It is generally hard to determine if the Taint should be propagated through
a LEA instruction, which loads address, and is usually used for pointer dereferencing.
Please, find the following test from this PR:
#include <stdio.h>
int main() {
int x = 5;
int *p = &x;
int **pp = &p;
p = 1;
printf("2 + x is %d\n",**pp + 2);
return 0;
}
In the presented case, the TaintAnalysis goes into two paths:
(1) Leads to line p = 1, which is correct blame line,
(2) Leads to line int x = 5, which is not correct blame line.
This patch introduces Dereference Level, as a field of a Taint Info.
At the crash-start, TaintInfo has zero (0) DerefLevel, and when propagating
the Taint, DerefLevel is changes based on the Machine Instruction:
(a) For Store MIs, it is increased by 1
(b) For Load MIs, it is decreased by 1
(c) For others, it is not changed
At the end of the Analysis, we consider only blame Nodes that have
zero Dereference level (example below). With this, we can determine if the
constant is loaded into a pointer (1) or into a basic type location(2).
It is generally hard to determine if the Taint should be propagated through a LEA instruction, which loads address, and is usually used for pointer dereferencing.
Please, find the following test from this PR:
In the presented case, the TaintAnalysis goes into two paths: (1) Leads to line
p = 1
, which is correct blame line, (2) Leads to lineint x = 5
, which is not correct blame line.This patch introduces Dereference Level, as a field of a Taint Info. At the crash-start, TaintInfo has zero (0) DerefLevel, and when propagating the Taint, DerefLevel is changes based on the Machine Instruction: (a) For Store MIs, it is increased by 1 (b) For Load MIs, it is decreased by 1 (c) For others, it is not changed
At the end of the Analysis, we consider only blame Nodes that have zero Dereference level (example below). With this, we can determine if the constant is loaded into a pointer (1) or into a basic type location(2).
To specify dereference level of Taint Info from which we explicitly start Taint Analysis, use argument
-start-taint-deref-lvl
.