SVF::AbsExtAPI Class Reference

Handles external API calls and manages abstract states. More...

#include <AbsExtAPI.h>

Public Types
enum	ExtAPIType {   UNCLASSIFIED , MEMCPY , MEMSET , STRCPY ,   STRCAT }
	Enumeration of external API types. More...

Public Member Functions
void	initExtFunMap ()
	Initializes the external function map.
std::string	strRead (const ValVar *rhs, const ICFGNode *node)
	Reads a string from the abstract state.
void	handleExtAPI (const CallICFGNode *call)
	Handles an external API call.
u32_t	getElementSize (const ValVar *var)
	Get the byte size of each element for a pointer/array variable.
IntervalValue	getStrlen (const ValVar *strValue, const ICFGNode *node)
	Calculate the length of a null-terminated string in abstract state.
void	handleStrcpy (const CallICFGNode *call)
void	handleStrcat (const CallICFGNode *call)
void	handleStrncat (const CallICFGNode *call)
void	handleMemcpy (const ValVar *dst, const ValVar *src, const IntervalValue &len, u32_t start_idx, const ICFGNode *node)
	Core memcpy: copy len bytes from src to dst starting at dst[start_idx].
void	handleMemset (const ValVar *dst, const IntervalValue &elem, const IntervalValue &len, const ICFGNode *node)
IntervalValue	getRangeLimitFromType (const SVFType *type)
	Gets the range limit from a type.
AbstractState &	getAbsState (const ICFGNode *node)
	Retrieves the abstract state from the trace for a given ICFG node.
void	collectCheckPoint ()
void	checkPointAllSet ()

Static Public Member Functions
static bool	isValidLength (const IntervalValue &len)
	Check if an interval length is usable (not bottom, not unbounded).
static u32_t	getBoundedMinimumByteCount (const IntervalValue &len)
	Return the lower bound of len, capped by the field limit.

Public Attributes
Set< const CallICFGNode * >	checkpoints

Protected Attributes
AbstractInterpretation *	ae
	Owning AbstractInterpretation; provides state access.
SVFIR *	svfir
	Pointer to the SVF intermediate representation.
ICFG *	icfg
	Pointer to the interprocedural control flow graph.
Map< std::string, std::function< void(const CallICFGNode *)> >	func_map
	Map of function names to handlers.

Private Member Functions
	AbsExtAPI (AbstractInterpretation *ae)
	Constructor for AbsExtAPI.

Friends
class	AbstractInterpretation

Detailed Description

Handles external API calls and manages abstract states.

Definition at line 48 of file AbsExtAPI.h.

Member Enumeration Documentation

ExtAPIType

enum SVF::AbsExtAPI::ExtAPIType

Enumeration of external API types.

Enumerator
UNCLASSIFIED
MEMCPY
MEMSET
STRCPY
STRCAT

Definition at line 55 of file AbsExtAPI.h.

{ UNCLASSIFIED, MEMCPY, MEMSET, STRCPY, STRCAT };

Constructor & Destructor Documentation

AbsExtAPI()

AbsExtAPI::AbsExtAPI ( AbstractInterpretation *  ae )

private

Constructor for AbsExtAPI.

Parameters

ae	Reference to the AbstractInterpretation instance.

Definition at line 35 of file AbsExtAPI.cpp.

                                              : ae(ae)
{
    svfir = PAG::getPAG();
    icfg = svfir->getICFG();
    initExtFunMap();
}

Member Function Documentation

checkPointAllSet()

void AbsExtAPI::checkPointAllSet

(

)

Definition at line 298 of file AbsExtAPI.cpp.

{
    if (!checkpoints.empty())
    {
        SVFUtil::errs() << SVFUtil::errMsg("At least one svf_assert has not been checked!!") << "\n";
        for (const CallICFGNode* call: checkpoints)
            SVFUtil::errs() << call->toString() + "\n";
        assert(false);
    }
}

collectCheckPoint()

void AbsExtAPI::collectCheckPoint

(

)

Definition at line 258 of file AbsExtAPI.cpp.

