cisco-open / llvm-crash-analyzer

llvm crash analysis
Apache License 2.0
41 stars 17 forks source link

[TA] New TaintInfo equivalence operator #10

Closed niktesic closed 2 years ago

niktesic commented 2 years ago

If TaintInfo doesn't have ConcreteMemoryAddress calculated, that doesn't mean it is not a memory location (in some cases the ConcreteMemoryAddress is not available). Current implementation of operator== for TaintInfo has a problem to determine which TaintInfo is a memory address since it relies on existence of ConcreteMemoryAddress.

In the example below, current implementation would just compare the registers, since both TaintInfos don't have ConcreteMemoryAddress calculated.

 $rax = MOV64rm $rax, 1, $noreg, 8, $noreg
     T1: {reg: $rax}
     T2: {reg:$rax; off:8}

This is tested in the new unittest added to inspect Taint Info management during TaintAnalysis. I have a plan to add more cases for TaintInfo equivalence testing.

New implementation of operator== relies on existence of Offset instead of ConcreteMemoryAddress. Additionally, it makes code more readable and separates handling of different TaintInfo types (memory locations vs registers).