Open niktesic opened 1 year ago
Thank you for the extensive work, I didn't see much functional issues in the code, but there are couple efficiency issues that I commented on and also the style is a bit hard to understand. for example, runOnBlameMF has grown too big and the added complexity of two flags runFwAnalysis and runBwAnalysis hasn't made it easier to understand. Nevertheless, I'm ok with this code checked in, so I'm approving it, but not merging it. Waiting for other team members to comment
Thanks for your comments, Ali! I will add a new commit with suggested updates. Feel free to add new suggestions, if you notice some.
New commits address the reviewers comments and introduce support for parameters on the stack. This PR is functionally complete in terms of analysis of functions out of the backtrace, where parameters are tainted. New commits discard previous approval, so a new one is needed. Thanks!
isStackSlotTainted
method to check for Tainted stack slots and populating TaintList to be used in the TaintAnalysis of the calleetransformSPtoBPTaints
method to transform TaintInfo to use BP as the base instead of SP, to match the callee frame pointer, when the callee is analyzedtransformBPtoSPTaints
method to transform TaintInfo to use SP as the base instead of BP, to match the caller stack pointer, after callee is analyzedrunOnBlameMF
to properly setup TL_Of_Call
to be used during TaintAnalysis of calls out of the backtrace, when parameters are tainted
Summary
This patch introduces support for analysis of functions, which call site is not in the backtrace, if the parameter is tainted. For now, only parameters forwarded through registers are supported.
This partially resolves https://github.com/cisco-open/llvm-crash-analyzer/issues/36
Description
To be able to track the value of function parameters, this patch introduces forward TaintAnalysis, which propagates the Taint from the function entry point to the point where the parameter value is set. If the path of the Taint is not terminated in the call (it is not set to constant value like in the tainted-param-inside-blame.test ), we should run the backward TaintAnalysis to try to propagate the Taint from the point where the parameter is set to a value, to the point where that value is set to constant ( tainted-params-outside-blame.test ).
Content of commits
0001-Target-Helpers-for-param-forwarding-registers.patch
0002-TaintDFG-Upgrade-TaintDFG-infrastructure.patch
0003-TA-Detect-tainted-parameters.patch
0004-TA-Introduce-forward-Taint-Analysis.patch
0005-TA-Analysis-of-already-decompiled-functions.patch
0006-New-tests-for-tainted-params-analysis.patch
Example
Run crash analyzer:
llvm-crash-analyzer --print-potential-crash-cause-loc ./m --core-file core.m
Output:TaintDFG:![mir-dfg](https://user-images.githubusercontent.com/51359036/230366489-c9b17a57-09b3-4ffa-9a73-4ddd8ed3ce66.png)