SVF::BufOverflowDetector Class Reference

Detector for identifying buffer overflow issues. More...

#include <AEDetector.h>

Inheritance diagram for SVF::BufOverflowDetector:

Classes
struct	BufferOverflowInfo

Public Member Functions
	BufOverflowDetector ()
	Constructor initializes the detector kind to BUF_OVERFLOW and sets up external API buffer overflow rules.
	~BufOverflowDetector ()=default
	Destructor.
void	updateGepObjOffsetFromBase (const ICFGNode *node, AddressValue gepAddrs, AddressValue objAddrs, IntervalValue offset)
	Updates the offset of a GEP object from its base.
void	detect (const ICFGNode *) override
	Detect buffer overflow issues within a node.
void	handleStubFunctions (const CallICFGNode *) override
	Handles external API calls related to buffer overflow detection.
void	addToGepObjOffsetFromBase (const GepObjVar *obj, const IntervalValue &offset)
	Adds an offset to a GEP object.
bool	hasGepObjOffsetFromBase (const GepObjVar *obj) const
	Checks if a GEP object has an associated offset.
IntervalValue	getGepObjOffsetFromBase (const GepObjVar *obj) const
	Retrieves the offset of a GEP object from its base.
IntervalValue	getAccessOffset (NodeID objId, const GepStmt *gep)
	Retrieves the access offset for a given object and GEP statement.
void	addBugToReporter (const AEException &e, const ICFGNode *node)
	Adds a bug to the reporter based on an exception.
void	addBugToReporter (const AEException &e, const ICFGNode *node, const BufferOverflowInfo &info)
	Report an OOB alarm with the buffer size and offset from its check.
void	reportBug () override
	Reports all detected buffer overflow bugs.
void	initExtAPIBufOverflowCheckRules ()
	Initializes external API buffer overflow check rules.
void	detectExtAPI (const CallICFGNode *call)
	Handles external API calls related to buffer overflow detection.
bool	canSafelyAccessMemory (const ValVar *value, const IntervalValue &len, const ICFGNode *node, BufferOverflowInfo *info=nullptr)
	Checks if memory can be safely accessed.
Public Member Functions inherited from SVF::AEDetector
	AEDetector ()
	Constructor initializes the detector kind to UNKNOWN.
virtual	~AEDetector ()=default
	Virtual destructor for safe polymorphic use.
DetectorKind	getKind () const
	Get the kind of the detector.

Static Public Member Functions
static bool	classof (const AEDetector *detector)
	Check if the detector is of the BUF_OVERFLOW kind.
Static Public Member Functions inherited from SVF::AEDetector
static bool	classof (const AEDetector *detector)
	Check if the detector is of the UNKNOWN kind.

Private Member Functions
bool	detectStrcat (const CallICFGNode *call, BufferOverflowInfo &info)
	Detects buffer overflow in 'strcat' function calls.
bool	detectStrcpy (const CallICFGNode *call, BufferOverflowInfo &info)
	Detects buffer overflow in 'strcpy' function calls.

Private Attributes
Map< const GepObjVar *, IntervalValue >	gepObjOffsetFromBase
	Maps GEP objects to their offsets from the base.
Map< std::string, std::vector< std::pair< u32_t, u32_t > > >	extAPIBufOverflowCheckRules
	Rules for checking buffer overflows in external APIs.
Set< std::string >	bugLoc
	Set of locations where bugs have been reported.
SVFBugReport	recoder
	Recorder for abstract execution bugs.
Map< const ICFGNode *, std::string >	nodeToBugInfo
	Maps ICFG nodes to bug information.

Friends
class	AbstractInterpretation

Additional Inherited Members
Public Types inherited from SVF::AEDetector
enum	DetectorKind { BUF_OVERFLOW , NULL_DEREF , UNKNOWN }
	Enumerates the types of detectors available. More...
Protected Attributes inherited from SVF::AEDetector
DetectorKind	kind
	The kind of the detector.

Detailed Description

Detector for identifying buffer overflow issues.

Definition at line 138 of file AEDetector.h.

Constructor & Destructor Documentation

BufOverflowDetector()

SVF::BufOverflowDetector::BufOverflowDetector ( )

inline

Constructor initializes the detector kind to BUF_OVERFLOW and sets up external API buffer overflow rules.

