32 TaintMapTy TM = State->get<TaintMap>();
35 Out <<
"Tainted symbols:" << NL;
37 for (
const auto &I : TM)
38 Out << I.first <<
" : " << I.second << NL;
48 return addTaint(State, State->getSVal(S, LCtx), Kind);
67 if (std::optional<SVal> binding =
68 State->getStateManager().getStoreManager().getDefaultBinding(
70 if (
SymbolRef Sym = binding->getAsSymbol())
81 if (
const SymbolicRegion *SR = dyn_cast_or_null<SymbolicRegion>(R))
82 return addTaint(State, SR->getSymbol(), Kind);
90 while (
const SymbolCast *SC = dyn_cast<SymbolCast>(Sym))
91 Sym = SC->getOperand();
108 if (
const SymbolicRegion *SR = dyn_cast_or_null<SymbolicRegion>(R))
116 while (
const SymbolCast *SC = dyn_cast<SymbolCast>(Sym))
117 Sym = SC->getOperand();
129 if (
const TaintTagType *T = State->get<TaintMap>(ParentSym))
135 return addTaint(State, ParentSym, Kind);
137 const TaintedSubRegions *SavedRegs = State->get<DerivedSymTaint>(ParentSym);
138 TaintedSubRegions::Factory &F = State->get_context<TaintedSubRegions>();
139 TaintedSubRegions Regs = SavedRegs ? *SavedRegs : F.getEmptyMap();
142 ProgramStateRef NewState = State->set<DerivedSymTaint>(ParentSym, Regs);
197 bool returnFirstOnly) {
198 SVal val = State->getSVal(S, LCtx);
204 bool returnFirstOnly) {
215 bool returnFirstOnly) {
216 std::vector<SymbolRef> TaintedSymbols;
218 return TaintedSymbols;
221 if (
const ElementRegion *ER = dyn_cast<ElementRegion>(Reg)) {
222 std::vector<SymbolRef> TaintedIndex =
224 llvm::append_range(TaintedSymbols, TaintedIndex);
225 if (returnFirstOnly && !TaintedSymbols.empty())
226 return TaintedSymbols;
227 std::vector<SymbolRef> TaintedSuperRegion =
229 llvm::append_range(TaintedSymbols, TaintedSuperRegion);
230 if (returnFirstOnly && !TaintedSymbols.empty())
231 return TaintedSymbols;
235 std::vector<SymbolRef> TaintedRegions =
237 llvm::append_range(TaintedSymbols, TaintedRegions);
238 if (returnFirstOnly && !TaintedSymbols.empty())
239 return TaintedSymbols;
242 if (
const SubRegion *ER = dyn_cast<SubRegion>(Reg)) {
243 std::vector<SymbolRef> TaintedSubRegions =
245 llvm::append_range(TaintedSymbols, TaintedSubRegions);
246 if (returnFirstOnly && !TaintedSymbols.empty())
247 return TaintedSymbols;
250 return TaintedSymbols;
256 bool returnFirstOnly) {
257 std::vector<SymbolRef> TaintedSymbols;
259 return TaintedSymbols;
265 if (!isa<SymbolData>(*SI))
268 if (
const TaintTagType *Tag = State->get<TaintMap>(*SI)) {
270 TaintedSymbols.push_back(*SI);
272 return TaintedSymbols;
276 if (
const auto *SD = dyn_cast<SymbolDerived>(*SI)) {
279 State, SD->getParentSymbol(), Kind, returnFirstOnly);
280 llvm::append_range(TaintedSymbols, TaintedParents);
281 if (returnFirstOnly && !TaintedSymbols.empty())
282 return TaintedSymbols;
287 if (
const TaintedSubRegions *Regs =
288 State->get<DerivedSymTaint>(SD->getParentSymbol())) {
290 for (
auto I : *Regs) {
296 TaintedSymbols.push_back(SD->getParentSymbol());
297 if (returnFirstOnly && !TaintedSymbols.empty())
298 return TaintedSymbols;
305 if (
const auto *SRV = dyn_cast<SymbolRegionValue>(*SI)) {
306 std::vector<SymbolRef> TaintedRegions =
308 llvm::append_range(TaintedSymbols, TaintedRegions);
309 if (returnFirstOnly && !TaintedSymbols.empty())
310 return TaintedSymbols;
314 if (
const auto *SC = dyn_cast<SymbolCast>(*SI)) {
315 std::vector<SymbolRef> TaintedCasts =
317 llvm::append_range(TaintedSymbols, TaintedCasts);
318 if (returnFirstOnly && !TaintedSymbols.empty())
319 return TaintedSymbols;
322 return TaintedSymbols;
#define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value)
Declares an immutable map of type NameTy, suitable for placement into the ProgramState.
#define REGISTER_MAP_FACTORY_WITH_PROGRAMSTATE(Name, Key, Value)
Declares an immutable map type Name and registers the factory for such maps in the program state,...
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Stmt - This represents one statement.
ElementRegion is used to represent both array elements and casts.
MemRegion - The root abstract class for all memory regions.
LLVM_ATTRIBUTE_RETURNS_NONNULL const MemRegion * getBaseRegion() const
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
SubRegion - A region that subsets another larger region.
bool isSubRegionOf(const MemRegion *R) const override
Check if the region is a subregion of the given region.
Iterator over symbols that the current symbol depends on.
static symbol_iterator symbol_end()
symbol_iterator symbol_begin() const
Represents a cast expression.
SymbolicRegion - A special, "non-concrete" region.
TypedValueRegion - An abstract class representing regions having a typed value.
std::vector< SymbolRef > getTaintedSymbolsImpl(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind, bool returnFirstOnly)
ProgramStateRef addTaint(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric)
Create a new state in which the value of the statement is marked as tainted.
std::vector< SymbolRef > getTaintedSymbols(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric)
Returns the tainted Symbols for a given Statement and state.
bool isTainted(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric)
Check if the statement has a tainted value in the given state.
ProgramStateRef removeTaint(ProgramStateRef State, SVal V)
void printTaint(ProgramStateRef State, raw_ostream &Out, const char *nl="\n", const char *sep="")
ProgramStateRef addPartialTaint(ProgramStateRef State, SymbolRef ParentSym, const SubRegion *SubRegion, TaintTagType Kind=TaintTagGeneric)
Create a new state in a which a sub-region of a given symbol is tainted.
LLVM_DUMP_METHOD void dumpTaint(ProgramStateRef State)