Previously, taint propagations in *alloc() functions were discarded. This resulted in the seemingly poor performance in the LAVA-M dataset.
The current approach is to record each allocation in a HashMap and propagate the taint labels on reallocation. This fix improved the who benchmark in LAVA-M to around 2400 bugs found.
TODO: add support for non-standard reallocarray() function
Fixed taint propagation in
realloc()
.Previously, taint propagations in
*alloc()
functions were discarded. This resulted in the seemingly poor performance in the LAVA-M dataset.The current approach is to record each allocation in a
HashMap
and propagate the taint labels on reallocation. This fix improved thewho
benchmark in LAVA-M to around 2400 bugs found.TODO: add support for non-standard
reallocarray()
function