Definition at line 152 of file AEDetector.h.

    {
        kind = BUF_OVERFLOW;
        initExtAPIBufOverflowCheckRules();
    }

~BufOverflowDetector()

SVF::BufOverflowDetector::~BufOverflowDetector ( )

default

Destructor.

Member Function Documentation

addBugToReporter() [1/2]

void SVF::BufOverflowDetector::addBugToReporter ( const AEException &  e, const ICFGNode *  node  )

inline

Adds a bug to the reporter based on an exception.

Parameters

e	The exception that was thrown.
node	Pointer to the ICFG node where the bug was detected.

Definition at line 249 of file AEDetector.h.

    {
        addBugToReporter(e, node, BufferOverflowInfo{});
    }

addBugToReporter() [2/2]

void SVF::BufOverflowDetector::addBugToReporter ( const AEException &  e, const ICFGNode *  node, const BufferOverflowInfo &  info  )

inline

Report an OOB alarm with the buffer size and offset from its check.

Definition at line 255 of file AEDetector.h.

    {
 
        GenericBug::EventStack eventStack;
        SVFBugEvent sourceInstEvent(SVFBugEvent::EventType::SourceInst, node);
        eventStack.push_back(sourceInstEvent); // Add the source instruction event to the event stack
 
        if (eventStack.empty())
        {
            return; // If the event stack is empty, return early
        }
 
        std::string loc = eventStack.back().getEventLoc(); // Get the location of the last event in the stack
 
        // Check if the bug at this location has already been reported
        if (bugLoc.find(loc) != bugLoc.end())
        {
            return; // If the bug location is already reported, return early
        }
        else
        {
            bugLoc.insert(loc); // Otherwise, mark this location as reported
        }
 
        // Add the bug to the recorder with details from the event stack
        recoder.addAbsExecBug(GenericBug::FULLBUFOVERFLOW, eventStack,
                              info.bufferLowerBound, info.bufferSize,
                              info.accessOffset.lb().getNumeral(), info.accessOffset.ub().getNumeral());
        nodeToBugInfo[node] = e.what(); // Record the exception information for the node
    }

addToGepObjOffsetFromBase()

void SVF::BufOverflowDetector::addToGepObjOffsetFromBase ( const GepObjVar *  obj, const IntervalValue &  offset  )

inline

Adds an offset to a GEP object.

Parameters

obj	Pointer to the GEP object.
offset	The interval value of the offset.

Definition at line 204 of file AEDetector.h.

    {
        gepObjOffsetFromBase[obj] = offset;
    }

canSafelyAccessMemory()

bool BufOverflowDetector::canSafelyAccessMemory	(	const ValVar *	value,
		const IntervalValue &	len,
		const ICFGNode *	node,
		BufferOverflowInfo *	info = nullptr
	)

Checks if memory can be safely accessed.

Checks if a memory access is safe given a specific buffer length.

Parameters

value	Pointer to the SVF var.
len	The interval value representing the length of the memory access.
node	The ICFG node providing context.

Returns

True if the memory access is safe, false otherwise.

This function ensures that a given memory access, starting at a specific value, does not exceed the allocated size of the buffer.

Parameters

as	Reference to the abstract state.
value	Pointer to the SVF var.
len	The interval value representing the length of the memory access.

Returns

True if the memory access is safe, false otherwise.

Definition at line 469 of file AEDetector.cpp.

{
    if (info) *info = {};
    SVFIR* svfir = PAG::getPAG();
    auto& ae = AbstractInterpretation::getAEInstance();
 
