SVF::AbsExtAPI Class Reference

Handles external API calls and manages abstract states. More...

#include <AbsExtAPI.h>

Public Types
enum	ExtAPIType {   UNCLASSIFIED , MEMCPY , MEMSET , STRCPY ,   STRCAT }
	Enumeration of external API types. More...

Public Member Functions
	AbsExtAPI (Map< const ICFGNode *, AbstractState > &traces)
	Constructor for AbsExtAPI.
void	initExtFunMap ()
	Initializes the external function map.
std::string	strRead (AbstractState &as, const SVFVar *rhs)
	Reads a string from the abstract state.
void	handleExtAPI (const CallICFGNode *call)
	Handles an external API call.
u32_t	getElementSize (AbstractState &as, const SVFVar *var)
	Get the byte size of each element for a pointer/array variable.
IntervalValue	getStrlen (AbstractState &as, const SVF::SVFVar *strValue)
	Calculate the length of a null-terminated string in abstract state.
void	handleStrcpy (const CallICFGNode *call)
void	handleStrcat (const CallICFGNode *call)
void	handleStrncat (const CallICFGNode *call)
void	handleMemcpy (AbstractState &as, const SVF::SVFVar *dst, const SVF::SVFVar *src, IntervalValue len, u32_t start_idx)
	Core memcpy: copy len bytes from src to dst starting at dst[start_idx].
void	handleMemset (AbstractState &as, const SVFVar *dst, IntervalValue elem, IntervalValue len)
IntervalValue	getRangeLimitFromType (const SVFType *type)
	Gets the range limit from a type.
AbstractState &	getAbsStateFromTrace (const ICFGNode *node)
	Retrieves the abstract state from the trace for a given ICFG node.

Static Public Member Functions
static bool	isValidLength (const IntervalValue &len)
	Check if an interval length is usable (not bottom, not unbounded).

Protected Attributes
SVFIR *	svfir
	Pointer to the SVF intermediate representation.
ICFG *	icfg
	Pointer to the interprocedural control flow graph.
Map< const ICFGNode *, AbstractState > &	abstractTrace
	Map of ICFG nodes to abstract states.
Map< std::string, std::function< void(const CallICFGNode *)> >	func_map
	Map of function names to handlers.

Detailed Description

Handles external API calls and manages abstract states.

Definition at line 43 of file AbsExtAPI.h.

Member Enumeration Documentation

ExtAPIType

enum SVF::AbsExtAPI::ExtAPIType

Enumeration of external API types.

Enumerator
UNCLASSIFIED
MEMCPY
MEMSET
STRCPY
STRCAT

Definition at line 50 of file AbsExtAPI.h.

{ UNCLASSIFIED, MEMCPY, MEMSET, STRCPY, STRCAT };

Constructor & Destructor Documentation

AbsExtAPI()

AbsExtAPI::AbsExtAPI

(

Map< const ICFGNode *, AbstractState > &

traces

)

Constructor for AbsExtAPI.

Parameters

abstractTrace

Reference to a map of ICFG nodes to abstract states.

Definition at line 35 of file AbsExtAPI.cpp.

                                                               : abstractTrace(traces)
{
    svfir = PAG::getPAG();
    icfg = svfir->getICFG();
    initExtFunMap();
}

Member Function Documentation

getAbsStateFromTrace()

AbstractState & AbsExtAPI::getAbsStateFromTrace

(

const ICFGNode *

node

)

Retrieves the abstract state from the trace for a given ICFG node.

Parameters

node	Pointer to the ICFG node.

Returns

Reference to the abstract state.

Exceptions

Assertion

if no trace exists for the node.

Definition at line 338 of file AbsExtAPI.cpp.

{
    if (abstractTrace.count(node) == 0)
    {
        assert(0 && "No preAbsTrace for this node");
        abort();
    }
    else
    {
        return abstractTrace[node];
    }
}

getElementSize()

u32_t AbsExtAPI::getElementSize	(	AbstractState &	as,
		const SVFVar *	var
	)

Get the byte size of each element for a pointer/array variable.

Get the byte size of each element for a pointer/array variable. Shared by handleMemcpy, handleMemset, and getStrlen to avoid duplication.

Definition at line 463 of file AbsExtAPI.cpp.

{
    if (var->getType()->isArrayTy())
    {
        return SVFUtil::dyn_cast<SVFArrayType>(var->getType())
               ->getTypeOfElement()->getByteSize();
    }
    if (var->getType()->isPointerTy())
    {
        if (const SVFType* elemType = as.getPointeeElement(var->getId()))
        {
            if (elemType->isArrayTy())
                return SVFUtil::dyn_cast<SVFArrayType>(elemType)
                       ->getTypeOfElement()->getByteSize();
            return elemType->getByteSize();
        }
        return 1;
    }
    assert(false && "unsupported type for element size");
    return 1;
}

getRangeLimitFromType()

IntervalValue AbsExtAPI::getRangeLimitFromType

(

const SVFType *

type

)

Gets the range limit from a type.

Parameters

type	Pointer to the SVF type.

Returns

The interval value representing the range limit.

This function, getRangeLimitFromType, calculates the lower and upper bounds of a numeric range for a given SVFType. It is used to determine the possible value range of integer types. If the type is an SVFIntegerType, it calculates the bounds based on the size and signedness of the type. The calculated bounds are returned as an IntervalValue representing the lower (lb) and upper (ub) limits of the range.

Parameters

type	The SVFType for which to calculate the value range.

Returns

An IntervalValue representing the lower and upper bounds of the range.

Definition at line 696 of file AbsExtAPI.cpp.

{
    if (const SVFIntegerType* intType = SVFUtil::dyn_cast<SVFIntegerType>(type))
    {
        u32_t bits = type->getByteSize() * 8;
        s64_t ub = 0;
        s64_t lb = 0;
        if (bits >= 32)
        {
            if (intType->isSigned())
            {
                ub = static_cast<s64_t>(std::numeric_limits<s32_t>::max());
                lb = static_cast<s64_t>(std::numeric_limits<s32_t>::min());
            }
            else
            {
                ub = static_cast<s64_t>(std::numeric_limits<u32_t>::max());
                lb = static_cast<s64_t>(std::numeric_limits<u32_t>::min());
            }
        }
        else if (bits == 16)
        {
            if (intType->isSigned())
            {
                ub = static_cast<s64_t>(std::numeric_limits<s16_t>::max());
                lb = static_cast<s64_t>(std::numeric_limits<s16_t>::min());
            }
            else
            {
                ub = static_cast<s64_t>(std::numeric_limits<u16_t>::max());
                lb = static_cast<s64_t>(std::numeric_limits<u16_t>::min());
            }
        }
        else if (bits == 8)
        {
            if (intType->isSigned())
            {
                ub = static_cast<s64_t>(std::numeric_limits<int8_t>::max());
                lb = static_cast<s64_t>(std::numeric_limits<int8_t>::min());
            }
            else
            {
                ub = static_cast<s64_t>(std::numeric_limits<uint8_t>::max());
                lb = static_cast<s64_t>(std::numeric_limits<uint8_t>::min());
            }
        }
        return IntervalValue(lb, ub);
    }
    else if (SVFUtil::isa<SVFOtherType>(type))
    {
        // handle other type like float double, set s32_t as the range
        s64_t ub = static_cast<s64_t>(std::numeric_limits<s32_t>::max());
        s64_t lb = static_cast<s64_t>(std::numeric_limits<s32_t>::min());
        return IntervalValue(lb, ub);
    }
    else
    {
        return IntervalValue::top();
        // other types, return top interval
    }
}

getStrlen()

IntervalValue AbsExtAPI::getStrlen	(	AbstractState &	as,
		const SVF::SVFVar *	strValue
	)

Calculate the length of a null-terminated string in abstract state.

Calculate the length of a null-terminated string in abstract state. Scans memory from the base of strValue looking for a '\0' byte. Returns an IntervalValue: exact length if '\0' found, otherwise [0, MaxFieldLimit].

Definition at line 496 of file AbsExtAPI.cpp.

