Static Value-Flow Analysis
Loading...
Searching...
No Matches
Public Member Functions | List of all members
SVF::DoubleFreeChecker Class Reference

#include <DoubleFreeChecker.h>

Inheritance diagram for SVF::DoubleFreeChecker:
SVF::LeakChecker SVF::SrcSnkDDA SVF::GraphReachSolver< SVFG *, CxtDPItem >

Public Member Functions

 DoubleFreeChecker ()
 Constructor.
virtual ~DoubleFreeChecker ()
 Destructor.
virtual bool runOnModule (SVFIR *pag) override
 We start from here.
void reportBug (ProgSlice *slice) override
 Report file/close bugs.
void testsValidation (ProgSlice *slice)
 Validate test cases for regression test purpose.
void validateSuccessTests (ProgSlice *slice, const FunObjVar *fun)
void validateExpectedFailureTests (ProgSlice *slice, const FunObjVar *fun)
Public Member Functions inherited from SVF::LeakChecker
 LeakChecker ()
 Constructor.
virtual ~LeakChecker ()
 Destructor.
virtual void initSrcs () override
 Initialize sources and sinks.
virtual void initSnks () override
virtual bool isSourceLikeFun (const FunObjVar *fun) override
 Whether the function is a heap allocator/reallocator (allocate memory).
virtual bool isSinkLikeFun (const FunObjVar *fun) override
 Whether the function is a heap deallocator (free/release memory).
Public Member Functions inherited from SVF::SrcSnkDDA
 SrcSnkDDA ()
 Bug Reporter.
 ~SrcSnkDDA () override
 Destructor.
virtual void analyze ()
 Start analysis here.
virtual void initialize ()
 Initialize analysis.
virtual void finalize ()
 Finalize analysis.
SVFIR * getPAG () const
 Get SVFIR.
const SVFG * getSVFG () const
 Get SVFG.
CallGraph * getCallgraph () const
 Get Callgraph.
bool isGlobalSVFGNode (const SVFGNode *node) const
 Whether this svfg node may access global variable.
virtual void setCurSlice (const SVFGNode *src)
 Slice operations.
ProgSlice * getCurSlice () const
void addSinkToCurSlice (const SVFGNode *node)
bool isInCurForwardSlice (const SVFGNode *node)
bool isInCurBackwardSlice (const SVFGNode *node)
void addToCurForwardSlice (const SVFGNode *node)
void addToCurBackwardSlice (const SVFGNode *node)
bool isInAWrapper (const SVFGNode *src, CallSiteSet &csIdSet)
 Identify allocation wrappers.
const SVFGNodeSet & getSources () const
 Get sources/sinks.
SVFGNodeSetIter sourcesBegin () const
SVFGNodeSetIter sourcesEnd () const
void addToSources (const SVFGNode *node)
const SVFGNodeSet & getSinks () const
SVFGNodeSetIter sinksBegin () const
SVFGNodeSetIter sinksEnd () const
void addToSinks (const SVFGNode *node)
SaberCondAllocator * getSaberCondAllocator () const
 Get saber condition allocator.
const SVFBugReport & getBugReport () const
bool isSource (const SVFGNode *node) const
bool isSink (const SVFGNode *node) const