    AbstractValue ptrVal = ae.getAbsValue(value, node);
    if (!ptrVal.isAddr())
    {
        ptrVal = AddressValue(BlackHoleObjAddr);
        ae.updateAbsValue(value, ptrVal, node);
    }
 
    const AddressValue& addresses = ptrVal.getAddrs();
    if (std::any_of(addresses.begin(), addresses.end(),
                    AbstractState::isNullOrBlackHoleAddr))
        return false;
 
    for (const auto& addr : addresses)
    {
        NodeID objId = ae.getAbsState(node).getIDFromAddr(addr);
        u32_t size = 0;
        u32_t lower = 0;
        // if the object is a constant size object, get the size directly
        if (svfir->getBaseObject(objId)->isConstantByteSize())
        {
            size = svfir->getBaseObject(objId)->getByteSizeOfObj();
            lower = size;
        }
        else
        {
            // if the object is not a constant size object, get the size from the addrStmt
            const ICFGNode* addrNode = svfir->getBaseObject(objId)->getICFGNode();
            for (const SVFStmt* stmt2 : addrNode->getSVFStmts())
            {
                if (const AddrStmt* addrStmt = SVFUtil::dyn_cast<AddrStmt>(stmt2))
                {
                    const auto bounds = ae.getAllocaInstByteSize(addrStmt);
                    size = bounds.upperBound;
                    lower = bounds.lowerBound;
                }
            }
        }
 
        IntervalValue offset(0);
        // if the object is a GepObjVar, get the offset from the base object
        if (SVFUtil::isa<GepObjVar>(svfir->getSVFVar(objId)))
        {
            offset = getGepObjOffsetFromBase(SVFUtil::cast<GepObjVar>(svfir->getSVFVar(objId))) + len;
        }
        else if (SVFUtil::isa<BaseObjVar>(svfir->getSVFVar(objId)))
        {
            // if the object is a BaseObjVar, get the offset directly
            offset = len;
        }
 
        // if the offset is greater than the size, return false
        if (offset.ub().getIntNumeral() >= size)
        {
            if (info) *info = {size, lower, offset};
            return false;
        }
    }
    return true;
}

classof()

static bool SVF::BufOverflowDetector::classof ( const AEDetector *  detector )

inlinestatic

Check if the detector is of the BUF_OVERFLOW kind.

Parameters

detector

Pointer to the detector.

Returns

True if the detector is of type BUF_OVERFLOW, false otherwise.

Definition at line 168 of file AEDetector.h.

    {
        return detector->getKind() == AEDetector::BUF_OVERFLOW;
    }

detect()

void BufOverflowDetector::detect ( const ICFGNode *  node )

overridevirtual

Detect buffer overflow issues within a node.

Detects buffer overflow issues within a given ICFG node.

Parameters

as	Reference to the abstract state.
node	Pointer to the ICFG node.

This function handles both non-call nodes, where it analyzes GEP (GetElementPtr) instructions for potential buffer overflows, and call nodes, where it checks for external API calls that may cause overflows.

Parameters

as	Reference to the abstract state.
node	Pointer to the ICFG node.

Implements SVF::AEDetector.

Definition at line 46 of file AEDetector.cpp.

{
    auto& ae = AbstractInterpretation::getAEInstance();
    if (!SVFUtil::isa<CallICFGNode>(node))
    {
        // Handle non-call nodes by analyzing GEP instructions
        for (const SVFStmt* stmt : node->getSVFStmts())
        {
            if (const GepStmt* gep = SVFUtil::dyn_cast<GepStmt>(stmt))
            {
                SVFIR* svfir = PAG::getPAG();
 
                // Update the GEP object offset from its base
                const AbstractValue& lhsVal = ae.getAbsValue(gep->getLHSVar(), node);
                const AbstractValue& rhsVal = ae.getAbsValue(gep->getRHSVar(), node);
                updateGepObjOffsetFromBase(node, lhsVal.getAddrs(), rhsVal.getAddrs(),
                                           ae.getGepByteOffset(gep));
 
                const AddressValue& objAddrs = rhsVal.getAddrs();
                for (const auto& addr : objAddrs)
                {
                    NodeID objId = ae.getAbsState(node).getIDFromAddr(addr);
                    u32_t size = 0;
                    u32_t lower = 0;
                    // like `int arr[10]` which has constant size before runtime
                    if (svfir->getBaseObject(objId)->isConstantByteSize())
                    {
                        size = svfir->getBaseObject(objId)->getByteSizeOfObj();
                        lower = size;
                    }
                    else
                    {
                        // like `int len = ***; int arr[len]`, whose size can only be known in runtime
                        const ICFGNode* addrNode = svfir->getBaseObject(objId)->getICFGNode();
                        for (const SVFStmt* stmt2 : addrNode->getSVFStmts())
                        {
                            if (const AddrStmt* addrStmt = SVFUtil::dyn_cast<AddrStmt>(stmt2))
                            {
                                const auto bounds = ae.getAllocaInstByteSize(addrStmt);
                                size = bounds.upperBound;
                                lower = bounds.lowerBound;
                            }
                        }
                    }
 
