trailofbits / binary_type_inference

GNU General Public License v3.0
11 stars 0 forks source link

Handle Compound Variables Directly During Constraint Generation #36

Open 2over12 opened 2 years ago

2over12 commented 2 years ago

Currently, compound outparameters are handled by creating a fake structure with a field for each storage location during lowering. This obviously isnt ideal. We should output compound variables as such in the CWE checker IR then in constraint generation produce constraints that reflect the compound out or in parameter. Changing these as is would break CWE checker abstract interpretation in a lot of ways. We can perhaps work around this by not touching their argument definition that is primarily used for externals and instead emit our own argument definition specifically for use in type constraint generation

2over12 commented 2 years ago

We may be able to use a hack where we store both the compound version of variables (for use in type inference) and the exploded version (for use in pointer analysis)