{
    // traverse every ICFGNode
    Set<std::string> ae_checkpoint_names = {"svf_assert"};
    Set<std::string> buf_checkpoint_names = {"UNSAFE_BUFACCESS", "SAFE_BUFACCESS"};
    Set<std::string> nullptr_checkpoint_names = {"UNSAFE_LOAD", "SAFE_LOAD"};
 
    for (auto it = svfir->getICFG()->begin(); it != svfir->getICFG()->end(); ++it)
    {
        const ICFGNode* node = it->second;
        if (const CallICFGNode *call = SVFUtil::dyn_cast<CallICFGNode>(node))
        {
            if (const FunObjVar *fun = call->getCalledFunction())
            {
                if (ae_checkpoint_names.find(fun->getName()) !=
                        ae_checkpoint_names.end())
                {
                    checkpoints.insert(call);
                }
                if (Options::BufferOverflowCheck())
                {
                    if (buf_checkpoint_names.find(fun->getName()) !=
                            buf_checkpoint_names.end())
                    {
                        checkpoints.insert(call);
                    }
                }
                if (Options::NullDerefCheck())
                {
                    if (nullptr_checkpoint_names.find(fun->getName()) !=
                            nullptr_checkpoint_names.end())
                    {
                        checkpoints.insert(call);
                    }
                }
            }
        }
    }
}

getAbsState()

AbstractState & AbsExtAPI::getAbsState

(

const ICFGNode *

node

)

Retrieves the abstract state from the trace for a given ICFG node.

Parameters

node	Pointer to the ICFG node.

Returns

Reference to the abstract state.

Exceptions

Assertion

if no trace exists for the node.

Definition at line 253 of file AbsExtAPI.cpp.

{
    return ae->getAbsState(node);
}

getBoundedMinimumByteCount()

u32_t AbsExtAPI::getBoundedMinimumByteCount ( const IntervalValue &  len )

static

Return the lower bound of len, capped by the field limit.

Definition at line 429 of file AbsExtAPI.cpp.

{
    u32_t byteCount = 0;
    if (isValidLength(len) && len.lb().getIntNumeral() > 0)
    {
        byteCount = std::min(Options::MaxFieldLimit(),
                             (u32_t)len.lb().getIntNumeral());
    }
    return byteCount;
}

getElementSize()

u32_t AbsExtAPI::getElementSize

(

const ValVar *

var

)

Get the byte size of each element for a pointer/array variable.

Get the byte size of each element for a pointer/array variable. Shared by handleMemcpy, handleMemset, and getStrlen to avoid duplication.

Definition at line 408 of file AbsExtAPI.cpp.

{
    if (var->getType()->isArrayTy())
    {
        return SVFUtil::dyn_cast<SVFArrayType>(var->getType())
               ->getTypeOfElement()->getByteSize();
    }
    if (var->getType()->isPointerTy())
        return 1;
    assert(false && "unsupported type for element size");
    return 1;
}

getRangeLimitFromType()

IntervalValue AbsExtAPI::getRangeLimitFromType

(

const SVFType *

type

)

Gets the range limit from a type.

Parameters

type	Pointer to the SVF type.

Returns

The interval value representing the range limit.

This function, getRangeLimitFromType, calculates the lower and upper bounds of a numeric range for a given SVFType. It is used to determine the possible value range of integer types. If the type is an SVFIntegerType, it calculates the bounds based on the size and signedness of the type. The calculated bounds are returned as an IntervalValue representing the lower (lb) and upper (ub) limits of the range.

Parameters

type	The SVFType for which to calculate the value range.

Returns

An IntervalValue representing the lower and upper bounds of the range.

Definition at line 626 of file AbsExtAPI.cpp.