                    // Calculate access offset and check for potential overflow
                    IntervalValue accessOffset = getAccessOffset(objId, gep);
                    if (accessOffset.ub().getIntNumeral() >= size)
                    {
                        AEException bug(stmt->toString());
                        addBugToReporter(bug, stmt->getICFGNode(),
                        {size, lower, accessOffset});
                    }
                }
            }
        }
    }
    else
    {
        // Handle call nodes by checking for external API calls
        const CallICFGNode* callNode = SVFUtil::cast<CallICFGNode>(node);
        if (SVFUtil::isExtCall(callNode->getCalledFunction()))
        {
            detectExtAPI(callNode);
        }
    }
}

detectExtAPI()

void BufOverflowDetector::detectExtAPI

(

const CallICFGNode *

call

)

Handles external API calls related to buffer overflow detection.

Parameters

as	Reference to the abstract state.
call	Pointer to the call ICFG node.

This function checks the type of external memory API (e.g., memcpy, memset, strcpy, strcat) and applies the corresponding buffer overflow checks based on predefined rules.

Parameters

call	Pointer to the call ICFG node.

Definition at line 218 of file AEDetector.cpp.

{
    assert(call->getCalledFunction() && "FunObjVar* is nullptr");
    auto& ae = AbstractInterpretation::getAEInstance();
 
    AbsExtAPI::ExtAPIType extType = AbsExtAPI::UNCLASSIFIED;
 
    // Determine the type of external memory API
    for (const std::string &annotation : ExtAPI::getExtAPI()->getExtFuncAnnotations(call->getCalledFunction()))
    {
        if (annotation.find("MEMCPY") != std::string::npos)
            extType = AbsExtAPI::MEMCPY;
        if (annotation.find("MEMSET") != std::string::npos)
            extType = AbsExtAPI::MEMSET;
        if (annotation.find("STRCPY") != std::string::npos)
            extType = AbsExtAPI::STRCPY;
        if (annotation.find("STRCAT") != std::string::npos)
            extType = AbsExtAPI::STRCAT;
    }
 
    // Apply buffer overflow checks based on the determined API type
    BufferOverflowInfo info;
    if (extType == AbsExtAPI::MEMCPY)
    {
        if (extAPIBufOverflowCheckRules.count(call->getCalledFunction()->getName()) == 0)
        {
            SVFUtil::errs() << "Warning: " << call->getCalledFunction()->getName() << " is not in the rules, please implement it\n";
            return;
        }
        std::vector<std::pair<u32_t, u32_t>> args =
                                              extAPIBufOverflowCheckRules.at(call->getCalledFunction()->getName());
        for (auto arg : args)
        {
            IntervalValue offset = ae.getAbsValue(call->getArgument(arg.second), call).getInterval() - IntervalValue(1);
            const ValVar* argVar = call->getArgument(arg.first);
            if (!canSafelyAccessMemory(argVar, offset, call, &info))
            {
                AEException bug(call->toString());
                addBugToReporter(bug, call, info);
            }
        }
    }
    else if (extType == AbsExtAPI::MEMSET)
    {
        if (extAPIBufOverflowCheckRules.count(call->getCalledFunction()->getName()) == 0)
        {
            SVFUtil::errs() << "Warning: " << call->getCalledFunction()->getName() << " is not in the rules, please implement it\n";
            return;
        }
        std::vector<std::pair<u32_t, u32_t>> args =
                                              extAPIBufOverflowCheckRules.at(call->getCalledFunction()->getName());
        for (auto arg : args)
        {
            IntervalValue offset = ae.getAbsValue(call->getArgument(arg.second), call).getInterval() - IntervalValue(1);
            const ValVar* argVar = call->getArgument(arg.first);
            if (!canSafelyAccessMemory(argVar, offset, call, &info))
            {
                AEException bug(call->toString());
                addBugToReporter(bug, call, info);
            }
        }
    }
    else if (extType == AbsExtAPI::STRCPY)
    {
        if (!detectStrcpy(call, info))
        {
            AEException bug(call->toString());
            addBugToReporter(bug, call, info);
        }
    }
    else if (extType == AbsExtAPI::STRCAT)
    {
        if (!detectStrcat(call, info))
        {
            AEException bug(call->toString());
            addBugToReporter(bug, call, info);
        }
    }
    else
    {
        // Handle other cases
    }
}

