We maintain lastTaintedNode map, to keep track of the last Node (Instruction), which tainted the operand.
To construct Taint Data Flow Graph properly, we create an edge between lastTaintedNode and newTaintNode
for that particular operand.
To keep order in used std::map, where key is operand, represented by TaintInfo class, the operator< of TaintInfo is used.
Previous implementation of TaintInfo operand< was responsible for some incorrect graph construction.
Incorrect DFG generated from test/Analysis/taint-dest-base-reg.test.
Please, notice that Node, which represents load of the constant value 2, is not represented as terminal.
The new implementation of TaintInfo operand< is based on tuple representation of a TaintInfo object.
Tuple consists of the following fields:
I've added a test for print-taint-value-flow-as-dot with a new commit, so previous approve was automatically discarded. If there are no new comments, we can land this. Thanks!
We maintain lastTaintedNode map, to keep track of the last Node (Instruction), which tainted the operand. To construct Taint Data Flow Graph properly, we create an edge between lastTaintedNode and newTaintNode for that particular operand.
To keep order in used std::map, where key is operand, represented by TaintInfo class, the operator< of TaintInfo is used. Previous implementation of TaintInfo operand< was responsible for some incorrect graph construction.
Incorrect DFG generated from test/Analysis/taint-dest-base-reg.test.
Please, notice that Node, which represents load of the constant value 2, is not represented as terminal.
The new implementation of TaintInfo operand< is based on tuple representation of a TaintInfo object. Tuple consists of the following fields:
Correct DFG generated from test/Analysis/taint-dest-base-reg.test after applying this patch.![tuple](https://user-images.githubusercontent.com/51359036/180209039-bd4897ce-89a4-4752-b119-55565aab435f.png)