchEventIt = bugEventStack.end() - 1;
222 for(
auto eventIt = bugEventStack.begin(); eventIt != lastBranchEventIt; eventIt++)
224 cJSON *newBranch = cJSON_CreateObject();
225 cJSON *branchLoc = cJSON_Parse((*eventIt).getEventLoc().c_str());
226 if(branchLoc ==
nullptr) branchLoc = cJSON_CreateObject();
227 cJSON *branchCondition = cJSON_CreateString((*eventIt).getEventDescription().c_str());
229 cJSON_AddItemToObject(newBranch,
"BranchLoc", branchLoc);
230 cJSON_AddItemToObject(newBranch,
"BranchCond", branchCondition);
232 cJSON_AddItemToArray(pathInfo, newBranch);
234 cJSON_AddItemToObject(bugDescription,
"ConditionalFileClosePath", pathInfo);
236 return bugDescription;
239 void FilePartialCloseBug::printBugToTerminal()
const
242 << GenericBug::getLoc() <<
")\n";
245 auto lastBranchEventIt = bugEventStack.end() - 1;
246 for(
auto eventIt = bugEventStack.begin(); eventIt != lastBranchEventIt; eventIt++)
248 SVFUtil::errs() <<
"\t\t --> (" << (*eventIt).getEventLoc() <<
"|" << (*eventIt).getEventDescription() <<
") \n";
253 cJSON *FullNullPtrDereferenceBug::getBugDescription()
const
255 cJSON *bugDescription = cJSON_CreateObject();
256 return bugDescription;
259 void FullNullPtrDereferenceBug::printBugToTerminal()
const
262 << GenericBug::getLoc() <<
")\n";
265 cJSON *PartialNullPtrDereferenceBug::getBugDescription()
const
267 cJSON *bugDescription = cJSON_CreateObject();
268 return bugDescription;
271 void PartialNullPtrDereferenceBug::printBugToTerminal()
const
274 << GenericBug::getLoc() <<
")\n";
279 return eventInst->getFun()->getName();
284 return eventInst->getSourceLoc();
289 switch(getEventType())
291 case SVFBugEvent::Branch:
303 case SVFBugEvent::CallSite:
306 assert(SVFUtil::isa<CallICFGNode>(eventInst) &&
"not a call ICFGNode?");
307 const SVFFunction *callee = SVFUtil::cast<CallICFGNode>(eventInst)->getCalledFunction();
308 if(callee ==
nullptr)
310 description +=
"<unknown>";
314 description += callee->
getName();
319 case SVFBugEvent::SourceInst:
325 assert(
false &&
"No such type of event!");
331 SVFBugReport::~SVFBugReport()
333 for(
auto bugIt: bugSet)
339 void SVFBugReport::dumpToJsonFile(
const std::string& filePath)
const
341 std::map<u32_t, std::string> eventType2Str =
343 {SVFBugEvent::CallSite,
"call site"},
344 {SVFBugEvent::Caller,
"caller"},
346 {SVFBugEvent::Branch,
"branch"}
349 ofstream jsonFile(filePath, ios::out);
354 jsonFile <<
"\"Defects\": [\n";
355 size_t commaCounter = bugSet.size() - 1;
356 for (
auto bugPtr : bugSet)
358 cJSON *singleDefect = cJSON_CreateObject();
361 cJSON *bugType = cJSON_CreateString(
362 GenericBug::BugType2Str.at(bugPtr->getBugType()).c_str());
363 cJSON_AddItemToObject(singleDefect,
"DefectType", bugType);
365 cJSON *bugLoc = cJSON_Parse(bugPtr->getLoc().c_str());
366 if (bugLoc ==
nullptr)
368 bugLoc = cJSON_CreateObject();
370 cJSON_AddItemToObject(singleDefect,
"Location", bugLoc);
372 cJSON *bugFunction = cJSON_CreateString(
373 bugPtr->getFuncName().c_str());
374 cJSON_AddItemToObject(singleDefect,
"Function", bugFunction);
376 cJSON_AddItemToObject(singleDefect,
"Description",
377 bugPtr->getBugDescription());
380 cJSON *eventList = cJSON_CreateArray();
382 if (BufferOverflowBug::classof(bugPtr))
387 if (event.getEventType() == SVFBugEvent::SourceInst)
392 cJSON *singleEvent = cJSON_CreateObject();
394 cJSON *eventType = cJSON_CreateString(
395 eventType2Str[event.getEventType()].c_str());
396 cJSON_AddItemToObject(singleEvent,
"EventType", eventType);
398 cJSON *eventFunc = cJSON_CreateString(
399 event.getFuncName().c_str());
400 cJSON_AddItemToObject(singleEvent,
"Function", eventFunc);
402 cJSON *eventLoc = cJSON_Parse(event.getEventLoc().c_str());
403 if (eventLoc ==
nullptr)
405 eventLoc = cJSON_CreateObject();
407 cJSON_AddItemToObject(singleEvent,
"Location", eventLoc);
409 cJSON *eventDescription = cJSON_CreateString(
410 event.getEventDescription().c_str());
411 cJSON_AddItemToObject(singleEvent,
"Description", eventDescription);
413 cJSON_AddItemToArray(eventList, singleEvent);
416 cJSON_AddItemToObject(singleDefect,
"Events", eventList);
419 char *singleDefectStr = cJSON_Print(singleDefect);
420 jsonFile << singleDefectStr;
421 if (commaCounter != 0)
430 jsonFile <<
"\n],\n";
433 jsonFile <<
"\"Time\": " << time <<
",\n";
434 jsonFile <<
"\"Memory\": \"" << mem <<
"\",\n";
435 jsonFile <<
"\"Coverage\": " << coverage <<
"\n";
std::vector< SVFBugEvent > EventStack
virtual const std::string getEventLoc() const
virtual const std::string getFuncName() const
const std::string & getName() const
std::string bugMsg1(const std::string &msg)
std::ostream & errs()
Overwrite llvm::errs()
std::string bugMsg2(const std::string &msg)
llvm::Loop Loop
LLVM Loop.