dataflow pass

A trivial LLVM pass that instruct tainted memory access with DFSsan.

Requirement:

• LLVM 3.8 or later
• clang
• compiler-rt (dataflow sanitizer)
• lit (for running test suite)

Build:

mkdir build
cd build
cmake ..
make

Simple example

As for target source example/target.c

1   #include <string.h>
2   #include "runtime.h"
3   #define MAXSIZE 256
4   int main()
5   {
6       char src[MAXSIZE] = {1};
7       char dst[MAXSIZE] = {0};
8       df_init(src, MAXSIZE);
9       memcpy(dst, src, MAXSIZE/2);
10      char temp;
11      temp = dst[0];
12      temp = dst[MAXSIZE/2 - 1];
13      temp = dst[MAXSIZE/2];
14      df_stat();
15      return 0;
16  }

1). compile target source with clang

cd example
clang -g -fsanitize=dataflow -std=c11 -Xclang -load \
-Xclang ../build/dataflow/libLoadStorePass.so -I../dataflow/runtime -c target.c -o target.o

2). compile runtime library

clang -g -fsanitize=dataflow ../dataflow/runtime/runtime.c \
-I../dataflow/runtime -c -o runtime.o

3). and link them together

clang -fsanitize=dataflow target.o runtime.o -o target

Sample output of runtime checking:

DF_RUNTIME: N/A:0: clean store 4 byte(s)
DF_RUNTIME: target.c:6: clean store 256 byte(s)
DF_RUNTIME: target.c:6: clean store 1 byte(s)
DF_RUNTIME: target.c:7: clean store 256 byte(s)
DF_RUNTIME: label initialized
DF_RUNTIME: target.c:9: tainted store 128 byte(s)
DF_RUNTIME: target.c:9: tainted load 128 byte(s)
DF_RUNTIME: target.c:11: tainted load 1 byte(s)
DF_RUNTIME: target.c:11: tainted store 1 byte(s)
DF_RUNTIME: target.c:12: tainted load 1 byte(s)
DF_RUNTIME: target.c:12: tainted store 1 byte(s)
DF_RUNTIME: target.c:13: clean load 1 byte(s)
DF_RUNTIME: target.c:13: clean store 1 byte(s)
DF_RUNTIME: total 4 load, 3 tainted, 1 clean
DF_RUNTIME: total 4 store, 3 tainted, 1 clean

Run tests:

lit --show-tests dataflow/test
lit -j8 dataflow/test