17 using namespace clang;
19 using namespace taint;
31 TaintMapTy TM = State->get<TaintMap>();
34 Out <<
"Tainted symbols:" << NL;
36 for (
const auto &I : TM)
37 Out << I.first <<
" : " << I.second << NL;
65 if (
auto LCV =
V.getAs<nonloc::LazyCompoundVal>()) {
67 State->getStateManager().getStoreManager()
68 .getDefaultBinding(*LCV)) {
69 if (
SymbolRef Sym = binding->getAsSymbol())
74 const MemRegion *R =
V.getAsRegion();
80 if (
const SymbolicRegion *SR = dyn_cast_or_null<SymbolicRegion>(R))
89 while (
const SymbolCast *SC = dyn_cast<SymbolCast>(Sym))
90 Sym = SC->getOperand();
99 const SubRegion *SubRegion,
107 if (SubRegion == SubRegion->getBaseRegion())
110 const TaintedSubRegions *SavedRegs =
State->get<DerivedSymTaint>(ParentSym);
111 TaintedSubRegions::Factory &F =
State->get_context<TaintedSubRegions>();
112 TaintedSubRegions Regs = SavedRegs ? *SavedRegs : F.getEmptyMap();
114 Regs = F.add(Regs, SubRegion, Kind);
122 SVal val =
State->getSVal(S, LCtx);
127 if (
const SymExpr *Sym =
V.getAsSymExpr())
129 if (
const MemRegion *Reg =
V.getAsRegion())
141 if (
const ElementRegion *ER = dyn_cast<ElementRegion>(Reg))
145 if (
const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(Reg))
148 if (
const SubRegion *ER = dyn_cast<SubRegion>(Reg))
159 for (SymExpr::symbol_iterator SI = Sym->symbol_begin(),
160 SE = Sym->symbol_end(); SI != SE; ++SI) {
161 if (!isa<SymbolData>(*SI))
169 if (
const auto *SD = dyn_cast<SymbolDerived>(*SI)) {
177 if (
const TaintedSubRegions *Regs =
178 State->get<DerivedSymTaint>(SD->getParentSymbol())) {
179 const TypedValueRegion *R = SD->getRegion();
180 for (
auto I : *Regs) {
185 if (Kind == I.second && R->isSubRegionOf(I.first))
192 if (
const auto *SRV = dyn_cast<SymbolRegionValue>(*SI)) {
198 if (
const auto *SC = dyn_cast<SymbolCast>(*SI)) {
207 std::shared_ptr<PathDiagnosticPiece>
226 return std::make_shared<PathDiagnosticEventPiece>(L,
"Taint originated here");
const SymExpr * SymbolRef
Stmt - This represents one statement.
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
const ProgramStateRef & getState() const
std::shared_ptr< PathDiagnosticPiece > VisitNode(const ExplodedNode *N, BugReporterContext &BRC, BugReport &BR) override
const LocationContext * getLocationContext() const
ExplodedNode * getFirstPred()
unsigned TaintTagType
The type of taint, which helps to differentiate between different types of taint. ...
void printTaint(ProgramStateRef State, raw_ostream &Out, const char *nl="\, const char *sep="")
static const Stmt * getStmt(const ExplodedNode *N)
Given an exploded node, retrieve the statement that should be used for the diagnostic location...
LLVM_DUMP_METHOD void dumpTaint(ProgramStateRef State)
static PathDiagnosticLocation createBegin(const Decl *D, const SourceManager &SM)
Create a location for the beginning of the declaration.
#define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value)
Declares an immutable map of type NameTy, suitable for placement into the ProgramState.
bool isTainted(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric)
Check if the statement has a tainted value in the given state.
LLVM_NODISCARD ProgramStateRef addTaint(ProgramStateRef State, const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric)
Create a new state in which the value of the statement is marked as tainted.
FullSourceLoc asLocation() const
Dataflow Directional Tag Classes.
bool isValid() const
Return true if this is a valid SourceLocation object.
LLVM_NODISCARD ProgramStateRef addPartialTaint(ProgramStateRef State, SymbolRef ParentSym, const SubRegion *SubRegion, TaintTagType Kind=TaintTagGeneric)
Create a new state in a which a sub-region of a given symbol is tainted.
REGISTER_MAP_FACTORY_WITH_PROGRAMSTATE(TaintedSubRegions, const SubRegion *, TaintTagType) void taint
This class provides an interface through which checkers can create individual bug reports...
SourceManager & getSourceManager()