{
    NodeID value_id = strValue->getId();
 
    // Step 1: determine the buffer size (in bytes) backing this pointer
    u32_t dst_size = 0;
    for (const auto& addr : as[value_id].getAddrs())
    {
        NodeID objId = as.getIDFromAddr(addr);
        if (svfir->getBaseObject(objId)->isConstantByteSize())
        {
            dst_size = svfir->getBaseObject(objId)->getByteSizeOfObj();
        }
        else
        {
            const ICFGNode* icfgNode = svfir->getBaseObject(objId)->getICFGNode();
            for (const SVFStmt* stmt2: icfgNode->getSVFStmts())
            {
                if (const AddrStmt* addrStmt = SVFUtil::dyn_cast<AddrStmt>(stmt2))
                {
                    dst_size = as.getAllocaInstByteSize(addrStmt);
                }
            }
        }
    }
 
    // Step 2: scan for '\0' terminator
    u32_t len = 0;
    if (as.inVarToAddrsTable(value_id))
    {
        for (u32_t index = 0; index < dst_size; index++)
        {
            AbstractValue expr0 =
                as.getGepObjAddrs(value_id, IntervalValue(index));
            AbstractValue val;
            for (const auto &addr: expr0.getAddrs())
            {
                val.join_with(as.load(addr));
            }
            if (val.getInterval().is_numeral() &&
                    (char) val.getInterval().getIntNumeral() == '\0')
            {
                break;
            }
            ++len;
        }
    }
 
    // Step 3: scale by element size and return
    u32_t elemSize = getElementSize(as, strValue);
    if (len == 0)
        return IntervalValue((s64_t)0, (s64_t)Options::MaxFieldLimit());
    return IntervalValue(len * elemSize);
}

handleExtAPI()

void AbsExtAPI::handleExtAPI

(

const CallICFGNode *

call

)

Handles an external API call.

Parameters

call	Pointer to the call ICFG node.

Definition at line 381 of file AbsExtAPI.cpp.

{
    AbstractState& as = getAbsStateFromTrace(call);
    const FunObjVar *fun = call->getCalledFunction();
    assert(fun && "FunObjVar* is nullptr");
    ExtAPIType extType = UNCLASSIFIED;
    // get type of mem api
    for (const std::string &annotation: ExtAPI::getExtAPI()->getExtFuncAnnotations(fun))
    {
        if (annotation.find("MEMCPY") != std::string::npos)
            extType =  MEMCPY;
        if (annotation.find("MEMSET") != std::string::npos)
            extType =  MEMSET;
        if (annotation.find("STRCPY") != std::string::npos)
            extType = STRCPY;
        if (annotation.find("STRCAT") != std::string::npos)
            extType =  STRCAT;
    }
    if (extType == UNCLASSIFIED)
    {
        if (func_map.find(fun->getName()) != func_map.end())
        {
            func_map[fun->getName()](call);
        }
        else
        {
            if (const SVFVar* ret = call->getRetICFGNode()->getActualRet())
            {
                u32_t lhsId = ret->getId();
                if (as.inVarToAddrsTable(lhsId))
                {
 
                }
                else
                {
                    as[lhsId] = IntervalValue();
                }
            }
            return;
        }
    }
    // 1. memcpy functions like memcpy_chk, strncpy, annotate("MEMCPY"), annotate("BUF_CHECK:Arg0, Arg2"), annotate("BUF_CHECK:Arg1, Arg2")
    else if (extType == MEMCPY)
    {
        IntervalValue len = as[call->getArgument(2)->getId()].getInterval();
        (void)svfir->getSVFVar(call->getArgument(0)->getId());
        handleMemcpy(as, call->getArgument(0), call->getArgument(1), len, 0);
    }
    else if (extType == MEMSET)
    {
        // memset dst is arg0, elem is arg1, size is arg2
        IntervalValue len = as[call->getArgument(2)->getId()].getInterval();
        IntervalValue elem = as[call->getArgument(1)->getId()].getInterval();
        handleMemset(as, call->getArgument(0), elem, len);
    }
    else if (extType == STRCPY)
    {
        handleStrcpy(call);
    }
    else if (extType == STRCAT)
    {
        // Both strcat and strncat are annotated as STRCAT.
        // Distinguish by name: strncat/wcsncat contain "ncat".
        const std::string& name = fun->getName();
        if (name.find("ncat") != std::string::npos)
            handleStrncat(call);
        else
            handleStrcat(call);
    }
    else
    {
 
    }
    return;
}

handleMemcpy()

void AbsExtAPI::handleMemcpy	(	AbstractState &	as,
		const SVF::SVFVar *	dst,
		const SVF::SVFVar *	src,
		IntervalValue	len,
		u32_t	start_idx
	)

Core memcpy: copy len bytes from src to dst starting at dst[start_idx].