{
    if (const SVFIntegerType* intType = SVFUtil::dyn_cast<SVFIntegerType>(type))
    {
        u32_t bits = type->getByteSize() * 8;
        s64_t ub = 0;
        s64_t lb = 0;
        if (bits >= 32)
        {
            if (intType->isSigned())
            {
                ub = static_cast<s64_t>(std::numeric_limits<s32_t>::max());
                lb = static_cast<s64_t>(std::numeric_limits<s32_t>::min());
            }
            else
            {
                ub = static_cast<s64_t>(std::numeric_limits<u32_t>::max());
                lb = static_cast<s64_t>(std::numeric_limits<u32_t>::min());
            }
        }
        else if (bits == 16)
        {
            if (intType->isSigned())
            {
                ub = static_cast<s64_t>(std::numeric_limits<s16_t>::max());
                lb = static_cast<s64_t>(std::numeric_limits<s16_t>::min());
            }
            else
            {
                ub = static_cast<s64_t>(std::numeric_limits<u16_t>::max());
                lb = static_cast<s64_t>(std::numeric_limits<u16_t>::min());
            }
        }
        else if (bits == 8)
        {
            if (intType->isSigned())
            {
                ub = static_cast<s64_t>(std::numeric_limits<int8_t>::max());
                lb = static_cast<s64_t>(std::numeric_limits<int8_t>::min());
            }
            else
            {
                ub = static_cast<s64_t>(std::numeric_limits<uint8_t>::max());
                lb = static_cast<s64_t>(std::numeric_limits<uint8_t>::min());
            }
        }
        return IntervalValue(lb, ub);
    }
    else if (SVFUtil::isa<SVFOtherType>(type))
    {
        // handle other type like float double, set s32_t as the range
        s64_t ub = static_cast<s64_t>(std::numeric_limits<s32_t>::max());
        s64_t lb = static_cast<s64_t>(std::numeric_limits<s32_t>::min());
        return IntervalValue(lb, ub);
    }
    else
    {
        return IntervalValue::top();
        // other types, return top interval
    }
}

getStrlen()

IntervalValue AbsExtAPI::getStrlen	(	const ValVar *	strValue,
		const ICFGNode *	node
	)

Calculate the length of a null-terminated string in abstract state.

Calculate the length of a null-terminated string in abstract state. Scans memory from the base of strValue looking for a '\0' byte. Returns an IntervalValue: exact length if '\0' found, otherwise [0, MaxFieldLimit].

Definition at line 443 of file AbsExtAPI.cpp.

{
    AbstractState& as = getAbsState(node);
    // Step 1: determine the buffer size (in bytes) backing this pointer
    u32_t dst_size = 0;
    const AbstractValue& ptrVal = ae->getAbsValue(strValue, node);
    for (const auto& addr : ptrVal.getAddrs())
    {
        // Unknown and null pointers have no concrete backing buffer to inspect.
        if (AbstractState::isNullOrBlackHoleAddr(addr))
            continue;
        NodeID objId = as.getIDFromAddr(addr);
        if (svfir->getBaseObject(objId)->isConstantByteSize())
        {
            dst_size = svfir->getBaseObject(objId)->getByteSizeOfObj();
        }
        else
        {
            const ICFGNode* icfgNode = svfir->getBaseObject(objId)->getICFGNode();
            for (const SVFStmt* stmt2: icfgNode->getSVFStmts())
            {
                if (const AddrStmt* addrStmt = SVFUtil::dyn_cast<AddrStmt>(stmt2))
                {
                    dst_size = ae->getAllocaInstByteSize(addrStmt).upperBound;
                }
            }
        }
    }
 
    // Step 2: scan for '\0' terminator
    u32_t len = 0;
    for (u32_t index = 0; index < dst_size; index++)
    {
        AbstractValue expr0 =
            ae->getGepObjAddrs(strValue, IntervalValue(index));
        AbstractValue val;
        for (const auto &addr: expr0.getAddrs())
        {
            val.join_with(as.load(addr));
        }
        if (val.getInterval().is_numeral() &&
                (char) val.getInterval().getIntNumeral() == '\0')
        {
            break;
        }
        ++len;
    }
 
    // Step 3: scale by element size and return
    u32_t elemSize = getElementSize(strValue);
    if (len == 0)
        return IntervalValue((s64_t)0, (s64_t)Options::MaxFieldLimit());
    return IntervalValue(len * elemSize);
}

handleExtAPI()

void AbsExtAPI::handleExtAPI

(

const CallICFGNode *

call

)

Handles an external API call.

Parameters

call	Pointer to the call ICFG node.

Definition at line 337 of file AbsExtAPI.cpp.

{
    const FunObjVar *fun = call->getCalledFunction();
    assert(fun && "FunObjVar* is nullptr");
    ExtAPIType extType = UNCLASSIFIED;
    // get type of mem api
    for (const std::string &annotation: ExtAPI::getExtAPI()->getExtFuncAnnotations(fun))
    {
        if (annotation.find("MEMCPY") != std::string::npos)
            extType =  MEMCPY;
        if (annotation.find("MEMSET") != std::string::npos)
            extType =  MEMSET;
        if (annotation.find("STRCPY") != std::string::npos)
            extType = STRCPY;
        if (annotation.find("STRCAT") != std::string::npos)
            extType =  STRCAT;
    }
    if (extType == UNCLASSIFIED)
    {
        if (func_map.find(fun->getName()) != func_map.end())
        {
            func_map[fun->getName()](call);
        }
        else
        {
            const SVFVar* ret = call->getRetICFGNode()->getActualRet();
            if (ret && !ret->getType()->isPointerTy())
            {
                ae->updateAbsValue(ret, IntervalValue(), call);
            }
        }
    }
    // 1. memcpy functions like memcpy_chk, strncpy, annotate("MEMCPY"), annotate("BUF_CHECK:Arg0, Arg2"), annotate("BUF_CHECK:Arg1, Arg2")
    else if (extType == MEMCPY)
    {
        IntervalValue len = ae->getAbsValue(call->getArgument(2), call).getInterval();
        handleMemcpy(call->getArgument(0), call->getArgument(1), len, 0, call);
    }
    else if (extType == MEMSET)
    {
        IntervalValue len = ae->getAbsValue(call->getArgument(2), call).getInterval();
        IntervalValue elem = ae->getAbsValue(call->getArgument(1), call).getInterval();
        handleMemset(call->getArgument(0), elem, len, call);
    }
    else if (extType == STRCPY)
    {
        handleStrcpy(call);
    }
    else if (extType == STRCAT)
    {
        // Both strcat and strncat are annotated as STRCAT.
        // Distinguish by name: strncat/wcsncat contain "ncat".
        const std::string& name = fun->getName();
        if (name.find("ncat") != std::string::npos)
            handleStrncat(call);
        else
            handleStrcat(call);
    }
    else
    {
 
    }
    return;
}

handleMemcpy()

void AbsExtAPI::handleMemcpy	(	const ValVar *	dst,
		const ValVar *	src,
		const IntervalValue &	len,
		u32_t	start_idx,
		const ICFGNode *	node
	)

Core memcpy: copy len bytes from src to dst starting at dst[start_idx].

Definition at line 538 of file AbsExtAPI.cpp.

{
    AbstractState& as = getAbsState(node);
 
    u32_t elemSize = getElementSize(dst);
    u32_t size = getBoundedMinimumByteCount(len);
    u32_t range_val = size / elemSize;
 
    for (u32_t index = 0; index < range_val; index++)
    {
        AbstractValue expr_src =
            ae->getGepObjAddrs(src, IntervalValue(index));
        AbstractValue expr_dst =
            ae->getGepObjAddrs(dst, IntervalValue(index + start_idx));
        for (const auto &dstAddr: expr_dst.getAddrs())
        {
            for (const auto &srcAddr: expr_src.getAddrs())
            {
                u32_t objId = as.getIDFromAddr(srcAddr);
                if (as.inAddrToValTable(objId) || as.inAddrToAddrsTable(objId))
                {
                    as.store(dstAddr, as.load(srcAddr));
                }
            }
        }
    }
}

handleMemset()

void AbsExtAPI::handleMemset	(	const ValVar *	dst,
		const IntervalValue &	elem,
		const IntervalValue &	len,
		const ICFGNode *	node
	)

Core memset: fill dst with elem for len bytes. Note: elemSize here uses the pointee type's full size (not array element size) to match how LLVM memset/wmemset intrinsics measure len. For a pointer to wchar_t[100], elemSize = sizeof(wchar_t[100]), so range_val reflects the number of top-level GEP fields, not individual array elements.

