17 using namespace clang;
19 using namespace taint;
31 TaintMapTy TM = State->get<TaintMap>();
34 Out <<
"Tainted symbols:" << NL;
36 for (
const auto &I : TM)
37 Out << I.first <<
" : " << I.second << NL;
63 if (
auto LCV =
V.getAs<nonloc::LazyCompoundVal>()) {
65 State->getStateManager().getStoreManager().getDefaultBinding(
67 if (
SymbolRef Sym = binding->getAsSymbol())
72 const MemRegion *R =
V.getAsRegion();
78 if (
const SymbolicRegion *SR = dyn_cast_or_null<SymbolicRegion>(R))
87 while (
const SymbolCast *SC = dyn_cast<SymbolCast>(Sym))
88 Sym = SC->getOperand();
100 const MemRegion *R = V.getAsRegion();
105 if (
const SymbolicRegion *SR = dyn_cast_or_null<SymbolicRegion>(R))
113 while (
const SymbolCast *SC = dyn_cast<SymbolCast>(Sym))
114 Sym = SC->getOperand();
123 const SubRegion *SubRegion,
131 if (SubRegion == SubRegion->getBaseRegion())
134 const TaintedSubRegions *SavedRegs =
State->get<DerivedSymTaint>(ParentSym);
135 TaintedSubRegions::Factory &F =
State->get_context<TaintedSubRegions>();
136 TaintedSubRegions Regs = SavedRegs ? *SavedRegs : F.getEmptyMap();
138 Regs = F.add(Regs, SubRegion, Kind);
146 SVal val =
State->getSVal(S, LCtx);
151 if (
const SymExpr *Sym =
V.getAsSymExpr())
153 if (
const MemRegion *Reg =
V.getAsRegion())
165 if (
const ElementRegion *ER = dyn_cast<ElementRegion>(Reg))
169 if (
const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(Reg))
172 if (
const SubRegion *ER = dyn_cast<SubRegion>(Reg))
183 for (SymExpr::symbol_iterator SI = Sym->symbol_begin(),
184 SE = Sym->symbol_end();
186 if (!isa<SymbolData>(*SI))
194 if (
const auto *SD = dyn_cast<SymbolDerived>(*SI)) {
202 if (
const TaintedSubRegions *Regs =
203 State->get<DerivedSymTaint>(SD->getParentSymbol())) {
204 const TypedValueRegion *R = SD->getRegion();
205 for (
auto I : *Regs) {
210 if (Kind == I.second && R->isSubRegionOf(I.first))
217 if (
const auto *SRV = dyn_cast<SymbolRegionValue>(*SI)) {
223 if (
const auto *SC = dyn_cast<SymbolCast>(*SI)) {
251 return std::make_shared<PathDiagnosticEventPiece>(L,
"Taint originated here");
const Stmt * getStmtForDiagnostics() const
If the node's program point corresponds to a statement, retrieve that statement.
Stmt - This represents one statement.
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
PathDiagnosticPieceRef VisitNode(const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &BR) override
const ProgramStateRef & getState() const
const SymExpr * SymbolRef
std::shared_ptr< PathDiagnosticPiece > PathDiagnosticPieceRef
const LocationContext * getLocationContext() const
ExplodedNode * getFirstPred()
unsigned TaintTagType
The type of taint, which helps to differentiate between different types of taint. ...
void printTaint(ProgramStateRef State, raw_ostream &Out, const char *nl="\, const char *sep="")
const SourceManager & getSourceManager() const
LLVM_DUMP_METHOD void dumpTaint(ProgramStateRef State)
static PathDiagnosticLocation createBegin(const Decl *D, const SourceManager &SM)
Create a location for the beginning of the declaration.
#define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value)
Declares an immutable map of type NameTy, suitable for placement into the ProgramState.
bool isTainted(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric)
Check if the statement has a tainted value in the given state.
LLVM_NODISCARD ProgramStateRef addTaint(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric)
Create a new state in which the value of the statement is marked as tainted.
FullSourceLoc asLocation() const
Dataflow Directional Tag Classes.
bool isValid() const
Return true if this is a valid SourceLocation object.
LLVM_NODISCARD ProgramStateRef addPartialTaint(ProgramStateRef State, SymbolRef ParentSym, const SubRegion *SubRegion, TaintTagType Kind=TaintTagGeneric)
Create a new state in a which a sub-region of a given symbol is tainted.
REGISTER_MAP_FACTORY_WITH_PROGRAMSTATE(TaintedSubRegions, const SubRegion *, TaintTagType) void taint
LLVM_NODISCARD ProgramStateRef removeTaint(ProgramStateRef State, SVal V)