Definition at line 595 of file AbsExtAPI.cpp.

{
    if (!isValidLength(len)) return;
 
    u32_t dstId = dst->getId();
    u32_t srcId = src->getId();
    u32_t elemSize = getElementSize(as, dst);
    u32_t size = std::min((u32_t)Options::MaxFieldLimit(),
                          (u32_t)len.lb().getIntNumeral());
    u32_t range_val = size / elemSize;
 
    if (!as.inVarToAddrsTable(srcId) || !as.inVarToAddrsTable(dstId))
        return;
 
    for (u32_t index = 0; index < range_val; index++)
    {
        AbstractValue expr_src =
            as.getGepObjAddrs(srcId, IntervalValue(index));
        AbstractValue expr_dst =
            as.getGepObjAddrs(dstId, IntervalValue(index + start_idx));
        for (const auto &dstAddr: expr_dst.getAddrs())
        {
            for (const auto &srcAddr: expr_src.getAddrs())
            {
                u32_t objId = as.getIDFromAddr(srcAddr);
                if (as.inAddrToValTable(objId) || as.inAddrToAddrsTable(objId))
                {
                    as.store(dstAddr, as.load(srcAddr));
                }
            }
        }
    }
}

handleMemset()

void AbsExtAPI::handleMemset	(	AbstractState &	as,
		const SVFVar *	dst,
		IntervalValue	elem,
		IntervalValue	len
	)

Core memset: fill dst with elem for len bytes. Note: elemSize here uses the pointee type's full size (not array element size) to match how LLVM memset/wmemset intrinsics measure len. For a pointer to wchar_t[100], elemSize = sizeof(wchar_t[100]), so range_val reflects the number of top-level GEP fields, not individual array elements.

Definition at line 636 of file AbsExtAPI.cpp.

{
    if (!isValidLength(len)) return;
 
    u32_t dstId = dst->getId();
    u32_t elemSize = 1;
    if (dst->getType()->isArrayTy())
    {
        elemSize = SVFUtil::dyn_cast<SVFArrayType>(dst->getType())
                   ->getTypeOfElement()->getByteSize();
    }
    else if (dst->getType()->isPointerTy())
    {
        if (const SVFType* elemType = as.getPointeeElement(dstId))
            elemSize = elemType->getByteSize();
        else
            elemSize = 1;
    }
    else
    {
        assert(false && "unsupported type for element size");
    }
    u32_t size = std::min((u32_t)Options::MaxFieldLimit(),
                          (u32_t)len.lb().getIntNumeral());
    u32_t range_val = size / elemSize;
 
    for (u32_t index = 0; index < range_val; index++)
    {
        if (!as.inVarToAddrsTable(dstId))
            break;
        AbstractValue lhs_gep = as.getGepObjAddrs(dstId, IntervalValue(index));
        for (const auto &addr: lhs_gep.getAddrs())
        {
            u32_t objId = as.getIDFromAddr(addr);
            if (as.inAddrToValTable(objId))
            {
                AbstractValue tmp = as.load(addr);
                tmp.join_with(elem);
                as.store(addr, tmp);
            }
            else
            {
                as.store(addr, elem);
            }
        }
    }
}

handleStrcat()

void AbsExtAPI::handleStrcat

(

const CallICFGNode *

call

)

strcat(dst, src): append all of src after the end of dst. Covers: strcat, __strcat_chk, wcscat, __wcscat_chk

Definition at line 570 of file AbsExtAPI.cpp.

{
    AbstractState& as = getAbsStateFromTrace(call);
    const SVFVar* dst = call->getArgument(0);
    const SVFVar* src = call->getArgument(1);
    IntervalValue dstLen = getStrlen(as, dst);
    IntervalValue srcLen = getStrlen(as, src);
    if (!isValidLength(dstLen)) return;
    handleMemcpy(as, dst, src, srcLen, dstLen.lb().getIntNumeral());
}

handleStrcpy()

void AbsExtAPI::handleStrcpy

(

const CallICFGNode *

call

)

strcpy(dst, src): copy all of src (including '\0') into dst. Covers: strcpy, __strcpy_chk, stpcpy, wcscpy, __wcscpy_chk

Definition at line 557 of file AbsExtAPI.cpp.

