From bd5d73206f2ea0c696c69fffb3fd96c3493a1d2e Mon Sep 17 00:00:00 2001 From: mxHuber Date: Wed, 23 Oct 2024 10:40:18 +0200 Subject: [PATCH 1/2] fix --- .../IfdsIde/Problems/IFDSTaintAnalysis.cpp | 33 +++++++++---------- 1 file changed, 16 insertions(+), 17 deletions(-) diff --git a/lib/PhasarLLVM/DataFlow/IfdsIde/Problems/IFDSTaintAnalysis.cpp b/lib/PhasarLLVM/DataFlow/IfdsIde/Problems/IFDSTaintAnalysis.cpp index 1b54e5b162..85490d7f54 100644 --- a/lib/PhasarLLVM/DataFlow/IfdsIde/Problems/IFDSTaintAnalysis.cpp +++ b/lib/PhasarLLVM/DataFlow/IfdsIde/Problems/IFDSTaintAnalysis.cpp @@ -262,9 +262,8 @@ transferAndKillTwoFlows(d_t To, d_t From1, d_t From2) { }); } -auto IFDSTaintAnalysis::getNormalFlowFunction(n_t Curr, - [[maybe_unused]] n_t Succ) - -> FlowFunctionPtrType { +auto IFDSTaintAnalysis::getNormalFlowFunction( + n_t Curr, [[maybe_unused]] n_t Succ) -> FlowFunctionPtrType { // If a tainted value is stored, the store location must be tainted too if (const auto *Store = llvm::dyn_cast(Curr)) { container_type Gen; @@ -329,10 +328,9 @@ auto IFDSTaintAnalysis::getCallFlowFunction(n_t CallSite, f_t DestFun) return mapFactsToCallee(CS, DestFun); } -auto IFDSTaintAnalysis::getRetFlowFunction(n_t CallSite, f_t /*CalleeFun*/, - n_t ExitStmt, - [[maybe_unused]] n_t RetSite) - -> FlowFunctionPtrType { +auto IFDSTaintAnalysis::getRetFlowFunction( + n_t CallSite, f_t /*CalleeFun*/, n_t ExitStmt, + [[maybe_unused]] n_t RetSite) -> FlowFunctionPtrType { // We must check if the return value and formal parameter are tainted, if so // we must taint all user's of the function call. We are only interested in // formal parameters of pointer/reference type. @@ -349,10 +347,9 @@ auto IFDSTaintAnalysis::getRetFlowFunction(n_t CallSite, f_t /*CalleeFun*/, // All other stuff is killed at this point } -auto IFDSTaintAnalysis::getCallToRetFlowFunction(n_t CallSite, - [[maybe_unused]] n_t RetSite, - llvm::ArrayRef Callees) - -> FlowFunctionPtrType { +auto IFDSTaintAnalysis::getCallToRetFlowFunction( + n_t CallSite, [[maybe_unused]] n_t RetSite, + llvm::ArrayRef Callees) -> FlowFunctionPtrType { const auto *CS = llvm::cast(CallSite); @@ -416,12 +413,14 @@ auto IFDSTaintAnalysis::getSummaryFlowFunction([[maybe_unused]] n_t CallSite, llvm::zip(CS->args(), DestFun->args())) { if (Source == Arg.get()) { auto VecFacts = DestFunFacts.find(DestParam.getArgNo()); - for (const auto &VecFact : VecFacts->second) { - if (const auto *Param = - std::get_if(&VecFact.Fact)) { - Facts.insert(CS->getArgOperand(Param->Index)); - } else { - Facts.insert(CallSite); + if (VecFacts != DestFunFacts.end()) { + for (const auto &VecFact : VecFacts->second) { + if (const auto *Param = std::get_if( + &VecFact.Fact)) { + Facts.insert(CS->getArgOperand(Param->Index)); + } else { + Facts.insert(CallSite); + } } } } From 55beb8fffd334735a6d56f2d92a815ea4be09561 Mon Sep 17 00:00:00 2001 From: mxHuber Date: Wed, 23 Oct 2024 10:44:56 +0200 Subject: [PATCH 2/2] fixed formatting --- .../IfdsIde/Problems/IFDSTaintAnalysis.cpp | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/lib/PhasarLLVM/DataFlow/IfdsIde/Problems/IFDSTaintAnalysis.cpp b/lib/PhasarLLVM/DataFlow/IfdsIde/Problems/IFDSTaintAnalysis.cpp index 85490d7f54..5a525093f3 100644 --- a/lib/PhasarLLVM/DataFlow/IfdsIde/Problems/IFDSTaintAnalysis.cpp +++ b/lib/PhasarLLVM/DataFlow/IfdsIde/Problems/IFDSTaintAnalysis.cpp @@ -262,8 +262,9 @@ transferAndKillTwoFlows(d_t To, d_t From1, d_t From2) { }); } -auto IFDSTaintAnalysis::getNormalFlowFunction( - n_t Curr, [[maybe_unused]] n_t Succ) -> FlowFunctionPtrType { +auto IFDSTaintAnalysis::getNormalFlowFunction(n_t Curr, + [[maybe_unused]] n_t Succ) + -> FlowFunctionPtrType { // If a tainted value is stored, the store location must be tainted too if (const auto *Store = llvm::dyn_cast(Curr)) { container_type Gen; @@ -328,9 +329,10 @@ auto IFDSTaintAnalysis::getCallFlowFunction(n_t CallSite, f_t DestFun) return mapFactsToCallee(CS, DestFun); } -auto IFDSTaintAnalysis::getRetFlowFunction( - n_t CallSite, f_t /*CalleeFun*/, n_t ExitStmt, - [[maybe_unused]] n_t RetSite) -> FlowFunctionPtrType { +auto IFDSTaintAnalysis::getRetFlowFunction(n_t CallSite, f_t /*CalleeFun*/, + n_t ExitStmt, + [[maybe_unused]] n_t RetSite) + -> FlowFunctionPtrType { // We must check if the return value and formal parameter are tainted, if so // we must taint all user's of the function call. We are only interested in // formal parameters of pointer/reference type. @@ -347,9 +349,10 @@ auto IFDSTaintAnalysis::getRetFlowFunction( // All other stuff is killed at this point } -auto IFDSTaintAnalysis::getCallToRetFlowFunction( - n_t CallSite, [[maybe_unused]] n_t RetSite, - llvm::ArrayRef Callees) -> FlowFunctionPtrType { +auto IFDSTaintAnalysis::getCallToRetFlowFunction(n_t CallSite, + [[maybe_unused]] n_t RetSite, + llvm::ArrayRef Callees) + -> FlowFunctionPtrType { const auto *CS = llvm::cast(CallSite);