Static Value-Flow Analysis
|
#include <SrcSnkDDA.h>
Public Types | |
typedef ProgSlice::SVFGNodeSet | SVFGNodeSet |
typedef Map< const SVFGNode *, ProgSlice * > | SVFGNodeToSliceMap |
typedef SVFGNodeSet::const_iterator | SVFGNodeSetIter |
typedef CxtDPItem | DPIm |
typedef Set< DPIm > | DPImSet |
dpitem set More... | |
typedef Map< const SVFGNode *, DPImSet > | SVFGNodeToDPItemsMap |
map a SVFGNode to its visited dpitems More... | |
typedef Set< const CallICFGNode * > | CallSiteSet |
typedef NodeBS | SVFGNodeBS |
typedef ProgSlice::VFWorkList | WorkList |
Public Types inherited from SVF::GraphReachSolver< GraphType, DPIm > | |
typedef SVF::GenericGraphTraits< GraphType > | GTraits |
Define the GTraits and node iterator. More... | |
typedef GTraits::NodeType | GNODE |
typedef GTraits::EdgeType | GEDGE |
typedef GTraits::nodes_iterator | node_iterator |
typedef GTraits::ChildIteratorType | child_iterator |
typedef SVF::GenericGraphTraits< SVF::Inverse< GNODE * > > | InvGTraits |
Define inverse GTraits and note iterator. More... | |
typedef InvGTraits::ChildIteratorType | inv_child_iterator |
typedef FIFOWorkList< DPIm > | WorkList |
Define worklist. More... | |
Public Member Functions | |
SrcSnkDDA () | |
Bug Reporter. More... | |
~SrcSnkDDA () override | |
Destructor. More... | |
virtual void | analyze (SVFModule *module) |
Start analysis here. More... | |
virtual void | initialize (SVFModule *module) |
Initialize analysis. More... | |
virtual void | finalize () |
Finalize analysis. More... | |
SVFIR * | getPAG () const |
Get SVFIR. More... | |
const SVFG * | getSVFG () const |
Get SVFG. More... | |
PTACallGraph * | getCallgraph () const |
Get Callgraph. More... | |
bool | isGlobalSVFGNode (const SVFGNode *node) const |
Whether this svfg node may access global variable. More... | |
virtual void | setCurSlice (const SVFGNode *src) |
Slice operations. More... | |
ProgSlice * | getCurSlice () const |
void | addSinkToCurSlice (const SVFGNode *node) |
bool | isInCurForwardSlice (const SVFGNode *node) |
bool | isInCurBackwardSlice (const SVFGNode *node) |
void | addToCurForwardSlice (const SVFGNode *node) |
void | addToCurBackwardSlice (const SVFGNode *node) |
bool | isInAWrapper (const SVFGNode *src, CallSiteSet &csIdSet) |
Identify allocation wrappers. More... | |
virtual void | reportBug (ProgSlice *slice)=0 |
report bug on the current analyzed slice More... | |
const SVFGNodeSet & | getSources () const |
Get sources/sinks. More... | |
SVFGNodeSetIter | sourcesBegin () const |
SVFGNodeSetIter | sourcesEnd () const |
void | addToSources (const SVFGNode *node) |
const SVFGNodeSet & | getSinks () const |
SVFGNodeSetIter | sinksBegin () const |
SVFGNodeSetIter | sinksEnd () const |
void | addToSinks (const SVFGNode *node) |
SaberCondAllocator * | getSaberCondAllocator () const |
Get saber condition allocator. More... | |
const SVFBugReport & | getBugReport () const |
virtual void | initSrcs ()=0 |
virtual void | initSnks ()=0 |
virtual bool | isSourceLikeFun (const SVFFunction *fun) |
virtual bool | isSinkLikeFun (const SVFFunction *fun) |
bool | isSource (const SVFGNode *node) const |
bool | isSink (const SVFGNode *node) const |
Protected Member Functions | |
void | FWProcessCurNode (const DPIm &item) override |
Forward traverse. More... | |
void | BWProcessCurNode (const DPIm &item) override |
Backward traverse. More... | |
void | FWProcessOutgoingEdge (const DPIm &item, SVFGEdge *edge) override |
Propagate information forward by matching context. More... | |
void | BWProcessIncomingEdge (const DPIm &item, SVFGEdge *edge) override |
Propagate information backward without matching context, as forward analysis already did it. More... | |
bool | forwardVisited (const SVFGNode *node, const DPIm &item) |
Whether has been visited or not, in order to avoid recursion on SVFG. More... | |
void | addForwardVisited (const SVFGNode *node, const DPIm &item) |