{
    AbstractState& as = getAbsStateFromTrace(call);
    const SVFVar* dst = call->getArgument(0);
    const SVFVar* src = call->getArgument(1);
    IntervalValue srcLen = getStrlen(as, src);
    // no need to -1, since srcLen includes up to (but not past) '\0'
    if (!isValidLength(srcLen)) return;
    handleMemcpy(as, dst, src, srcLen, 0);
}

handleStrncat()

void AbsExtAPI::handleStrncat

(

const CallICFGNode *

call

)

strncat(dst, src, n): append at most n bytes of src after the end of dst. Covers: strncat, __strncat_chk, wcsncat, __wcsncat_chk

Definition at line 583 of file AbsExtAPI.cpp.

{
    AbstractState& as = getAbsStateFromTrace(call);
    const SVFVar* dst = call->getArgument(0);
    const SVFVar* src = call->getArgument(1);
    IntervalValue n = as[call->getArgument(2)->getId()].getInterval();
    IntervalValue dstLen = getStrlen(as, dst);
    if (!isValidLength(dstLen)) return;
    handleMemcpy(as, dst, src, n, dstLen.lb().getIntNumeral());
}

initExtFunMap()

void AbsExtAPI::initExtFunMap

(

)

Initializes the external function map.

Definition at line 42 of file AbsExtAPI.cpp.

{
#define SSE_FUNC_PROCESS(LLVM_NAME ,FUNC_NAME) \
        auto sse_##FUNC_NAME = [this](const CallICFGNode *callNode) { \
        /* run real ext function */            \
        AbstractState& as = getAbsStateFromTrace(callNode); \
        u32_t rhs_id = callNode->getArgument(0)->getId(); \
        if (!as.inVarToValTable(rhs_id)) return; \
        u32_t rhs = as[rhs_id].getInterval().lb().getIntNumeral(); \
        s32_t res = FUNC_NAME(rhs);            \
        u32_t lhsId = callNode->getRetICFGNode()->getActualRet()->getId();               \
        as[lhsId] = IntervalValue(res);           \
        return; \
    };                                                                         \
    func_map[#FUNC_NAME] = sse_##FUNC_NAME;
 
    SSE_FUNC_PROCESS(isalnum, isalnum);
    SSE_FUNC_PROCESS(isalpha, isalpha);
    SSE_FUNC_PROCESS(isblank, isblank);
    SSE_FUNC_PROCESS(iscntrl, iscntrl);
    SSE_FUNC_PROCESS(isdigit, isdigit);
    SSE_FUNC_PROCESS(isgraph, isgraph);
    SSE_FUNC_PROCESS(isprint, isprint);
    SSE_FUNC_PROCESS(ispunct, ispunct);
    SSE_FUNC_PROCESS(isspace, isspace);
    SSE_FUNC_PROCESS(isupper, isupper);
    SSE_FUNC_PROCESS(isxdigit, isxdigit);
    SSE_FUNC_PROCESS(llvm.sin.f64, sin);
    SSE_FUNC_PROCESS(llvm.cos.f64, cos);
    SSE_FUNC_PROCESS(llvm.tan.f64, tan);
    SSE_FUNC_PROCESS(llvm.log.f64, log);
    SSE_FUNC_PROCESS(sinh, sinh);
    SSE_FUNC_PROCESS(cosh, cosh);
    SSE_FUNC_PROCESS(tanh, tanh);
 
    auto sse_svf_assert = [this](const CallICFGNode* callNode)
    {
        AbstractInterpretation::getAEInstance().checkpoints.erase(callNode);
        u32_t arg0 = callNode->getArgument(0)->getId();
        AbstractState&as = getAbsStateFromTrace(callNode);
        if (as[arg0].getInterval().equals(IntervalValue(1, 1)))
        {
            SVFUtil::errs() << SVFUtil::sucMsg("The assertion is successfully verified!!\n");
        }
        else
        {
            SVFUtil::errs() << SVFUtil::errMsg("Assertion failure, this svf_assert cannot be verified!!\n") << callNode->toString() << "\n";
            assert(false);
        }
        return;
    };
    func_map["svf_assert"] = sse_svf_assert;
 
