replica
/
hanchenye-llvm-project
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
118,476 Commits 2 Branches 0 Tags 1.8 GiB
Commit Graph

15 Commits

Author SHA1 Message Date
Anna Zaks 394256cc0d [analyzer] If memory region is tainted mark data as tainted. 
+ random comments

llvm-svn: 146199
 2011-12-08 22:38:43 +00:00
Anna Zaks 9da86ce834 [analyzer] Cleanup: use the variable. 
llvm-svn: 146056
 2011-12-07 19:56:13 +00:00
Anna Zaks b86fdbe7e3 [analyzer] Propagate taint through MemRegions. 
SVal can be not only a symbol, but a MemRegion. Add support for such
cases.

llvm-svn: 146006
 2011-12-07 01:09:52 +00:00
Anna Zaks 52fb9c08fc [analyzer] Add comments related to symbol_iterator 
llvm-svn: 145987
 2011-12-06 23:12:38 +00:00
Anna Zaks ee1a43533b [analyzer] Refactor: Move symbol_iterator from SVal to SymExpr, use it 
for finding dependent symbols for taint.

llvm-svn: 145986
 2011-12-06 23:12:33 +00:00
Anna Zaks c25efccc8b [analyzer] Propagate taint through NonLoc to NonLoc casts. 
- Created a new SymExpr type - SymbolCast.
 - SymbolCast is created when we don't know how to simplify a NonLoc to
NonLoc casts.
 - A bit of code refactoring: introduced dispatchCast to have better
code reuse, remove a goto.
 - Updated the test case to showcase the new taint flow.

llvm-svn: 145985
 2011-12-06 23:12:27 +00:00
Anna Zaks a636fbe73f [analyzer] Remove all uses of ConstraintManager::canResonAbout() from 
ExprEngine.

Teach SimpleConstraintManager::assumeSymRel() to propagate constraints
to symbolic expressions.

+ One extra warning (real bug) is now generated due to enhanced
assumeSymRel().

llvm-svn: 145832
 2011-12-05 18:58:25 +00:00
Anna Zaks f784d08d25 [analyzer] Add ability to do a simple ProgramState dump() without 
requiring CFG.

Adding more ugly code; the evnvironment printing should be moved to
envirnment at some point.

llvm-svn: 145828
 2011-12-05 18:58:08 +00:00
Anna Zaks 89c00c9d3f [analyzer] Minor tweaks to the ProgramState::isTainted(). 
llvm-svn: 144928
 2011-11-17 22:59:00 +00:00
Anna Zaks ec7dc5c137 [analyzer] Adding basic building blocks for taint propagation. 
TaintTag.h will contain definitions of different taint kinds and their properties.
TaintManager will be responsible for implementing taint specific operations, storing taint.
ProgramState will provide API to add/remove taint.

llvm-svn: 144824
 2011-11-16 19:58:10 +00:00
Anna Zaks 9db35a8750 ST->scanReachableSymbols() is creating a SubRegionMap (SRM) on every call since one SRM is created in each ScanReachableSymbols instance. Creating the object just once and calling only scan inside the loop gives ~ 14% speed up of the StaticAnalyzer run (Release+Asserts). 
Pull out the declaration of the ScanReachableSymbols so that it can be used directly. Document ProgramState::scanReachableSymbols() methods.

llvm-svn: 140323
 2011-09-22 18:10:41 +00:00
Jordy Rose 087611ed81 [analyzer] Remove TransferFuncs.h, then deal with the fallout. 
And with that, TransferFuncs is gone!

llvm-svn: 139003
 2011-09-02 08:02:59 +00:00
Jordy Rose 58a20d31b7 [analyzer] Introduce a new callback for checkers, printState, to be used for debug-printing the contents of a ProgramState. 
Unlike the other callbacks, this one is a simple virtual method, since it is only to be used for debugging.

This new callback replaces the old ProgramState::Printer interface, and allows us to move the printing of refcount bindings from CFRefCount to RetainReleaseChecker.

llvm-svn: 138728
 2011-08-28 19:11:56 +00:00
Jordy Rose 1fad663126 [analyzer] Change the check::RegionChanges callback to include the regions explicitly requested for invalidation. 
Also, allow CallOrObjCMessage to wrap a CXXConstructExpr as well.

Finally, this allows us to remove the clunky whitelisting system from CFRefCount/RetainReleaseChecker. Slight regression due to CXXNewExprs not yet being handled in post-statement callbacks (PR forthcoming).

llvm-svn: 138716
 2011-08-27 22:51:26 +00:00
Ted Kremenek 32b9e234fe Add ProgramState.cpp. 
llvm-svn: 137677
 2011-08-15 23:05:22 +00:00