Struct cwe_checker_lib::analysis::taint::state::State

pub struct State { /* private fields */ }

The state object of the taint analysis representing all known tainted memory and register values at a certain location within the program.

Implementations

impl State

pub fn new_empty() -> Self

Returns an empty state.

pub fn new_return( taint_source: &ExternSymbol, vsa_result: &impl VsaResult<ValueDomain = PiData>, return_node: NodeIndex ) -> Self

Returns a state where only return values of the extern call are tainted.

pub fn eval(&self, expression: &Expression) -> Taint

Evaluate whether the result of the given expression is tainted in the current state.

pub fn load_taint_from_memory(&self, address: &PiData, size: ByteSize) -> Taint

Returns the taint of the value at the given address (with the given size).

If the address may point to more than one location, then the taint state of all possible locations is merged. Only exact locations are considered, all other locations are treated as untainted.

pub fn save_taint_to_memory(&mut self, address: &PiData, taint: Taint)

Mark the value at the given address with the given taint.

If the address may point to more than one object, we merge the taint into all objects for which the corresponding offset is exact. Since we merge, this will never remove any taint.

If the pointee object and offset are exactly known, we write the taint to the object at the given offset. This may remove taint.

In all other cases we do nothing.

pub fn remove_all_memory_taints(&mut self)

Remove all knowledge about taints contained in memory objects.

pub fn set_register_taint(&mut self, register: &Variable, taint: Taint)

Set the taint of a register.

pub fn get_register_taint(&self, register: &Variable) -> Taint

Returns the taint state of the given register.

pub fn check_mem_id_for_taint(&self, id: &AbstractIdentifier) -> bool

Returns true if the memory object with the given ID contains a tainted value.

pub fn check_if_address_points_to_taint(&self, address: PiData) -> bool

Check if the given address points to tainted memory.

Returns true iff the value at any of the exact memory locations that the pointer may point to is tainted.

pub fn check_generic_function_params_for_taint<const POINTER_TAINT: bool>( &self, vsa_result: &impl VsaResult<ValueDomain = PiData>, call_tid: &Tid, project: &Project, calling_convention_hint: &Option<String> ) -> bool

Check if a generic function call may contain tainted values in its arguments.

If POINTER_TAINT is selected, pointers to tainted memory are considered to be tainted.

Since we don’t know the actual parameters of the call, we approximate the parameters with all parameter registers of the calling convention of the function or of the standard calling convention of the project.

In case no standard calling convention is found. We assume everything may be parameters or referenced by parameters, i.e., we assume the parameters of the call are tainted iff there is taint in the state.

pub fn check_return_values_for_taint<const POINTER_TAINT: bool>( &self, vsa_result: &impl VsaResult<ValueDomain = PiData>, return_tid: &Tid, project: &Project, calling_convention_hint: &Option<String> ) -> bool

Check if the return registers may contain tainted values.

If POINTER_TAINT is selected, pointers to tainted memory are considered to be tainted.

Since we don’t know the actual return registers, we approximate them by all return registers of the calling convention of the function or of the standard calling convention of the project.

If no standard calling convention is found, we assume that everything may be a return value or referenced by return values.

pub fn remove_non_callee_saved_taint( &mut self, calling_conv: &CallingConvention )

Remove the taint from all registers not contained in the callee-saved register list of the given calling convention.

pub fn check_extern_parameters_for_taint<const POINTER_TAINT: bool>( &self, vsa_result: &impl VsaResult<ValueDomain = PiData>, extern_symbol: &ExternSymbol, call_tid: &Tid ) -> bool

Check parameters of a call to an extern symbol for taint.

If POINTER_TAINT is selected, we also return true if a pointer to tainted memory is passed as an argument.

pub fn is_empty(&self) -> bool

Check whether self contains any taint at all.

pub fn has_register_taint(&self) -> bool

Check whether there are any tainted registers in the state.

pub fn has_memory_taint(&self) -> bool

Check whether there is any tainted memory in the state.

pub fn merge_with_renaming( &mut self, other: &Self, renaming_map: Option<&BTreeMap<AbstractIdentifier, PiData>> )

Merges the given other state into this state with renaming of abstract identifiers.

The set of valid abstract identfiers (aIDs) is local to a given function. When merging states across function boundaries it is necessary to map aIDs into the set of valid aIDs in the target context before performing the merging.

This function assumes that the target context is the one of self and that renaming_map specifies how valid aIDs in the context of other correspond to the aIDs of this context.

pub fn into_mem_reg_taint( self ) -> (DomainMap<Variable, Taint, UnionMergeStrategy>, DomainMap<AbstractIdentifier, MemRegion<Taint>, MemoryTaintMergeStrategy>)

Deconstructs a State into its register and memory taint maps.

pub fn from_mem_reg_taint( register_taint: DomainMap<Variable, Taint, UnionMergeStrategy>, memory_taint: DomainMap<AbstractIdentifier, MemRegion<Taint>, MemoryTaintMergeStrategy> ) -> Self

Constructs a State from register and memory taint maps.

impl State

pub fn to_json_compact(&self) -> Value

Get a more compact json-representation of the state. Intended for pretty printing, not useable for serialization/deserialization.

Trait Implementations

impl AbstractDomain for State

fn merge(&self, other: &Self) -> Self

Merge two states.

Any value tainted in at least one input state is also tainted in the merged state.

fn is_top(&self) -> bool

The state has no explicit Top element.

fn merge_with(&mut self, other: &Self) -> &mut Self

Returns an upper bound (with respect to the partial order on the domain) for the two inputs self and other.

impl Clone for State

fn clone(&self) -> State

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for State

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for State

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for State

fn eq(&self, other: &Self) -> bool

Two states are equal if the same values are tainted in both states.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for State

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl ToJsonCompact for State

fn to_json_compact(&self) -> Value

Returns a json representation of values of type self that is suitable for debugging purposes.

fn print_compact_json(&self)

Print values of type Self for debugging purposes.

impl Eq for State

impl StructuralEq for State