    auto svf_assert_eq = [this](const CallICFGNode* callNode)
    {
        u32_t arg0 = callNode->getArgument(0)->getId();
        u32_t arg1 = callNode->getArgument(1)->getId();
        AbstractState&as = getAbsStateFromTrace(callNode);
        if (as[arg0].getInterval().equals(as[arg1].getInterval()))
        {
            SVFUtil::errs() << SVFUtil::sucMsg("The assertion is successfully verified!!\n");
        }
        else
        {
            SVFUtil::errs() <<"svf_assert_eq Fail. " << callNode->toString() << "\n";
            assert(false);
        }
        return;
    };
    func_map["svf_assert_eq"] = svf_assert_eq;
 
    auto svf_print = [&](const CallICFGNode* callNode)
    {
        if (callNode->arg_size() < 2) return;
        AbstractState&as = getAbsStateFromTrace(callNode);
        u32_t num_id = callNode->getArgument(0)->getId();
        std::string text = strRead(as, callNode->getArgument(1));
        assert(as.inVarToValTable(num_id) && "print() should pass integer");
        IntervalValue itv = as[num_id].getInterval();
        std::cout << "Text: " << text <<", Value: " << callNode->getArgument(0)->toString()
                  << ", PrintVal: " << itv.toString() << ", Loc:" << callNode->getSourceLoc() << std::endl;
        return;
    };
    func_map["svf_print"] = svf_print;
 
    auto svf_set_value = [&](const CallICFGNode* callNode)
    {
        if (callNode->arg_size() < 2) return;
        AbstractState&as = getAbsStateFromTrace(callNode);
        AbstractValue& num = as[callNode->getArgument(0)->getId()];
        AbstractValue& lb = as[callNode->getArgument(1)->getId()];
        AbstractValue& ub = as[callNode->getArgument(2)->getId()];
        assert(lb.getInterval().is_numeral() && ub.getInterval().is_numeral());
        num.getInterval().set_to_top();
        num.getInterval().meet_with(IntervalValue(lb.getInterval().lb(), ub.getInterval().ub()));
        const ICFGNode* node = SVFUtil::cast<ValVar>(callNode->getArgument(0))->getICFGNode();
        for (const SVFStmt* stmt: node->getSVFStmts())
        {
            if (SVFUtil::isa<LoadStmt>(stmt))
            {
                const LoadStmt* load = SVFUtil::cast<LoadStmt>(stmt);
                NodeID rhsId = load->getRHSVarID();
                as.storeValue(rhsId, num);
            }
        }
        return;
    };
    func_map["set_value"] = svf_set_value;
 
    auto sse_scanf = [&](const CallICFGNode* callNode)
    {
        AbstractState& as = getAbsStateFromTrace(callNode);
        //scanf("%d", &data);
        if (callNode->arg_size() < 2) return;
 
        u32_t dst_id = callNode->getArgument(1)->getId();
        if (!as.inVarToAddrsTable(dst_id))
        {
            return;
        }
        else
        {
            AbstractValue Addrs = as[dst_id];
            for (auto vaddr: Addrs.getAddrs())
            {
                u32_t objId = as.getIDFromAddr(vaddr);
                AbstractValue range = getRangeLimitFromType(svfir->getSVFVar(objId)->getType());
                as.store(vaddr, range);
            }
        }
    };
    auto sse_fscanf = [&](const CallICFGNode* callNode)
    {
        //fscanf(stdin, "%d", &data);
        if (callNode->arg_size() < 3) return;
        AbstractState& as = getAbsStateFromTrace(callNode);
        u32_t dst_id = callNode->getArgument(2)->getId();
        if (!as.inVarToAddrsTable(dst_id))
        {
        }
        else
        {
            AbstractValue Addrs = as[dst_id];
            for (auto vaddr: Addrs.getAddrs())
            {
                u32_t objId = as.getIDFromAddr(vaddr);
                AbstractValue range = getRangeLimitFromType(svfir->getSVFVar(objId)->getType());
                as.store(vaddr, range);
            }
        }
    };
 
