search

cisco-open / llvm-crash-analyzer

llvm crash analysis
Apache License 2.0
40 stars 17 forks source link

[TaintDFG] Reimplement TaintInfo less-than operator #12

Closed niktesic closed 2 years ago

niktesic commented 2 years ago

We maintain lastTaintedNode map, to keep track of the last Node (Instruction), which tainted the operand. To construct Taint Data Flow Graph properly, we create an edge between lastTaintedNode and newTaintNode for that particular operand.

To keep order in used std::map, where key is operand, represented by TaintInfo class, the operator< of TaintInfo is used. Previous implementation of TaintInfo operand< was responsible for some incorrect graph construction.

Incorrect DFG generated from test/Analysis/taint-dest-base-reg.test. old Please, notice that Node, which represents load of the constant value 2, is not represented as terminal.

The new implementation of TaintInfo operand< is based on tuple representation of a TaintInfo object. Tuple consists of the following fields:

  1. TaintInfoType - ImmediateVal = 0, RegisterLoc = 1, MemoryLoc = 2;
  2. RegisterID - Register ID (from TargetInfo) or -1 for $noreg;
  3. IntegerValue - Value of Immediate or Offset of Memory Location.

Correct DFG generated from test/Analysis/taint-dest-base-reg.test after applying this patch. tuple

niktesic commented 2 years ago

I've added a test for print-taint-value-flow-as-dot with a new commit, so previous approve was automatically discarded. If there are no new comments, we can land this. Thanks!