Definition at line 573 of file AbsExtAPI.cpp.

{
    AbstractState& as = getAbsState(node);
 
    u32_t elemSize = 1;
    if (dst->getType()->isArrayTy())
    {
        elemSize = SVFUtil::dyn_cast<SVFArrayType>(dst->getType())
                   ->getTypeOfElement()->getByteSize();
    }
    else if (dst->getType()->isPointerTy())
    {
        elemSize = 1;
    }
    else
    {
        assert(false && "unsupported type for element size");
    }
    u32_t size = getBoundedMinimumByteCount(len);
    u32_t range_val = size / elemSize;
 
    for (u32_t index = 0; index < range_val; index++)
    {
        AbstractValue lhs_gep = ae->getGepObjAddrs(dst, IntervalValue(index));
        for (const auto &addr: lhs_gep.getAddrs())
        {
            u32_t objId = as.getIDFromAddr(addr);
            if (as.inAddrToValTable(objId))
            {
                AbstractValue tmp = as.load(addr);
                tmp.join_with(elem);
                as.store(addr, tmp);
            }
            else
            {
                as.store(addr, elem);
            }
        }
    }
}

handleStrcat()

void AbsExtAPI::handleStrcat

(

const CallICFGNode *

call

)

strcat(dst, src): append all of src after the end of dst. Covers: strcat, __strcat_chk, wcscat, __wcscat_chk

Definition at line 515 of file AbsExtAPI.cpp.

{
    const ValVar* dst = call->getArgument(0);
    const ValVar* src = call->getArgument(1);
    IntervalValue dstLen = getStrlen(dst, call);
    IntervalValue srcLen = getStrlen(src, call);
    assert(isValidLength(dstLen) && "getStrlen must return a bounded length");
    handleMemcpy(dst, src, srcLen, dstLen.lb().getIntNumeral(), call);
}

handleStrcpy()

void AbsExtAPI::handleStrcpy

(

const CallICFGNode *

call

)

strcpy(dst, src): copy all of src (including '\0') into dst. Covers: strcpy, __strcpy_chk, stpcpy, wcscpy, __wcscpy_chk

Definition at line 504 of file AbsExtAPI.cpp.

{
    const ValVar* dst = call->getArgument(0);
    const ValVar* src = call->getArgument(1);
    IntervalValue srcLen = getStrlen(src, call);
    assert(isValidLength(srcLen) && "getStrlen must return a bounded length");
    handleMemcpy(dst, src, srcLen, 0, call);
}

handleStrncat()

void AbsExtAPI::handleStrncat

(

const CallICFGNode *

call

)

strncat(dst, src, n): append at most n bytes of src after the end of dst. Covers: strncat, __strncat_chk, wcsncat, __wcsncat_chk

Definition at line 527 of file AbsExtAPI.cpp.

{
    const ValVar* dst = call->getArgument(0);
    const ValVar* src = call->getArgument(1);
    IntervalValue n = ae->getAbsValue(call->getArgument(2), call).getInterval();
    IntervalValue dstLen = getStrlen(dst, call);
    assert(isValidLength(dstLen) && "getStrlen must return a bounded length");
    handleMemcpy(dst, src, n, dstLen.lb().getIntNumeral(), call);
}

initExtFunMap()

void AbsExtAPI::initExtFunMap

(

)

Initializes the external function map.

Definition at line 42 of file AbsExtAPI.cpp.

{
#define SSE_FUNC_PROCESS(LLVM_NAME ,FUNC_NAME) \
        auto sse_##FUNC_NAME = [this](const CallICFGNode *callNode) { \
        /* run real ext function */            \
        assert(callNode->arg_size() >= 1 && "external function expects one argument"); \
        const SVFVar* argVar = callNode->getArgument(0); \
        const AbstractValue& argVal = ae->getAbsValue(argVar, callNode); \
        IntervalValue result = IntervalValue::top(); \
        if (argVal.isInterval() && argVal.getInterval().is_numeral()) { \
            u32_t rhs = argVal.getInterval().lb().getIntNumeral(); \
            result = IntervalValue(FUNC_NAME(rhs)); \
        }                                      \
        const SVFVar* retVar = callNode->getRetICFGNode()->getActualRet(); \
        ae->updateAbsValue(retVar, result, callNode); \
    };                                                                         \
    func_map[#FUNC_NAME] = sse_##FUNC_NAME;
 
