#include <AEDetector.h>
Definition at line 330 of file AEDetector.h.
◆ NullptrDerefDetector()
SVF::NullptrDerefDetector::NullptrDerefDetector |
( |
| ) |
|
|
inline |
Definition at line 334 of file AEDetector.h.
335 {
337 }
@ NULL_DEREF
Detector for nullptr dereference issues.
DetectorKind kind
The kind of the detector.
◆ ~NullptrDerefDetector()
SVF::NullptrDerefDetector::~NullptrDerefDetector |
( |
| ) |
|
|
default |
◆ addBugToReporter()
Adds a bug to the reporter based on an exception.
- Parameters
-
e | The exception that was thrown. |
node | Pointer to the ICFG node where the bug was detected. |
Definition at line 376 of file AEDetector.h.
377 {
381
383 {
384 return;
385 }
387
388
390 {
391 return;
392 }
393 else
394 {
396 }
399 }
std::vector< SVFBugEvent > EventStack
Set< std::string > bugLoc
Set of locations where bugs have been reported.
SVFBugReport recoder
Recorder for abstract execution bugs.
Map< const ICFGNode *, std::string > nodeToBugInfo
Maps ICFG nodes to bug information.
void addAbsExecBug(GenericBug::BugType bugType, const GenericBug::EventStack &eventStack, s64_t allocLowerBound, s64_t allocUpperBound, s64_t accessLowerBound, s64_t accessUpperBound)
llvm::IRBuilder IRBuilder
◆ canSafelyDerefPtr()
Definition at line 679 of file AEDetector.cpp.
680{
683
685
686 if (!
AbsVal.isAddr())
return true;
688 {
689
691 return false;
692
694 return false;
695
696 else if (
as.isFreedMem(
addr))
697 return false;
698 }
699
700
701 return true;
702}
static bool isNullMem(u32_t addr)
static bool isInvalidMem(u32_t addr)
bool isUninit(AbstractValue v)
Checks if an Abstract Value is uninitialized.
◆ classof()
◆ detect()
Detects nullptr dereferences issues within a node.
- Parameters
-
as | Reference to the abstract state. |
node | Pointer to the ICFG node. |
Implements SVF::AEDetector.
Definition at line 526 of file AEDetector.cpp.
527{
528 if (SVFUtil::isa<CallICFGNode>(node))
529 {
530
531
534 {
536 }
537 }
538 else
539 {
540 for (
const auto&
stmt: node->getSVFStmts())
541 {
543 {
544
545
548 {
551 }
552 }
553 else if (
const LoadStmt* load = SVFUtil::dyn_cast<LoadStmt>(
stmt))
554 {
555
556
559 {
562 }
563 }
564 }
565 }
566}
Exception class for handling errors in Abstract Execution.
bool canSafelyDerefPtr(AbstractState &as, const SVFVar *ptr)
void addBugToReporter(const AEException &e, const ICFGNode *node)
Adds a bug to the reporter based on an exception.
void detectExtAPI(AbstractState &as, const CallICFGNode *call)
Handle external API calls related to nullptr dereferences.
bool isExtCall(const FunObjVar *fun)
◆ detectExtAPI()
Handle external API calls related to nullptr dereferences.
- Parameters
-
as | Reference to the abstract state. |
call | Pointer to the call ICFG node. |
Definition at line 620 of file AEDetector.cpp.
621{
623
624
626 for (
const std::string &
annotation:
ExtAPI::getExtAPI()->getExtFuncAnnotations(call->getCalledFunction()))
627 {
628 if (
annotation.find(
"MEMCPY") != std::string::npos)
629 {
631 {
632
635 }
636 else
637 {
638
643 }
644 }
645 else if (
annotation.find(
"MEMSET") != std::string::npos)
646 {
647
649 }
650 else if (
annotation.find(
"STRCPY") != std::string::npos)
651 {
652
655 }
656 else if (
annotation.find(
"STRCAT") != std::string::npos)
657 {
658
659
662 }
663 }
664
666 {
668 continue;
671 {
674 }
675 }
676}
const std::string toString() const override
const ValVar * getArgument(u32_t ArgNo) const
Parameter operations.
const FunObjVar * getCalledFunction() const
◆ handleStubFunctions()
Handles external API calls related to nullptr dereferences.
- Parameters
-
call | Pointer to the call ICFG node. |
Implements SVF::AEDetector.
Definition at line 569 of file AEDetector.cpp.
570{
571 std::string funcName =
callNode->getCalledFunction()->getName();
572 if (funcName == "UNSAFE_LOAD")
573 {
574
577 return;
579
581
584 {
586 <<
" — " <<
callNode->toString() <<
"\n";
587 return;
588 }
589 else
590 {
592 <<
" — Position: " <<
callNode->getSourceLoc() <<
"\n";
594 }
595 }
596 else if (funcName == "SAFE_LOAD")
597 {
598
600 if (
callNode->arg_size() < 1)
return;
603
606 {
608 <<
" — " <<
callNode->toString() <<
"\n";
609 return;
610 }
611 else
612 {
614 <<
" — Position: " <<
callNode->getSourceLoc() <<
"\n";
616 }
617 }
618}
static AbstractInterpretation & getAEInstance()
AbstractState & getAbsStateFromTrace(const ICFGNode *node)
Retrieves the abstract state from the trace for a given ICFG node.
Set< const CallICFGNode * > checkpoints
NodeID getId() const
Get ID.
std::string sucMsg(const std::string &msg)
Returns successful message by converting a string into green string output.
std::string errMsg(const std::string &msg)
Print error message by converting a string into red string output.
std::ostream & outs()
Overwrite llvm::outs()
◆ isNull()
Check if an Abstract Value is NULL (or uninitialized).
- Parameters
-
v | An Abstract Value of loaded from an address in an Abstract State. |
Definition at line 431 of file AEDetector.h.
432 {
433 return !
v.isAddr() && !
v.isInterval();
434 }
◆ isUninit()
Checks if an Abstract Value is uninitialized.
- Parameters
-
v | The Abstract Value to check. |
- Returns
- True if the value is uninitialized, false otherwise.
Definition at line 364 of file AEDetector.h.
365 {
366
367 bool is =
v.getAddrs().isBottom() &&
v.getInterval().isBottom();
369 }
◆ reportBug()
void SVF::NullptrDerefDetector::reportBug |
( |
| ) |
|
|
inlinevirtual |
Reports all detected nullptr dereference bugs.
Implements SVF::AEDetector.
Definition at line 404 of file AEDetector.h.
405 {
407 {
408 std::cerr <<
"###################### Nullptr Dereference (" + std::to_string(
nodeToBugInfo.size())
409 + " found)######################\n";
410 std::cerr << "---------------------------------------------\n";
412 {
413 std::cerr <<
it.second <<
"\n---------------------------------------------\n";
414 }
415 }
416 }
◆ AbstractInterpretation
◆ bugLoc
Set<std::string> SVF::NullptrDerefDetector::bugLoc |
|
private |
Set of locations where bugs have been reported.
Definition at line 439 of file AEDetector.h.
◆ nodeToBugInfo
◆ recoder
Recorder for abstract execution bugs.
Definition at line 440 of file AEDetector.h.
The documentation for this class was generated from the following files: