Struct cwe_checker_lib::checkers::cwe_337::Context

pub struct Context<'a> { /* private fields */ }

The Context struct for the taint analysis.

Trait Implementations

impl<'a> AsRef<Project> for Context<'a>

fn as_ref(&self) -> &Project

Converts this type into a shared reference of the (usually inferred) input type.

impl<'a> HasCfg<'a> for Context<'a>

fn get_cfg(&self) -> &Graph<'a>

Returns a reference to the control flow graph managed by this type.

impl<'a> HasVsaResult<DataDomain<IntervalDomain>> for Context<'a>

fn vsa_result(&self) -> &impl VsaResult<ValueDomain = PiData>

Converts a reference to Self into a reference to a type that implements VsaResult with ValueDomain T.

impl<'a> TaintAnalysis<'a> for Context<'a>

fn update_call_stub(&self, state: &TaState, call: &Term<Jmp>) -> Option<TaState>

Generate a CWE warning if taint may be contained in the arguments to a sink function.

If this is a call to a sink function and the passed arguments may contain taint we generate a CWE waning and return None to suppress the generation of further warnings. Else we just clear the taint from all non-caller-saved registers.

fn handle_empty_state_out(&self, _tid: &Tid) -> Option<State>

Called when a transition function mapped the input state to the empty state.

fn update_call_generic( &self, state: &State, call_tid: &Tid, calling_convention_hint: &Option<String> ) -> Option<State>

Update taint state on a function call without further target information.

fn update_call( &self, _state: &State, _call: &Term<Jmp>, _target: &CfgNode<'_>, _calling_convention: &Option<String> ) -> Option<State>

Transition function for edges of type Call.

fn update_extern_call( &self, state: &State, _call: &Term<Jmp>, project: &Project, extern_symbol: &ExternSymbol ) -> Option<State>

Transition function for calls to external functions.

fn update_jump( &self, state: &State, jump: &Term<Jmp>, _untaken_conditional: Option<&Term<Jmp>>, _target: &Term<Blk> ) -> Option<State>

Returns the new taint state after a jump.

fn update_return_callee( &self, _state: &State, _call_term: &Term<Jmp>, _return_term: &Term<Jmp>, _calling_convention: &Option<String> ) -> Option<State>

Corresponds to returns from calls to other functions within the program.

fn update_return( &self, state_before_return: Option<&State>, state_before_call: Option<&State>, call_term: &Term<Jmp>, return_term: &Term<Jmp>, calling_convention: &Option<String> ) -> Option<State>

Corresponds to returns from calls to other functions within the program.

fn update_def_assign( &self, state: &State, _tid: &Tid, var: &Variable, value: &Expression ) -> State

Returns the new taint state after an assignment.

fn update_def_load( &self, state: &State, tid: &Tid, var: &Variable, _address: &Expression ) -> State

Returns the new taint state after a load from memory.

fn update_def_store( &self, state: &State, tid: &Tid, _address: &Expression, value: &Expression ) -> State

Returns the new taint state after a store to memory.

fn update_def_post( &self, _old_state: &State, new_state: State, def: &Term<Def> ) -> Option<State>

Returns the new taint state after processing a single Def term.