bool | backwardVisited (const SVFGNode *node) |
void | addBackwardVisited (const SVFGNode *node) |
void | clearVisitedMap () |
virtual bool | isAllPathReachable () |
Whether it is all path reachable from a source. More... | |
virtual bool | isSomePathReachable () |
Whether it is some path reachable from a source. More... | |
void | dumpSlices () |
Dump SVFG with annotated slice information. More... | |
void | annotateSlice (ProgSlice *slice) |
void | printZ3Stat () |
Protected Member Functions inherited from SVF::GraphReachSolver< GraphType, DPIm > | |
GraphReachSolver () | |
Constructor. More... | |
virtual | ~GraphReachSolver () |
Destructor. More... | |
const GraphType | graph () const |
Get/Set graph methods. More... | |
void | setGraph (GraphType g) |
GNODE * | getNode (NodeID id) const |
virtual NodeID | getNodeIDFromItem (const DPIm &item) const |
virtual void | forwardTraverse (DPIm &it) |
CFL forward traverse solve. More... | |
virtual void | backwardTraverse (DPIm &it) |
CFL forward traverse solve. More... | |
virtual void | FWProcessCurNode (const DPIm &) |
Process the DP item. More... | |
virtual void | BWProcessCurNode (const DPIm &) |
virtual void | FWProcessOutgoingEdge (const DPIm &item, GEDGE *edge) |
Propagation for the solving, to be implemented in the child class. More... | |
virtual void | BWProcessIncomingEdge (const DPIm &item, GEDGE *edge) |
DPIm | popFromWorklist () |
Worklist operations. More... | |
bool | pushIntoWorklist (DPIm &item) |
bool | isWorklistEmpty () |
bool | isInWorklist (DPIm &item) |
Protected Attributes | |
SaberSVFGBuilder | memSSA |
SVFG * | svfg |
PTACallGraph * | callgraph |
SVFBugReport | report |
Private Attributes | |
ProgSlice * | _curSlice |
SVFGNodeSet | sources |
current program slice More... | |
SVFGNodeSet | sinks |
source nodes More... | |
std::unique_ptr< SaberCondAllocator > | saberCondAllocator |
source nodes More... | |
SVFGNodeToDPItemsMap | nodeToDPItemsMap |
record forward visited dpitems More... | |
SVFGNodeSet | visitedSet |
record backward visited nodes More... | |
General source-sink analysis, which serves as a base analysis to be extended for various clients
Definition at line 54 of file SrcSnkDDA.h.
typedef Set<const CallICFGNode*> SVF::SrcSnkDDA::CallSiteSet |
Definition at line 64 of file SrcSnkDDA.h.
typedef CxtDPItem SVF::SrcSnkDDA::DPIm |
Definition at line 61 of file SrcSnkDDA.h.
typedef Set<DPIm> SVF::SrcSnkDDA::DPImSet |
dpitem set
Definition at line 62 of file SrcSnkDDA.h.
typedef NodeBS SVF::SrcSnkDDA::SVFGNodeBS |
Definition at line 65 of file SrcSnkDDA.h.
Definition at line 58 of file SrcSnkDDA.h.
typedef SVFGNodeSet::const_iterator SVF::SrcSnkDDA::SVFGNodeSetIter |
Definition at line 60 of file SrcSnkDDA.h.
typedef Map<const SVFGNode*, DPImSet> SVF::SrcSnkDDA::SVFGNodeToDPItemsMap |
map a SVFGNode to its visited dpitems
Definition at line 63 of file SrcSnkDDA.h.
typedef Map<const SVFGNode*,ProgSlice*> SVF::SrcSnkDDA::SVFGNodeToSliceMap |
Definition at line 59 of file SrcSnkDDA.h.
Definition at line 66 of file SrcSnkDDA.h.
|
inline |
Bug Reporter.
Constructor
Definition at line 85 of file SrcSnkDDA.h.
|
inlineoverride |
Destructor.
the following shared by multiple checkers, thus can not be released.
Definition at line 90 of file SrcSnkDDA.h.
|
inlineprotected |
Definition at line 295 of file SrcSnkDDA.h.
Definition at line 287 of file SrcSnkDDA.h.
|
inline |
Definition at line 150 of file SrcSnkDDA.h.
|
inline |
Definition at line 167 of file SrcSnkDDA.h.
|
inline |
Definition at line 163 of file SrcSnkDDA.h.
|
inline |
Definition at line 234 of file SrcSnkDDA.h.
|
inline |
Definition at line 218 of file SrcSnkDDA.h.
|
virtual |
Start analysis here.
do not consider there is bug when reaching a global SVFGNode if we touch a global, then we assume the client uses this memory until the program exits.