    SSE_FUNC_PROCESS(isalnum, isalnum);
    SSE_FUNC_PROCESS(isalpha, isalpha);
    SSE_FUNC_PROCESS(isblank, isblank);
    SSE_FUNC_PROCESS(iscntrl, iscntrl);
    SSE_FUNC_PROCESS(isdigit, isdigit);
    SSE_FUNC_PROCESS(isgraph, isgraph);
    SSE_FUNC_PROCESS(isprint, isprint);
    SSE_FUNC_PROCESS(ispunct, ispunct);
    SSE_FUNC_PROCESS(isspace, isspace);
    SSE_FUNC_PROCESS(isupper, isupper);
    SSE_FUNC_PROCESS(isxdigit, isxdigit);
    SSE_FUNC_PROCESS(llvm.sin.f64, sin);
    SSE_FUNC_PROCESS(llvm.cos.f64, cos);
    SSE_FUNC_PROCESS(llvm.tan.f64, tan);
    SSE_FUNC_PROCESS(llvm.log.f64, log);
    SSE_FUNC_PROCESS(sinh, sinh);
    SSE_FUNC_PROCESS(cosh, cosh);
    SSE_FUNC_PROCESS(tanh, tanh);
 
    auto sse_svf_assert = [this](const CallICFGNode* callNode)
    {
        checkpoints.erase(callNode);
        const AbstractValue& arg0Val = ae->getAbsValue(callNode->getArgument(0), callNode);
        if (arg0Val.getInterval().equals(IntervalValue(1, 1)))
        {
            SVFUtil::errs() << SVFUtil::sucMsg("The assertion is successfully verified!!\n");
        }
        else
        {
            SVFUtil::errs() << SVFUtil::errMsg("Assertion failure, this svf_assert cannot be verified!!\n") << callNode->toString() << "\n";
            assert(false);
        }
        return;
    };
    func_map["svf_assert"] = sse_svf_assert;
 
    auto svf_assert_eq = [this](const CallICFGNode* callNode)
    {
        const AbstractValue& arg0Val = ae->getAbsValue(callNode->getArgument(0), callNode);
        const AbstractValue& arg1Val = ae->getAbsValue(callNode->getArgument(1), callNode);
        if (arg0Val.getInterval().equals(arg1Val.getInterval()))
        {
            SVFUtil::errs() << SVFUtil::sucMsg("The assertion is successfully verified!!\n");
        }
        else
        {
            SVFUtil::errs() <<"svf_assert_eq Fail. " << callNode->toString() << "\n";
            assert(false);
        }
        return;
    };
    func_map["svf_assert_eq"] = svf_assert_eq;
 
    auto svf_print = [&](const CallICFGNode* callNode)
    {
        assert(callNode->arg_size() >= 2 && "svf_print expects two arguments");
        std::string text = strRead(callNode->getArgument(1), callNode);
        IntervalValue itv = ae->getAbsValue(callNode->getArgument(0), callNode).getInterval();
        std::cout << "Text: " << text <<", Value: " << callNode->getArgument(0)->toString()
                  << ", PrintVal: " << itv.toString() << ", Loc:" << callNode->getSourceLoc() << std::endl;
        return;
    };
    func_map["svf_print"] = svf_print;
 