Additional Inherited Members

Public Types inherited from SVF::LeakChecker
enum  LEAK_TYPE { NEVER_FREE_LEAK , CONTEXT_LEAK , PATH_LEAK , GLOBAL_LEAK }
typedef Map< const SVFGNode *, const CallICFGNode * > SVFGNodeToCSIDMap
typedef FIFOWorkList< const CallICFGNode * > CSWorkList
typedef ProgSlice::VFWorkList WorkList
typedef NodeBS SVFGNodeBS
Public Types inherited from SVF::SrcSnkDDA
typedef ProgSlice::SVFGNodeSet SVFGNodeSet
typedef Map< const SVFGNode *, ProgSlice * > SVFGNodeToSliceMap
typedef SVFGNodeSet::const_iterator SVFGNodeSetIter
typedef CxtDPItem DPIm
typedef Set< DPIm > DPImSet
 dpitem set
typedef Map< const SVFGNode *, DPImSet > SVFGNodeToDPItemsMap
 map a SVFGNode to its visited dpitems
typedef Set< const CallICFGNode * > CallSiteSet
typedef NodeBS SVFGNodeBS
typedef ProgSlice::VFWorkList WorkList
Public Types inherited from SVF::GraphReachSolver< SVFG *, CxtDPItem >
typedef SVF::GenericGraphTraits< SVFG * > GTraits
 Define the GTraits and node iterator.
typedef GTraits::NodeType GNODE
typedef GTraits::EdgeType GEDGE
typedef GTraits::nodes_iterator node_iterator
typedef GTraits::ChildIteratorType child_iterator
typedef SVF::GenericGraphTraits< SVF::Inverse< GNODE * > > InvGTraits
 Define inverse GTraits and note iterator.
typedef InvGTraits::ChildIteratorType inv_child_iterator
typedef FIFOWorkList< CxtDPItem > WorkList
 Define worklist.
Protected Member Functions inherited from SVF::LeakChecker
void testsValidation (const ProgSlice *slice)
 Validate test cases for regression test purpose.
void validateSuccessTests (const SVFGNode *source, const FunObjVar *fun)
void validateExpectedFailureTests (const SVFGNode *source, const FunObjVar *fun)
void addSrcToCSID (const SVFGNode *src, const CallICFGNode *cs)
 Record a source to its callsite.
const CallICFGNode * getSrcCSID (const SVFGNode *src)
Protected Member Functions inherited from SVF::SrcSnkDDA
void FWProcessCurNode (const DPIm &item) override
 Forward traverse.
void BWProcessCurNode (const DPIm &item) override
 Backward traverse.
void FWProcessOutgoingEdge (const DPIm &item, SVFGEdge *edge) override
 Propagate information forward by matching context.
void BWProcessIncomingEdge (const DPIm &item, SVFGEdge *edge) override
 Propagate information backward without matching context, as forward analysis already did it.
bool forwardVisited (const SVFGNode *node, const DPIm &item)
 Whether has been visited or not, in order to avoid recursion on SVFG.
void addForwardVisited (const SVFGNode *node, const DPIm &item)
bool backwardVisited (const SVFGNode *node)
void addBackwardVisited (const SVFGNode *node)
void clearVisitedMap ()
virtual bool isAllPathReachable ()
 Whether it is all path reachable from a source.
virtual bool isSomePathReachable ()
 Whether it is some path reachable from a source.
void dumpSlices ()
 Dump SVFG with annotated slice information.
void annotateSlice (ProgSlice *slice)
void printZ3Stat ()
Protected Member Functions inherited from SVF::GraphReachSolver< SVFG *, CxtDPItem >
 GraphReachSolver ()
 Constructor.
virtual ~GraphReachSolver ()
 Destructor.
const SVFG * graph () const
 Get/Set graph methods.
void setGraph (SVFG *g)
GNODE * getNode (NodeID id) const
virtual NodeID getNodeIDFromItem (const CxtDPItem &item) const
virtual void forwardTraverse (CxtDPItem &it)
 CFL forward traverse solve.
virtual void backwardTraverse (CxtDPItem &it)
 CFL forward traverse solve.
virtual void FWProcessOutgoingEdge (const CxtDPItem &item, GEDGE *edge)
 Propagation for the solving, to be implemented in the child class.
virtual void BWProcessIncomingEdge (const CxtDPItem &item, GEDGE *edge)
CxtDPItem popFromWorklist ()
 Worklist operations.
bool pushIntoWorklist (CxtDPItem &item)
bool isWorklistEmpty ()
bool isInWorklist (CxtDPItem &item)
Protected Attributes inherited from SVF::SrcSnkDDA
SaberSVFGBuilder memSSA
SVFG * svfg
CallGraph * callgraph
SVFBugReport report

Detailed Description

Double free checker to check deallocations of memory

Definition at line 42 of file DoubleFreeChecker.h.

Constructor & Destructor Documentation

◆ DoubleFreeChecker()

SVF::DoubleFreeChecker::DoubleFreeChecker ( )
inline

Constructor.

Definition at line 47 of file DoubleFreeChecker.h.

47 : LeakChecker()
48 {
49 }
SVF::LeakChecker::LeakChecker
LeakChecker()
Constructor.
Definition LeakChecker.h:59

◆ ~DoubleFreeChecker()

virtual SVF::DoubleFreeChecker::~DoubleFreeChecker ( )
inlinevirtual

Destructor.

Definition at line 52 of file DoubleFreeChecker.h.

53 {
54 }

Member Function Documentation

◆ reportBug()

void DoubleFreeChecker::reportBug ( ProgSlice * slice)
overridevirtual

Report file/close bugs.

Reimplemented from SVF::LeakChecker.

Definition at line 37 of file DoubleFreeChecker.cpp.

