Page MenuHomePhabricator

[Analyzer] Add bug visitor for taint checker
ClosedPublic

Authored by vlad.tsyrklevich on Feb 23 2017, 1:28 AM.

Details

Summary

Add a bug visitor to the taint checker to make it easy to distinguish where the tainted value originated. This is especially useful when the original taint source is obscured by complex data flow.

Diff Detail

Repository
rL LLVM

Event Timeline

NoQ edited edge metadata.Feb 23 2017, 1:44 AM

Yay, this is awesome!

It's actually possible to test visitors with the -analyzer-output=text option. This option converts path notes to note: diagnostics, which you can catch with expected-note{{}}, see test/Analysis/inlining/path-notes.c for an example (well, it's also possible to test this with other -analyzer-output variants, but that'd be an overkill).

lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
109 ↗(On Diff #89475)

Could you call this V? Because S is often a statement pointer (so often that you actually shadow this member with a local statement later).

681 ↗(On Diff #89475)

C.getSVal(E)

Promoting the new fancy helper function^^

vlad.tsyrklevich marked 2 inline comments as done.

Fixes and a test for Artem's suggestions.

zaks.anna accepted this revision.Feb 24 2017, 10:07 PM

Looks great!

This revision is now accepted and ready to land.Feb 24 2017, 10:07 PM
This revision was automatically updated to reflect the committed changes.