    func_map["__isoc99_fscanf"] = sse_fscanf;
    func_map["__isoc99_scanf"] = sse_scanf;
    func_map["__isoc99_vscanf"] = sse_scanf;
    func_map["fscanf"] = sse_fscanf;
    func_map["scanf"] = sse_scanf;
    func_map["sscanf"] = sse_scanf;
    func_map["__isoc99_sscanf"] = sse_scanf;
    func_map["vscanf"] = sse_scanf;
 
    auto sse_fread = [&](const CallICFGNode *callNode)
    {
        if (callNode->arg_size() < 3) return;
        AbstractState&as = getAbsStateFromTrace(callNode);
        u32_t block_count_id = callNode->getArgument(2)->getId();
        u32_t block_size_id = callNode->getArgument(1)->getId();
        IntervalValue block_count = as[block_count_id].getInterval();
        IntervalValue block_size = as[block_size_id].getInterval();
        IntervalValue block_byte = block_count * block_size;
    };
    func_map["fread"] = sse_fread;
 
    auto sse_sprintf = [&](const CallICFGNode *callNode)
    {
        // printf is difficult to predict since it has no byte size arguments
    };
 
    auto sse_snprintf = [&](const CallICFGNode *callNode)
    {
        if (callNode->arg_size() < 2) return;
        AbstractState&as = getAbsStateFromTrace(callNode);
        u32_t size_id = callNode->getArgument(1)->getId();
        u32_t dst_id = callNode->getArgument(0)->getId();
        // get elem size of arg2
        u32_t elemSize = 1;
        if (callNode->getArgument(2)->getType()->isArrayTy())
        {
            elemSize = SVFUtil::dyn_cast<SVFArrayType>(
                           callNode->getArgument(2)->getType())->getTypeOfElement()->getByteSize();
        }
        else if (callNode->getArgument(2)->getType()->isPointerTy())
        {
            elemSize = as.getPointeeElement(callNode->getArgument(2)->getId())->getByteSize();
        }
        else
        {
            return;
            // assert(false && "we cannot support this type");
        }
        IntervalValue size = as[size_id].getInterval() * IntervalValue(elemSize) - IntervalValue(1);
        if (!as.inVarToAddrsTable(dst_id))
        {
        }
    };
    func_map["__snprintf_chk"] = sse_snprintf;
    func_map["__vsprintf_chk"] = sse_sprintf;
    func_map["__sprintf_chk"] = sse_sprintf;
    func_map["snprintf"] = sse_snprintf;
    func_map["sprintf"] = sse_sprintf;
    func_map["vsprintf"] = sse_sprintf;
    func_map["vsnprintf"] = sse_snprintf;
    func_map["__vsnprintf_chk"] = sse_snprintf;
    func_map["swprintf"] = sse_snprintf;
    func_map["_snwprintf"] = sse_snprintf;
 
 
    auto sse_itoa = [&](const CallICFGNode* callNode)
    {
        // itoa(num, ch, 10);
        // num: int, ch: char*, 10 is decimal
        if (callNode->arg_size() < 3) return;
        AbstractState&as = getAbsStateFromTrace(callNode);
        u32_t num_id = callNode->getArgument(0)->getId();
 
        u32_t num = (u32_t) as[num_id].getInterval().getNumeral();
        std::string snum = std::to_string(num);
    };
    func_map["itoa"] = sse_itoa;
 
 
    auto sse_strlen = [&](const CallICFGNode *callNode)
    {
        if (callNode->arg_size() < 1) return;
        AbstractState& as = getAbsStateFromTrace(callNode);
        u32_t lhsId = callNode->getRetICFGNode()->getActualRet()->getId();
        // strlen/wcslen return the number of characters (not bytes).
        // getStrlen returns byte-scaled length (len * elemSize) for use
        // by memcpy/strcpy. Here we need the raw character count, so
        // divide back by elemSize.
        IntervalValue byteLen = getStrlen(as, callNode->getArgument(0));
        u32_t elemSize = getElementSize(as, callNode->getArgument(0));
        if (byteLen.is_numeral() && elemSize > 1)
            as[lhsId] = IntervalValue(byteLen.getIntNumeral() / (s64_t)elemSize);
        else
            as[lhsId] = byteLen;
    };
    func_map["strlen"] = sse_strlen;
    func_map["wcslen"] = sse_strlen;
 