detectStrcat()

bool BufOverflowDetector::detectStrcat ( const CallICFGNode *  call, BufferOverflowInfo &  info  )

private

Detects buffer overflow in 'strcat' function calls.

Parameters

call	Pointer to the call ICFG node.

Returns

True if a buffer overflow is detected, false otherwise.

Definition at line 427 of file AEDetector.cpp.

{
    auto& ae = AbstractInterpretation::getAEInstance();
    const std::vector<std::string> strcatGroup = {"__strcat_chk", "strcat", "__wcscat_chk", "wcscat"};
    const std::vector<std::string> strncatGroup = {"__strncat_chk", "strncat", "__wcsncat_chk", "wcsncat"};
 
    if (std::find(strcatGroup.begin(), strcatGroup.end(), call->getCalledFunction()->getName()) != strcatGroup.end())
    {
        const ValVar* arg0Val = call->getArgument(0);
        const ValVar* arg1Val = call->getArgument(1);
        IntervalValue strLen0 = ae.getUtils()->getStrlen(arg0Val, call);
        IntervalValue strLen1 = ae.getUtils()->getStrlen(arg1Val, call);
        IntervalValue totalLen = strLen0 + strLen1;
        return canSafelyAccessMemory(arg0Val, totalLen, call, &info);
    }
    else if (std::find(strncatGroup.begin(), strncatGroup.end(), call->getCalledFunction()->getName()) != strncatGroup.end())
    {
        const ValVar* arg0Val = call->getArgument(0);
        const ValVar* arg2Val = call->getArgument(2);
        IntervalValue arg2Num = ae.getAbsValue(arg2Val, call).getInterval();
        IntervalValue strLen0 = ae.getUtils()->getStrlen(arg0Val, call);
        IntervalValue totalLen = strLen0 + arg2Num;
        return canSafelyAccessMemory(arg0Val, totalLen, call, &info);
    }
    else
    {
        assert(false && "Unknown strcat function, please add it to strcatGroup or strncatGroup");
        abort();
    }
}

detectStrcpy()

bool BufOverflowDetector::detectStrcpy ( const CallICFGNode *  call, BufferOverflowInfo &  info  )

private

Detects buffer overflow in 'strcpy' function calls.

Parameters

call	Pointer to the call ICFG node.

Returns

True if a buffer overflow is detected, false otherwise.

This function checks if the destination buffer can safely accommodate the source string being copied, accounting for the null terminator.

Parameters

as	Reference to the abstract state.
call	Pointer to the call ICFG node.

Returns

True if the memory access is safe, false otherwise.

Definition at line 418 of file AEDetector.cpp.

{
    const ValVar* arg0Val = call->getArgument(0);
    const ValVar* arg1Val = call->getArgument(1);
    auto& ae = AbstractInterpretation::getAEInstance();
    IntervalValue strLen = ae.getUtils()->getStrlen(arg1Val, call);
    return canSafelyAccessMemory(arg0Val, strLen, call, &info);
}

getAccessOffset()

IntervalValue BufOverflowDetector::getAccessOffset	(	SVF::NodeID	objId,
		const GepStmt *	gep
	)

Retrieves the access offset for a given object and GEP statement.

Parameters

as	Reference to the abstract state.
objId	The ID of the object.
gep	Pointer to the GEP statement.

Returns

The interval value of the access offset.

This function calculates the access offset for a base object or a sub-object of an aggregate object (using GEP). If the object is a dummy object, it returns a top interval value.

Parameters

objId	The ID of the object.
gep	Pointer to the GEP statement.

Returns

The interval value of the access offset.