    auto svf_set_value = [&](const CallICFGNode* callNode)
    {
        assert(callNode->arg_size() >= 3 && "set_value expects three arguments");
        AbstractState&as = getAbsState(callNode);
        const AbstractValue& lbVal = ae->getAbsValue(callNode->getArgument(1), callNode);
        const AbstractValue& ubVal = ae->getAbsValue(callNode->getArgument(2), callNode);
        assert(lbVal.getInterval().is_numeral() && ubVal.getInterval().is_numeral());
        AbstractValue num;
        num.getInterval().set_to_top();
        num.getInterval().meet_with(IntervalValue(lbVal.getInterval().lb(), ubVal.getInterval().ub()));
        ae->updateAbsValue(callNode->getArgument(0), num, callNode);
        const ICFGNode* node = SVFUtil::cast<ValVar>(callNode->getArgument(0))->getICFGNode();
        for (const SVFStmt* stmt: node->getSVFStmts())
        {
            if (SVFUtil::isa<LoadStmt>(stmt))
            {
                const LoadStmt* load = SVFUtil::cast<LoadStmt>(stmt);
                const AbstractValue& ptrVal = ae->getAbsValue(load->getRHSVar(), callNode);
                for (auto addr : ptrVal.getAddrs())
                    as.store(addr, num);
            }
        }
        return;
    };
    func_map["set_value"] = svf_set_value;
 
    auto sse_fread = [&](const CallICFGNode *callNode)
    {
        assert(callNode->arg_size() >= 3 && "fread expects at least three arguments");
        IntervalValue block_count = ae->getAbsValue(callNode->getArgument(2), callNode).getInterval();
        IntervalValue block_size = ae->getAbsValue(callNode->getArgument(1), callNode).getInterval();
        IntervalValue block_byte = block_count * block_size;
        (void)block_byte;
    };
    func_map["fread"] = sse_fread;
 
    auto sse_sprintf = [&](const CallICFGNode *callNode)
    {
        // printf is difficult to predict since it has no byte size arguments
    };
 
    auto sse_snprintf = [&](const CallICFGNode *callNode)
    {
        assert(callNode->arg_size() >= 2 &&
               "formatted-output function expects at least two arguments");
        u32_t elemSize = 1;
        if (callNode->arg_size() > 2 &&
                callNode->getArgument(2)->getType()->isArrayTy())
        {
            elemSize = SVFUtil::cast<SVFArrayType>(
                           callNode->getArgument(2)->getType())
                       ->getTypeOfElement()->getByteSize();
        }
        IntervalValue size = ae->getAbsValue(callNode->getArgument(1), callNode).getInterval()
                             * IntervalValue(elemSize) - IntervalValue(1);
        (void)size;
    };
    func_map["__snprintf_chk"] = sse_snprintf;
    func_map["__vsprintf_chk"] = sse_sprintf;
    func_map["__sprintf_chk"] = sse_sprintf;
    func_map["snprintf"] = sse_snprintf;
    func_map["sprintf"] = sse_sprintf;
    func_map["vsprintf"] = sse_sprintf;
    func_map["vsnprintf"] = sse_snprintf;
    func_map["__vsnprintf_chk"] = sse_snprintf;
    func_map["swprintf"] = sse_snprintf;
    func_map["_snwprintf"] = sse_snprintf;
 
 
    auto sse_itoa = [&](const CallICFGNode* callNode)
    {
        assert(callNode->arg_size() >= 3 && "itoa expects three arguments");
        u32_t num = (u32_t) ae->getAbsValue(callNode->getArgument(0), callNode).getInterval().getNumeral();
        std::string snum = std::to_string(num);
        (void)snum;
    };
    func_map["itoa"] = sse_itoa;
 
 
    auto sse_strlen = [&](const CallICFGNode *callNode)
    {
        assert(callNode->arg_size() >= 1 && "strlen expects one argument");
        const SVFVar* retVar = callNode->getRetICFGNode()->getActualRet();
        IntervalValue byteLen = getStrlen(callNode->getArgument(0), callNode);
        u32_t elemSize = getElementSize(callNode->getArgument(0));
        if (byteLen.is_numeral() && elemSize > 1)
            ae->updateAbsValue(retVar, IntervalValue(byteLen.getIntNumeral() / (s64_t)elemSize), callNode);
        else
            ae->updateAbsValue(retVar, byteLen, callNode);
    };
    func_map["strlen"] = sse_strlen;
    func_map["wcslen"] = sse_strlen;
 