    auto sse_recv = [&](const CallICFGNode *callNode)
    {
        // recv(sockfd, buf, len, flags);
        if (callNode->arg_size() < 4) return;
        AbstractState&as = getAbsStateFromTrace(callNode);
        u32_t len_id = callNode->getArgument(2)->getId();
        IntervalValue len = as[len_id].getInterval() - IntervalValue(1);
        u32_t lhsId = callNode->getRetICFGNode()->getActualRet()->getId();
        as[lhsId] = len;
    };
    func_map["recv"] = sse_recv;
    func_map["__recv"] = sse_recv;
 
    auto sse_free = [&](const CallICFGNode *callNode)
    {
        if (callNode->arg_size() < 1) return;
        AbstractState& as = getAbsStateFromTrace(callNode);
        const u32_t freePtr = callNode->getArgument(0)->getId();
        for (auto addr: as[freePtr].getAddrs())
        {
            if (AbstractState::isBlackHoleObjAddr(addr))
            {
                // Detected a double free — the address has already been freed.
                // No action is taken at this point.
            }
            else
            {
                as.addToFreedAddrs(addr);
            }
        }
    };
    // Add all free-related functions to func_map
    std::vector<std::string> freeFunctions =
    {
        "VOS_MemFree", "cfree", "free", "free_all_mem", "freeaddrinfo",
        "gcry_mpi_release", "gcry_sexp_release", "globfree", "nhfree",
        "obstack_free", "safe_cfree", "safe_free", "safefree", "safexfree",
        "sm_free", "vim_free", "xfree", "SSL_CTX_free", "SSL_free", "XFree"
    };
 
    for (const auto& name : freeFunctions)
    {
        func_map[name] = sse_free;
    }
};

isValidLength()

bool AbsExtAPI::isValidLength ( const IntervalValue &  len )

static

Check if an interval length is usable (not bottom, not unbounded).

Check if an interval length is usable for memory operations. Returns false for bottom (no information) or unbounded lower bound (cannot determine a concrete start for iteration).

Definition at line 488 of file AbsExtAPI.cpp.

{
    return !len.isBottom() && !len.lb().is_minus_infinity();
}

strRead()

std::string AbsExtAPI::strRead	(	AbstractState &	as,
		const SVFVar *	rhs
	)

Reads a string from the abstract state.

Parameters

as	Reference to the abstract state.
rhs	Pointer to the SVF variable representing the string.

Returns

The string value.

Definition at line 351 of file AbsExtAPI.cpp.

{
    // sse read string nodeID->string
    std::string str0;
 
    for (u32_t index = 0; index < Options::MaxFieldLimit(); index++)
    {
        // dead loop for string and break if there's a \0. If no \0, it will throw err.
        if (!as.inVarToAddrsTable(rhs->getId())) continue;
        AbstractValue expr0 =
            as.getGepObjAddrs(rhs->getId(), IntervalValue(index));
 
        AbstractValue val;
        for (const auto &addr: expr0.getAddrs())
        {
            val.join_with(as.load(addr));
        }
        if (!val.getInterval().is_numeral())
        {
            break;
        }
        if ((char) val.getInterval().getIntNumeral() == '\0')
        {
            break;
        }
        str0.push_back((char) val.getInterval().getIntNumeral());
    }
    return str0;
}

Member Data Documentation

abstractTrace

Map<const ICFGNode*, AbstractState>& SVF::AbsExtAPI::abstractTrace

protected

Map of ICFG nodes to abstract states.

Definition at line 114 of file AbsExtAPI.h.

func_map

Map<std::string, std::function<void(const CallICFGNode*)> > SVF::AbsExtAPI::func_map

protected

Map of function names to handlers.

Definition at line 115 of file AbsExtAPI.h.

icfg

ICFG* SVF::AbsExtAPI::icfg

protected

Pointer to the interprocedural control flow graph.

Definition at line 113 of file AbsExtAPI.h.

svfir

SVFIR* SVF::AbsExtAPI::svfir

protected

Pointer to the SVF intermediate representation.

Definition at line 112 of file AbsExtAPI.h.

---

The documentation for this class was generated from the following files:

• /home/runner/work/SVF/SVF/svf/include/AE/Svfexe/AbsExtAPI.h
• /home/runner/work/SVF/SVF/svf/lib/AE/Svfexe/AbsExtAPI.cpp