Definition at line 312 of file AEDetector.cpp.

{
    SVFIR* svfir = PAG::getPAG();
    auto& ae = AbstractInterpretation::getAEInstance();
    auto obj = svfir->getSVFVar(objId);
 
    if (SVFUtil::isa<BaseObjVar>(obj))
    {
        return ae.getGepByteOffset(gep);
    }
    else if (SVFUtil::isa<GepObjVar>(obj))
    {
        return getGepObjOffsetFromBase(SVFUtil::cast<GepObjVar>(obj)) + ae.getGepByteOffset(gep);
    }
    else
    {
        assert(SVFUtil::isa<DummyObjVar>(obj) && "Unknown object type");
        return IntervalValue::top();
    }
}

getGepObjOffsetFromBase()

IntervalValue SVF::BufOverflowDetector::getGepObjOffsetFromBase ( const GepObjVar *  obj ) const

inline

Retrieves the offset of a GEP object from its base.

Parameters

obj	Pointer to the GEP object.

Returns

The interval value of the offset.

Definition at line 224 of file AEDetector.h.

    {
        if (hasGepObjOffsetFromBase(obj))
            return gepObjOffsetFromBase.at(obj);
        else
        {
            assert(false && "GepObjVar not found in gepObjOffsetFromBase");
            abort();
        }
    }

handleStubFunctions()

void BufOverflowDetector::handleStubFunctions ( const CallICFGNode *  callNode )

overridevirtual

Handles external API calls related to buffer overflow detection.

Handles stub functions within the ICFG node.

Parameters

call	Pointer to the call ICFG node.

This function is a placeholder for handling stub functions within the ICFG node.

Parameters

node	Pointer to the ICFG node.

Implements SVF::AEDetector.

Definition at line 122 of file AEDetector.cpp.

{
    // get function name
    std::string funcName = callNode->getCalledFunction()->getName();
    auto& ae = AbstractInterpretation::getAEInstance();
    if (funcName == "SAFE_BUFACCESS")
    {
        ae.getUtils()->checkpoints.erase(callNode);
        if (callNode->arg_size() < 2)
            return;
        IntervalValue val = ae.getAbsValue(callNode->getArgument(1), callNode).getInterval();
        if (val.isBottom())
        {
            val = IntervalValue(0);
            assert(false && "SAFE_BUFACCESS size is bottom");
        }
        const ValVar* arg0Val = callNode->getArgument(0);
        bool isSafe = canSafelyAccessMemory(arg0Val, val, callNode);
        if (isSafe)
        {
            SVFUtil::outs() << SVFUtil::sucMsg("success: expected safe buffer access at SAFE_BUFACCESS")
                            << " — " << callNode->toString() << "\n";
            return;
        }
        else
        {
            SVFUtil::outs() << SVFUtil::errMsg("failure: unexpected buffer overflow at SAFE_BUFACCESS")
                            << " — Position: " << callNode->getSourceLoc() << "\n";
            assert(false);
        }
    }
    else if (funcName == "UNSAFE_BUFACCESS")
    {
        ae.getUtils()->checkpoints.erase(callNode);
        if (callNode->arg_size() < 2) return;
        IntervalValue val = ae.getAbsValue(callNode->getArgument(1), callNode).getInterval();
        if (val.isBottom())
        {
            assert(false && "UNSAFE_BUFACCESS size is bottom");
        }
        const ValVar* arg0Val = callNode->getArgument(0);
        bool isSafe = canSafelyAccessMemory(arg0Val, val, callNode);
        if (!isSafe)
        {
            SVFUtil::outs() << SVFUtil::sucMsg("success: expected buffer overflow at UNSAFE_BUFACCESS")
                            << " — " << callNode->toString() << "\n";
            return;
        }
        else
        {
            SVFUtil::outs() << SVFUtil::errMsg("failure: buffer overflow expected at UNSAFE_BUFACCESS, but none detected")
                            << " — Position: " << callNode->getSourceLoc() << "\n";
            assert(false);
        }
    }
}

hasGepObjOffsetFromBase()

bool SVF::BufOverflowDetector::hasGepObjOffsetFromBase ( const GepObjVar *  obj ) const

inline

Checks if a GEP object has an associated offset.

Parameters

obj	Pointer to the GEP object.

Returns

True if the GEP object has an offset, false otherwise.

Definition at line 214 of file AEDetector.h.

    {
        return gepObjOffsetFromBase.find(obj) != gepObjOffsetFromBase.end();
    }

initExtAPIBufOverflowCheckRules()

void BufOverflowDetector::initExtAPIBufOverflowCheckRules

(

)

Initializes external API buffer overflow check rules.

This function sets up rules for various memory-related functions like memcpy, memset, etc., defining which arguments should be checked for buffer overflows.

Definition at line 185 of file AEDetector.cpp.

{
    extAPIBufOverflowCheckRules["llvm_memcpy_p0i8_p0i8_i64"] = {{0, 2}, {1, 2}};
    extAPIBufOverflowCheckRules["llvm_memcpy_p0_p0_i64"] = {{0, 2}, {1, 2}};
    extAPIBufOverflowCheckRules["llvm_memcpy_p0i8_p0i8_i32"] = {{0, 2}, {1, 2}};
    extAPIBufOverflowCheckRules["llvm_memcpy"] = {{0, 2}, {1, 2}};
    extAPIBufOverflowCheckRules["llvm_memmove"] = {{0, 2}, {1, 2}};
    extAPIBufOverflowCheckRules["llvm_memmove_p0i8_p0i8_i64"] = {{0, 2}, {1, 2}};
    extAPIBufOverflowCheckRules["llvm_memmove_p0_p0_i64"] = {{0, 2}, {1, 2}};
    extAPIBufOverflowCheckRules["llvm_memmove_p0i8_p0i8_i32"] = {{0, 2}, {1, 2}};
    extAPIBufOverflowCheckRules["__memcpy_chk"] = {{0, 2}, {1, 2}};
    extAPIBufOverflowCheckRules["memmove"] = {{0, 2}, {1, 2}};
    extAPIBufOverflowCheckRules["bcopy"] = {{0, 2}, {1, 2}};
    extAPIBufOverflowCheckRules["memccpy"] = {{0, 3}, {1, 3}};
    extAPIBufOverflowCheckRules["__memmove_chk"] = {{0, 2}, {1, 2}};
    extAPIBufOverflowCheckRules["llvm_memset"] = {{0, 2}};
    extAPIBufOverflowCheckRules["llvm_memset_p0i8_i32"] = {{0, 2}};
    extAPIBufOverflowCheckRules["llvm_memset_p0i8_i64"] = {{0, 2}};
    extAPIBufOverflowCheckRules["llvm_memset_p0_i64"] = {{0, 2}};
    extAPIBufOverflowCheckRules["__memset_chk"] = {{0, 2}};
    extAPIBufOverflowCheckRules["wmemset"] = {{0, 2}};
    extAPIBufOverflowCheckRules["strncpy"] = {{0, 2}, {1, 2}};
    extAPIBufOverflowCheckRules["iconv"] = {{1, 2}, {3, 4}};
}

reportBug()

void SVF::BufOverflowDetector::reportBug ( )

inlineoverridevirtual

Reports all detected buffer overflow bugs.

Implements SVF::AEDetector.

Definition at line 290 of file AEDetector.h.

    {
        if (!nodeToBugInfo.empty())
        {
            std::cerr << "######################Buffer Overflow (" + std::to_string(nodeToBugInfo.size())
                      + " found)######################\n";
            std::cerr << "---------------------------------------------\n";
            for (const auto& it : nodeToBugInfo)
            {
                std::cerr << it.second << "\n---------------------------------------------\n";
            }
        }
    }

updateGepObjOffsetFromBase()

void BufOverflowDetector::updateGepObjOffsetFromBase	(	const ICFGNode *	node,
		SVF::AddressValue	gepAddrs,
		SVF::AddressValue	objAddrs,
		SVF::IntervalValue	offset
	)

Updates the offset of a GEP object from its base.

Parameters

as	Reference to the abstract state.
gepAddrs	Address value for GEP.
objAddrs	Address value for the object.
offset	The interval value of the offset.

This function calculates and stores the offset of a GEP object from its base object using the addresses and offsets provided.