    auto sse_recv = [&](const CallICFGNode *callNode)
    {
        assert(callNode->arg_size() >= 4 && "recv expects four arguments");
        IntervalValue len = ae->getAbsValue(callNode->getArgument(2), callNode).getInterval() - IntervalValue(1);
        const SVFVar* retVar = callNode->getRetICFGNode()->getActualRet();
        ae->updateAbsValue(retVar, len, callNode);
    };
    func_map["recv"] = sse_recv;
    func_map["__recv"] = sse_recv;
 
    auto sse_free = [&](const CallICFGNode *callNode)
    {
        assert(callNode->arg_size() >= 1 && "free expects one argument");
        AbstractState& as = getAbsState(callNode);
        const AbstractValue& ptrVal = ae->getAbsValue(callNode->getArgument(0), callNode);
        for (auto addr: ptrVal.getAddrs())
        {
            if (!AbstractState::isNullOrBlackHoleAddr(addr))
                as.addToFreedAddrs(addr);
        }
    };
    // Add all free-related functions to func_map
    std::vector<std::string> freeFunctions =
    {
        "VOS_MemFree", "cfree", "free", "free_all_mem", "freeaddrinfo",
        "gcry_mpi_release", "gcry_sexp_release", "globfree", "nhfree",
        "obstack_free", "safe_cfree", "safe_free", "safefree", "safexfree",
        "sm_free", "vim_free", "xfree", "SSL_CTX_free", "SSL_free", "XFree"
    };
 
    for (const auto& name : freeFunctions)
    {
        func_map[name] = sse_free;
    }
};

isValidLength()

bool AbsExtAPI::isValidLength ( const IntervalValue &  len )

static

Check if an interval length is usable (not bottom, not unbounded).

Check if an interval length is usable for memory operations. Returns false for bottom (no information) or unbounded lower bound (cannot determine a concrete start for iteration).

Definition at line 424 of file AbsExtAPI.cpp.

{
    return !len.isBottom() && !len.lb().is_minus_infinity();
}

strRead()

std::string AbsExtAPI::strRead	(	const ValVar *	rhs,
		const ICFGNode *	node
	)

Reads a string from the abstract state.

Parameters

as	Reference to the abstract state.
rhs	Pointer to the SVF variable representing the string.

Returns

The string value.

Definition at line 309 of file AbsExtAPI.cpp.

{
    AbstractState& as = getAbsState(node);
    std::string str0;
 
    for (u32_t index = 0; index < Options::MaxFieldLimit(); index++)
    {
        AbstractValue expr0 =
            ae->getGepObjAddrs(rhs, IntervalValue(index));
 
        AbstractValue val;
        for (const auto &addr: expr0.getAddrs())
        {
            val.join_with(as.load(addr));
        }
        if (!val.getInterval().is_numeral())
        {
            break;
        }
        if ((char) val.getInterval().getIntNumeral() == '\0')
        {
            break;
        }
        str0.push_back((char) val.getInterval().getIntNumeral());
    }
    return str0;
}

Friends And Related Symbol Documentation

AbstractInterpretation

friend class AbstractInterpretation

friend

Definition at line 61 of file AbsExtAPI.h.

Member Data Documentation

ae

AbstractInterpretation* SVF::AbsExtAPI::ae

protected

Owning AbstractInterpretation; provides state access.

Definition at line 132 of file AbsExtAPI.h.

checkpoints

Set<const CallICFGNode*> SVF::AbsExtAPI::checkpoints

Definition at line 129 of file AbsExtAPI.h.

func_map

Map<std::string, std::function<void(const CallICFGNode*)> > SVF::AbsExtAPI::func_map

protected

Map of function names to handlers.

Definition at line 135 of file AbsExtAPI.h.

icfg

ICFG* SVF::AbsExtAPI::icfg

protected

Pointer to the interprocedural control flow graph.

Definition at line 134 of file AbsExtAPI.h.

svfir

SVFIR* SVF::AbsExtAPI::svfir

protected

Pointer to the SVF intermediate representation.

Definition at line 133 of file AbsExtAPI.h.

---

The documentation for this class was generated from the following files:

• /home/runner/work/SVF/SVF/svf/include/AE/Svfexe/AbsExtAPI.h
• /home/runner/work/SVF/SVF/svf/lib/AE/Svfexe/AbsExtAPI.cpp