38{
39
40 if(slice->isSatisfiableForPairs() == false)
41 {
42 GenericBug::EventStack eventStack;
43 slice->evalFinalCond2Event(eventStack);
44 eventStack.push_back(
45 SVFBugEvent(SVFBugEvent::SourceInst, getSrcCSID(slice->getSource())));
46 report.addSaberBug(GenericBug::DOUBLEFREE, eventStack);
47 }
48 if(Options::ValidateTests())
49 testsValidation(slice);
50}
SVF::DoubleFreeChecker::testsValidation
void testsValidation(ProgSlice *slice)
Validate test cases for regression test purpose.
Definition DoubleFreeChecker.cpp:54
SVF::GenericBug::EventStack
std::vector< SVFBugEvent > EventStack
Definition SVFBugReport.h:81
SVF::LeakChecker::getSrcCSID
const CallICFGNode * getSrcCSID(const SVFGNode *src)
Definition LeakChecker.h:109
SVF::Options::ValidateTests
static const Option< bool > ValidateTests
Definition Options.h:164
SVF::ProgSlice::evalFinalCond2Event
void evalFinalCond2Event(GenericBug::EventStack &eventStack) const
Add final condition to eventStack.
Definition ProgSlice.cpp:196
SVF::ProgSlice::isSatisfiableForPairs
bool isSatisfiableForPairs()
Definition ProgSlice.cpp:158
SVF::ProgSlice::getSource
const SVFGNode * getSource() const
root and sink operations
Definition ProgSlice.h:122
SVF::SrcSnkDDA::report
SVFBugReport report
Definition SrcSnkDDA.h:80

◆ runOnModule()

virtual bool SVF::DoubleFreeChecker::runOnModule ( SVFIR * pag)
inlineoverridevirtual

We start from here.

start analysis

Reimplemented from SVF::LeakChecker.

Definition at line 57 of file DoubleFreeChecker.h.

58 {
60 analyze();
61 return false;
62 }
SVF::SrcSnkDDA::analyze
virtual void analyze()
Start analysis here.
Definition SrcSnkDDA.cpp:61

◆ testsValidation()

void DoubleFreeChecker::testsValidation ( ProgSlice * slice)

Validate test cases for regression test purpose.

Definition at line 54 of file DoubleFreeChecker.cpp.

55{
56 const SVFGNode* source = slice->getSource();
57 const CallICFGNode* cs = getSrcCSID(source);
58 const FunObjVar* fun = cs->getCalledFunction();
59 if(fun==nullptr)
60 return;
61 validateSuccessTests(slice,fun);
62 validateExpectedFailureTests(slice,fun);
63}
SVF::CallICFGNode::getCalledFunction
const FunObjVar * getCalledFunction() const
Definition ICFGNode.h:501
SVF::DoubleFreeChecker::validateExpectedFailureTests
void validateExpectedFailureTests(ProgSlice *slice, const FunObjVar *fun)
Definition DoubleFreeChecker.cpp:121
SVF::DoubleFreeChecker::validateSuccessTests
void validateSuccessTests(ProgSlice *slice, const FunObjVar *fun)
Definition DoubleFreeChecker.cpp:65
SVF::SVFGNode
VFGNode SVFGNode
Definition SVFG.h:43

◆ validateExpectedFailureTests()

void DoubleFreeChecker::validateExpectedFailureTests ( ProgSlice * slice,
const FunObjVar * fun )

output safe but should be double free

output double free but should be safe

Definition at line 121 of file DoubleFreeChecker.cpp.

