32 TaintMapTy TM = State->get<TaintMap>();
35 Out <<
"Tainted symbols:" << NL;
37 for (
const auto &I : TM)
38 Out << I.first <<
" : " << I.second << NL;
48 return addTaint(State, State->getSVal(S, LCtx), Kind);
67 if (std::optional<SVal> binding =
68 State->getStateManager().getStoreManager().getDefaultBinding(
70 if (
SymbolRef Sym = binding->getAsSymbol())
81 if (
const SymbolicRegion *SR = dyn_cast_or_null<SymbolicRegion>(R))
82 return addTaint(State, SR->getSymbol(), Kind);
90 while (
const SymbolCast *SC = dyn_cast<SymbolCast>(Sym))
91 Sym = SC->getOperand();
108 if (
const SymbolicRegion *SR = dyn_cast_or_null<SymbolicRegion>(R))
116 while (
const SymbolCast *SC = dyn_cast<SymbolCast>(Sym))
117 Sym = SC->getOperand();
129 if (
const TaintTagType *T = State->get<TaintMap>(ParentSym))
135 return addTaint(State, ParentSym, Kind);
137 const TaintedSubRegions *SavedRegs = State->get<DerivedSymTaint>(ParentSym);
138 TaintedSubRegions::Factory &F = State->get_context<TaintedSubRegions>();
139 TaintedSubRegions Regs = SavedRegs ? *SavedRegs : F.getEmptyMap();
142 ProgramStateRef NewState = State->set<DerivedSymTaint>(ParentSym, Regs);
197 bool returnFirstOnly) {
198 SVal val = State->getSVal(S, LCtx);
204 bool returnFirstOnly) {
215 bool returnFirstOnly) {
216 std::vector<SymbolRef> TaintedSymbols;
218 return TaintedSymbols;
221 if (
const ElementRegion *ER = dyn_cast<ElementRegion>(Reg)) {
222 std::vector<SymbolRef> TaintedIndex =
224 llvm::append_range(TaintedSymbols, TaintedIndex);
225 if (returnFirstOnly && !TaintedSymbols.empty())
226 return TaintedSymbols;
227 std::vector<SymbolRef> TaintedSuperRegion =
229 llvm::append_range(TaintedSymbols, TaintedSuperRegion);
230 if (returnFirstOnly && !TaintedSymbols.empty())
231 return TaintedSymbols;
235 std::vector<SymbolRef> TaintedRegions =
237 llvm::append_range(TaintedSymbols, TaintedRegions);
238 if (returnFirstOnly && !TaintedSymbols.empty())
239 return TaintedSymbols;
242 if (
const SubRegion *ER = dyn_cast<SubRegion>(Reg)) {
243 std::vector<SymbolRef> TaintedSubRegions =
245 llvm::append_range(TaintedSymbols, TaintedSubRegions);
246 if (returnFirstOnly && !TaintedSymbols.empty())
247 return TaintedSymbols;
250 return TaintedSymbols;
256 bool returnFirstOnly) {
257 std::vector<SymbolRef> TaintedSymbols;
259 return TaintedSymbols;
263 if (!isa<SymbolData>(SubSym))
266 if (
const TaintTagType *Tag = State->get<TaintMap>(SubSym)) {
268 TaintedSymbols.push_back(SubSym);
270 return TaintedSymbols;
274 if (
const auto *SD = dyn_cast<SymbolDerived>(SubSym)) {
277 State, SD->getParentSymbol(), Kind, returnFirstOnly);
278 llvm::append_range(TaintedSymbols, TaintedParents);
279 if (returnFirstOnly && !TaintedSymbols.empty())
280 return TaintedSymbols;
285 if (
const TaintedSubRegions *Regs =
286 State->get<DerivedSymTaint>(SD->getParentSymbol())) {
288 for (
auto I : *Regs) {
294 TaintedSymbols.push_back(SD->getParentSymbol());
295 if (returnFirstOnly && !TaintedSymbols.empty())
296 return TaintedSymbols;
303 if (
const auto *SRV = dyn_cast<SymbolRegionValue>(SubSym)) {
304 std::vector<SymbolRef> TaintedRegions =
306 llvm::append_range(TaintedSymbols, TaintedRegions);
307 if (returnFirstOnly && !TaintedSymbols.empty())
308 return TaintedSymbols;
312 if (
const auto *SC = dyn_cast<SymbolCast>(SubSym)) {
313 std::vector<SymbolRef> TaintedCasts =
315 llvm::append_range(TaintedSymbols, TaintedCasts);
316 if (returnFirstOnly && !TaintedSymbols.empty())
317 return TaintedSymbols;
320 return TaintedSymbols;
#define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value)
Declares an immutable map of type NameTy, suitable for placement into the ProgramState.
#define REGISTER_MAP_FACTORY_WITH_PROGRAMSTATE(Name, Key, Value)
Declares an immutable map type Name and registers the factory for such maps in the program state,...
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Stmt - This represents one statement.
ElementRegion is used to represent both array elements and casts.
MemRegion - The root abstract class for all memory regions.
LLVM_ATTRIBUTE_RETURNS_NONNULL const MemRegion * getBaseRegion() const
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
SubRegion - A region that subsets another larger region.
bool isSubRegionOf(const MemRegion *R) const override
Check if the region is a subregion of the given region.
llvm::iterator_range< symbol_iterator > symbols() const
Represents a cast expression.
SymbolicRegion - A special, "non-concrete" region.
TypedValueRegion - An abstract class representing regions having a typed value.
std::vector< SymbolRef > getTaintedSymbolsImpl(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind, bool returnFirstOnly)
ProgramStateRef addTaint(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric)
Create a new state in which the value of the statement is marked as tainted.
std::vector< SymbolRef > getTaintedSymbols(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric)
Returns the tainted Symbols for a given Statement and state.
bool isTainted(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric)
Check if the statement has a tainted value in the given state.
ProgramStateRef removeTaint(ProgramStateRef State, SVal V)
void printTaint(ProgramStateRef State, raw_ostream &Out, const char *nl="\n", const char *sep="")
ProgramStateRef addPartialTaint(ProgramStateRef State, SymbolRef ParentSym, const SubRegion *SubRegion, TaintTagType Kind=TaintTagGeneric)
Create a new state in a which a sub-region of a given symbol is tainted.
LLVM_DUMP_METHOD void dumpTaint(ProgramStateRef State)