<div dir="ltr"><p style="margin:0px;font-family:Helvetica">Ted, thanks for your response and help.</p><p style="margin:0px;font-family:Helvetica"><br></p><p style="margin:0px;font-family:Helvetica">Yes, actually the idea is to taint the value of ’s’ itself. The checker would provide propagation rules in order for the user to be able to define which are the functions that get tainted data propagated to other objects (this approach is based on GenericTaintChecker, which is included with the analyzer).</p>
<p style="margin:0px;font-family:Helvetica;min-height:22px"><br></p>
<p style="margin:0px;font-family:Helvetica">I am also interested in tracking the used member variables (or global vars) on method invocation over structs. For example, given a struct like struct X { … } myStruct; and executing myStruct.someMethod(). The checker should go and visit the body of the function, and mark as tainted any uses of member vars of myStruct and also global variables.</p>
<p style="margin:0px;font-family:Helvetica;min-height:22px"><br></p>
<p style="margin:0px;font-family:Helvetica">For now, I am getting the symbolic base of the LazyCompoundVal, and just mark that as tainted as the following piece of code shows.</p>
<p style="margin:0px;font-family:Helvetica;min-height:22px"><br></p>
<p style="margin:0px;font-family:Helvetica"><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_franchiotta_clang_blob_customtaintchecker_lib_StaticAnalyzer_Checkers_CustomTaintChecker.cpp-23L815&d=AwMFaQ&c=8hUWFZcy2Z-Za5rBPlktOQ&r=CnzuN65ENJ1H9py9XLiRvC_UQz6u3oG6GUNn7_wosSM&m=kc7885IBFmbmAOYpM-4Gc8qbx00TTXolDij9KSjtm9I&s=NpDcoYp-8-WYOciYFgaO3AOcOWcvcd1llcdlIEyY3DM&e=">https://github.com/franchiotta/clang/blob/customtaintchecker/lib/StaticAnalyzer/Checkers/CustomTaintChecker.cpp#L815</a></p></div><div class="gmail_extra"><br><div class="gmail_quote">2015-08-03 20:24 GMT-03:00 Ted Kremenek <span dir="ltr"><<a href="mailto:kremenek@apple.com" target="_blank">kremenek@apple.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Thinking about this more about your example…<br>
<br>
void somemethod(string s) {<br>
m(&s);<br>
}<br>
<br>
What specifically is tainted after the the call to ‘m’? The values of ’s’? If we know nothing about ’s’, technically the contents of ’s’ are all invalidated by the analyzer. Thus is makes sense to taint the region ’s’ itself. That said, when a value gets loaded from the tainted ’s’ that also needs to be treated as tainted, thus taint is a derived property. The taint tracking will need to handle not just symbols/region that are explicitly tainted, but taint that is implied because of the relationship to other tainted data.<br>
<br>
For example, in this case if I taint all of ’s’, I expect that any data that I load from it to also be tainted.<br>
<div class="HOEnZb"><div class="h5"><br>
> On Jul 31, 2015, at 10:15 PM, Ted Kremenek <<a href="mailto:kremenek@apple.com">kremenek@apple.com</a>> wrote:<br>
><br>
> LazyCompoundVal is just the value of ’s’, it is not ’s’ itself. After the call to ‘m’, does ’s’ have a new value? What, semantically, are you trying to track as being tainted?<br>
><br>
> Since ’s’ is a struct value, the LazyCompoundVal is just “the struct values of ’s’ when a specific symbolic Store was used”. We use LazyCompoundVals as an important optimization hack over CompoundVals, but they themselves do not have identity. They do, however, wrap things that do have identity. For example, LazyCompoundVal wraps an underlying MemRegion, which is the abstract memory that would have contained the value. In this case, the MemRegion is for the parameter ’s’ itself. Is the idea for ’s’ itself to be tainted? If so, you want to query for that MemRegion, and mark it tainted.<br>
><br>
>> On Jun 9, 2015, at 8:20 PM, Francisco Chiotta <<a href="mailto:franchiotta@gmail.com">franchiotta@gmail.com</a>> wrote:<br>
>><br>
>> Is it possible to mark as tainted a Sval that represents a class or struct?<br>
>><br>
>> For example, take a look at this code:<br>
>><br>
>> void somemethod(string s) {<br>
>> m(&s);<br>
>> }<br>
>><br>
>> I want to taint 's' as soon as it is passed on 'm' method. &s represents a loc, if I try to get the Sval from it, I get a nonloc:LazyCompundVar which doesn't have a symbol associated to make it tainted.<br>
>><br>
>> I'm a little bit confused, could anyone please clarify this?<br>
>> _______________________________________________<br>
>> cfe-dev mailing list<br>
>> <a href="mailto:cfe-dev@cs.uiuc.edu">cfe-dev@cs.uiuc.edu</a><br>
>> <a href="http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev" rel="noreferrer" target="_blank">http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev</a><br>
><br>
<br>
</div></div></blockquote></div><br></div>