Definition at line 61 of file SrcSnkDDA.cpp.
|
protected |
Definition at line 284 of file SrcSnkDDA.cpp.
|
inlineprotected |
Definition at line 291 of file SrcSnkDDA.h.
|
inlineoverrideprotected |
Backward traverse.
Definition at line 265 of file SrcSnkDDA.h.
Propagate information backward without matching context, as forward analysis already did it.
Propagate information backward without matching context, as forward analysis already did it
Definition at line 257 of file SrcSnkDDA.cpp.
|
inlineprotected |
Definition at line 299 of file SrcSnkDDA.h.
|
protected |
Dump SVFG with annotated slice information.
Definition at line 295 of file SrcSnkDDA.cpp.
|
inlinevirtual |
Finalize analysis.
Definition at line 114 of file SrcSnkDDA.h.
Whether has been visited or not, in order to avoid recursion on SVFG.
Definition at line 279 of file SrcSnkDDA.h.
|
inlineoverrideprotected |
Forward traverse.
Definition at line 253 of file SrcSnkDDA.h.
Propagate information forward by matching context.
Propagate information forward by matching context
handle globals here
perform context sensitive reachability
whether this dstNode has been visited or not
Definition at line 192 of file SrcSnkDDA.cpp.
|
inline |
Definition at line 246 of file SrcSnkDDA.h.
|
inline |
|
inline |
Definition at line 146 of file SrcSnkDDA.h.
|
inline |
Get SVFIR.
Definition at line 120 of file SrcSnkDDA.h.
|
inline |
Get saber condition allocator.
Definition at line 241 of file SrcSnkDDA.h.
|
inline |
Definition at line 222 of file SrcSnkDDA.h.
|
inline |
|
inline |
Get SVFG.
Definition at line 126 of file SrcSnkDDA.h.
|
virtual |
Initialize analysis.
allocate control-flow graph branch conditions
Definition at line 41 of file SrcSnkDDA.cpp.
|
pure virtual |
Implemented in SVF::LeakChecker.
|
pure virtual |
Initialize sources and sinks
Implemented in SVF::LeakChecker.
|
inlineprotectedvirtual |
|
inline |
Whether this svfg node may access global variable.
Definition at line 138 of file SrcSnkDDA.h.
bool SrcSnkDDA::isInAWrapper | ( | const SVFGNode * | src, |
CallSiteSet & | csIdSet | ||
) |
Identify allocation wrappers.
determine whether a SVFGNode n is in a allocation wrapper function, if so, return all SVFGNodes which receive the value of node n
Definition at line 118 of file SrcSnkDDA.cpp.
|
inline |
Definition at line 159 of file SrcSnkDDA.h.
|
inline |
Definition at line 155 of file SrcSnkDDA.h.
|
inline |
Definition at line 192 of file SrcSnkDDA.h.
|
inlinevirtual |
Reimplemented in SVF::LeakChecker, and SVF::FileChecker.
Definition at line 182 of file SrcSnkDDA.h.
|
inlineprotectedvirtual |
|
inline |
Definition at line 187 of file SrcSnkDDA.h.
|
inlinevirtual |
Reimplemented in SVF::LeakChecker, and SVF::FileChecker.
Definition at line 177 of file SrcSnkDDA.h.
|
protected |
Definition at line 302 of file SrcSnkDDA.cpp.
|
pure virtual |
report bug on the current analyzed slice
Implemented in SVF::LeakChecker, SVF::DoubleFreeChecker, and SVF::FileChecker.
|
virtual |
Slice operations.
Set current slice.
Definition at line 272 of file SrcSnkDDA.cpp.
|
inline |
Definition at line 226 of file SrcSnkDDA.h.
|
inline |
Definition at line 230 of file SrcSnkDDA.h.
|
inline |
Definition at line 210 of file SrcSnkDDA.h.
|
inline |
Definition at line 214 of file SrcSnkDDA.h.
|
private |
Definition at line 69 of file SrcSnkDDA.h.
|
protected |
Definition at line 79 of file SrcSnkDDA.h.
|
protected |
Definition at line 77 of file SrcSnkDDA.h.
|
private |
record forward visited dpitems
Definition at line 73 of file SrcSnkDDA.h.
|
protected |
Definition at line 80 of file SrcSnkDDA.h.
|
private |
source nodes
Definition at line 72 of file SrcSnkDDA.h.
|
private |
source nodes
Definition at line 71 of file SrcSnkDDA.h.
|
private |
current program slice
Definition at line 70 of file SrcSnkDDA.h.
|
protected |
Definition at line 78 of file SrcSnkDDA.h.
|
private |
record backward visited nodes
Definition at line 74 of file SrcSnkDDA.h.