122{
123 const SVFGNode* source = slice->getSource();
124 const CallICFGNode* cs = getSrcCSID(source);
125
126 bool expectedFailure = false;
128 if(fun->getName() == "DOUBLEFREEMALLOCFN")
129 {
130 if(slice->isSatisfiableForPairs() == true)
131 expectedFailure = true;
132 }
133 else if(fun->getName() == "SAFEMALLOCFP")
134 {
135 if(slice->isSatisfiableForPairs() == false)
136 expectedFailure = true;
137 }
138 else if(fun->getName() == "SAFEMALLOC" || fun->getName() == "DOUBLEFREEMALLOC")
139 {
140 return;
141 }
142 else
143 {
144 writeWrnMsg("\t can not validate, check function not found, please put it at the right place!!");
145 return;
146 }
147
148 std::string funName = source->getFun()->getName();
149
150 if (expectedFailure)
151 {
152 if (!(getSrcCSID(source))->hasLLVMValue())
153 {
154 outs() << sucMsg("\t EXPECTED-FAILURE :") << funName <<"\n";
155 return;
156 }
157 outs() << sucMsg("\t EXPECTED-FAILURE :") << funName << " check <src id:" << source->getId()
158 << ", cs id:" << (getSrcCSID(source))->valueOnlyToString() << "> at ("
159 << cs->getSourceLoc() << ")\n";
160 outs() << "\t\t double free path: \n" << slice->evalFinalCond() << "\n";
161 }
162 else
163 {
164 if (!(getSrcCSID(source))->hasLLVMValue())
165 {
166 SVFUtil::errs() << errMsg("\t UNEXPECTED FAILURE :") << funName <<"\n";
167 assert(false && "test case failed!");
168 return;
169 }
170 SVFUtil::errs() << errMsg("\t UNEXPECTED FAILURE :") << funName
171 << " check <src id:" << source->getId()
172 << ", cs id:" << (getSrcCSID(source))->valueOnlyToString() << "> at ("
173 << cs->getSourceLoc() << ")\n";
174 SVFUtil::errs() << "\t\t double free path: \n" << slice->evalFinalCond() << "\n";
175 assert(false && "test case failed!");
176 }
177}
SVF::CallICFGNode::getSourceLoc
const std::string getSourceLoc() const override
Definition ICFGNode.h:571
SVF::ProgSlice::evalFinalCond
std::string evalFinalCond() const
Evaluate final condition.
Definition ProgSlice.cpp:220
SVF::SVFValue::getId
NodeID getId() const
Get ID.
Definition SVFValue.h:158
SVF::SVFValue::getName
virtual const std::string & getName() const
Definition SVFValue.h:184
SVF::VFGNode::getFun
virtual const FunObjVar * getFun() const
Get the function of this SVFGNode.
Definition VFGNode.h:79
SVF::SVFUtil::sucMsg
std::string sucMsg(const std::string &msg)
Returns successful message by converting a string into green string output.
Definition SVFUtil.cpp:75
SVF::SVFUtil::errMsg
std::string errMsg(const std::string &msg)
Print error message by converting a string into red string output.
Definition SVFUtil.cpp:98
SVF::SVFUtil::errs
std::ostream & errs()
Overwrite llvm::errs().
Definition SVFUtil.h:64
SVF::SVFUtil::writeWrnMsg
void writeWrnMsg(const std::string &msg)
Writes a message run through wrnMsg.
Definition SVFUtil.cpp:88
SVF::SVFUtil::outs
std::ostream & outs()
Overwrite llvm::outs().
Definition SVFUtil.h:58

◆ validateSuccessTests()

void DoubleFreeChecker::validateSuccessTests ( ProgSlice * slice,
const FunObjVar * fun )

Definition at line 65 of file DoubleFreeChecker.cpp.

66{
67 const SVFGNode* source = slice->getSource();
68 const CallICFGNode* cs = getSrcCSID(source);
69
70 bool success = false;
71
72 if(fun->getName() == "SAFEMALLOC")
73 {
74 if(slice->isSatisfiableForPairs() == true)
75 success = true;
76 }
77 else if(fun->getName() == "DOUBLEFREEMALLOC")
78 {
79 if(slice->isSatisfiableForPairs() == false)
80 success = true;
81 }
82 else if(fun->getName() == "DOUBLEFREEMALLOCFN" || fun->getName() == "SAFEMALLOCFP")
83 {
84 return;
85 }
86 else
87 {
88 writeWrnMsg("\t can not validate, check function not found, please put it at the right place!!");
89 return;
90 }
91
92 std::string funName = source->getFun()->getName();
93
94 if (success)
95 {
96 if (!(getSrcCSID(source))->hasLLVMValue())
97 {
98 outs() << sucMsg("\t SUCCESS :") << funName<<"\n";
99 return;
100 }
101 outs() << sucMsg("\t SUCCESS :") << funName << " check <src id:" << source->getId()
102 << ", cs id:" << (getSrcCSID(source))->valueOnlyToString() << "> at ("
103 << cs->getSourceLoc() << ")\n";
104 outs() << "\t\t double free path: \n" << slice->evalFinalCond() << "\n";
105 }
106 else
107 {
108 if (!(getSrcCSID(source))->hasLLVMValue())
109 {
110 SVFUtil::errs() << errMsg("\t FAILURE :") << funName << "\n";
111 return;
112 }
113 SVFUtil::errs() << errMsg("\t FAILURE :") << funName << " check <src id:" << source->getId()
114 << ", cs id:" << (getSrcCSID(source))->valueOnlyToString() << "> at ("
115 << cs->getSourceLoc() << ")\n";
116 SVFUtil::errs() << "\t\t double free path: \n" << slice->evalFinalCond() << "\n";
117 assert(false && "test case failed!");
118 }
119}
The documentation for this class was generated from the following files:
Generated by doxygen 1.15.0