Parameters

gepAddrs	The addresses of the GEP objects.
objAddrs	The addresses of the base objects.
offset	The interval value of the offset.

Definition at line 343 of file AEDetector.cpp.

{
    SVFIR* svfir = PAG::getPAG();
    auto& ae = AbstractInterpretation::getAEInstance();
    const AbstractState& as = ae.getAbsState(node);
 
    for (const auto& objAddr : objAddrs)
    {
        NodeID objId = as.getIDFromAddr(objAddr);
        auto obj = svfir->getSVFVar(objId);
 
        if (SVFUtil::isa<BaseObjVar>(obj))
        {
            // if the object is a BaseObjVar, add the offset directly
            // like llvm bc `arr = alloc i8 12; p = gep arr, 4`
            // we write key value pair {gep, 4}
            for (const auto& gepAddr : gepAddrs)
            {
                NodeID gepObj = as.getIDFromAddr(gepAddr);
                if (const GepObjVar* gepObjVar = SVFUtil::dyn_cast<GepObjVar>(svfir->getSVFVar(gepObj)))
                {
                    addToGepObjOffsetFromBase(gepObjVar, offset);
                }
                else
                {
                    assert(AbstractState::isNullOrBlackHoleAddr(gepAddr) &&
                           "GEP object is neither a GepObjVar nor an address without a backing object");
                }
            }
        }
        else if (SVFUtil::isa<GepObjVar>(obj))
        {
            // if the object is a GepObjVar, add the offset from the base object
            // like llvm bc `arr = alloc i8 12; p = gep arr, 4; q = gep p, 6`
            // we retreive {p, 4} and write {q, 4+6}
            const GepObjVar* objVar = SVFUtil::cast<GepObjVar>(obj);
            for (const auto& gepAddr : gepAddrs)
            {
                NodeID gepObj = as.getIDFromAddr(gepAddr);
                if (const GepObjVar* gepObjVar = SVFUtil::dyn_cast<GepObjVar>(svfir->getSVFVar(gepObj)))
                {
                    if (hasGepObjOffsetFromBase(objVar))
                    {
                        IntervalValue objOffsetFromBase =
                            getGepObjOffsetFromBase(objVar);
                        if (!hasGepObjOffsetFromBase(gepObjVar))
                            addToGepObjOffsetFromBase(
                                gepObjVar, objOffsetFromBase + offset);
                    }
                    else
                    {
                        assert(false &&
                               "GEP RHS object has no offset from base");
                    }
                }
                else
                {
                    assert(AbstractState::isNullOrBlackHoleAddr(gepAddr) &&
                           "GEP object is neither a GepObjVar nor an address without a backing object");
                }
            }
        }
    }
}

Friends And Related Symbol Documentation

AbstractInterpretation

friend class AbstractInterpretation

friend

Definition at line 140 of file AEDetector.h.

Member Data Documentation

bugLoc

Set<std::string> SVF::BufOverflowDetector::bugLoc

private

Set of locations where bugs have been reported.

Definition at line 344 of file AEDetector.h.

extAPIBufOverflowCheckRules

Map<std::string, std::vector<std::pair<u32_t, u32_t> > > SVF::BufOverflowDetector::extAPIBufOverflowCheckRules

private

Rules for checking buffer overflows in external APIs.

Definition at line 343 of file AEDetector.h.

gepObjOffsetFromBase

Map<const GepObjVar*, IntervalValue> SVF::BufOverflowDetector::gepObjOffsetFromBase

private

Maps GEP objects to their offsets from the base.

Definition at line 342 of file AEDetector.h.

nodeToBugInfo

Map<const ICFGNode*, std::string> SVF::BufOverflowDetector::nodeToBugInfo

private

Maps ICFG nodes to bug information.

Definition at line 346 of file AEDetector.h.

recoder

SVFBugReport SVF::BufOverflowDetector::recoder

private

Recorder for abstract execution bugs.

Definition at line 345 of file AEDetector.h.

---

The documentation for this class was generated from the following files:

• /home/runner/work/SVF/SVF/svf/include/AE/Svfexe/AEDetector.h
• /home/runner/work/SVF/SVF/svf/lib/AE/Svfexe/AEDetector.cpp