clang
17.0.0git
|
Classes | |
class | TaintBugVisitor |
The bug visitor prints a diagnostic message at the location where a given variable was tainted. More... | |
Typedefs | |
using | TaintTagType = unsigned |
The type of taint, which helps to differentiate between different types of taint. More... | |
Functions | |
ProgramStateRef | addTaint (ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric) |
Create a new state in which the value of the statement is marked as tainted. More... | |
ProgramStateRef | addTaint (ProgramStateRef State, SVal V, TaintTagType Kind=TaintTagGeneric) |
Create a new state in which the value is marked as tainted. More... | |
ProgramStateRef | addTaint (ProgramStateRef State, SymbolRef Sym, TaintTagType Kind=TaintTagGeneric) |
Create a new state in which the symbol is marked as tainted. More... | |
ProgramStateRef | addTaint (ProgramStateRef State, const MemRegion *R, TaintTagType Kind=TaintTagGeneric) |
Create a new state in which the pointer represented by the region is marked as tainted. More... | |
ProgramStateRef | removeTaint (ProgramStateRef State, SVal V) |
ProgramStateRef | removeTaint (ProgramStateRef State, const MemRegion *R) |
ProgramStateRef | removeTaint (ProgramStateRef State, SymbolRef Sym) |
ProgramStateRef | addPartialTaint (ProgramStateRef State, SymbolRef ParentSym, const SubRegion *SubRegion, TaintTagType Kind=TaintTagGeneric) |
Create a new state in a which a sub-region of a given symbol is tainted. More... | |
bool | isTainted (ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric) |
Check if the statement has a tainted value in the given state. More... | |
bool | isTainted (ProgramStateRef State, SVal V, TaintTagType Kind=TaintTagGeneric) |
Check if the value is tainted in the given state. More... | |
bool | isTainted (ProgramStateRef State, SymbolRef Sym, TaintTagType Kind=TaintTagGeneric) |
Check if the symbol is tainted in the given state. More... | |
bool | isTainted (ProgramStateRef State, const MemRegion *Reg, TaintTagType Kind=TaintTagGeneric) |
Check if the pointer represented by the region is tainted in the given state. More... | |
void | printTaint (ProgramStateRef State, raw_ostream &Out, const char *nl="\n", const char *sep="") |
LLVM_DUMP_METHOD void | dumpTaint (ProgramStateRef State) |
Variables | |
static constexpr TaintTagType | TaintTagGeneric = 0 |
using clang::ento::taint::TaintTagType = typedef unsigned |
ProgramStateRef clang::ento::taint::addPartialTaint | ( | ProgramStateRef | State, |
SymbolRef | ParentSym, | ||
const SubRegion * | SubRegion, | ||
TaintTagType | Kind = TaintTagGeneric |
||
) |
Create a new state in a which a sub-region of a given symbol is tainted.
This might be necessary when referring to regions that can not have an individual symbol, e.g. if they are represented by the default binding of a LazyCompoundVal.
ProgramStateRef clang::ento::taint::addTaint | ( | ProgramStateRef | State, |
const MemRegion * | R, | ||
TaintTagType | Kind = TaintTagGeneric |
||
) |
Create a new state in which the pointer represented by the region is marked as tainted.
ProgramStateRef clang::ento::taint::addTaint | ( | ProgramStateRef | State, |
const Stmt * | S, | ||
const LocationContext * | LCtx, | ||
TaintTagType | Kind = TaintTagGeneric |
||
) |
Create a new state in which the value of the statement is marked as tainted.
ProgramStateRef clang::ento::taint::addTaint | ( | ProgramStateRef | State, |
SVal | V, | ||
TaintTagType | Kind = TaintTagGeneric |
||
) |
Create a new state in which the value is marked as tainted.
ProgramStateRef clang::ento::taint::addTaint | ( | ProgramStateRef | State, |
SymbolRef | Sym, | ||
TaintTagType | Kind = TaintTagGeneric |
||
) |
Create a new state in which the symbol is marked as tainted.
LLVM_DUMP_METHOD void clang::ento::taint::dumpTaint | ( | ProgramStateRef | State | ) |
bool clang::ento::taint::isTainted | ( | ProgramStateRef | State, |
const MemRegion * | Reg, | ||
TaintTagType | Kind = TaintTagGeneric |
||
) |
Check if the pointer represented by the region is tainted in the given state.
bool clang::ento::taint::isTainted | ( | ProgramStateRef | State, |
const Stmt * | S, | ||
const LocationContext * | LCtx, | ||
TaintTagType | Kind = TaintTagGeneric |
||
) |
Check if the statement has a tainted value in the given state.
Referenced by clang::ento::taint::TaintBugVisitor::VisitNode().
bool clang::ento::taint::isTainted | ( | ProgramStateRef | State, |
SVal | V, | ||
TaintTagType | Kind = TaintTagGeneric |
||
) |
Check if the value is tainted in the given state.
bool clang::ento::taint::isTainted | ( | ProgramStateRef | State, |
SymbolRef | Sym, | ||
TaintTagType | Kind = TaintTagGeneric |
||
) |
Check if the symbol is tainted in the given state.
void clang::ento::taint::printTaint | ( | ProgramStateRef | State, |
raw_ostream & | Out, | ||
const char * | nl = "\n" , |
||
const char * | sep = "" |
||
) |
ProgramStateRef clang::ento::taint::removeTaint | ( | ProgramStateRef | State, |
const MemRegion * | R | ||
) |
ProgramStateRef clang::ento::taint::removeTaint | ( | ProgramStateRef | State, |
SVal | V | ||
) |
ProgramStateRef clang::ento::taint::removeTaint | ( | ProgramStateRef | State, |
SymbolRef | Sym | ||
) |
|
staticconstexpr |