<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">Thanks for the help,</div><div class="">@Artem, I think the taint propagation is necessary for my problem. I want to analyze if an untrust input can somehow affect the control flow of some sensitive function (tainted source determine whether a sensitive function get executed or not). The untrusted input can taint other variables and eventually taint the branch condition expression. It still needs to be path sensitive. For example:</div><div class=""><br class=""></div><div class="">config_from_file = parse_config_file() // taint source</div><div class="">/* the tainted value may infect other variables (should_enc) in some paths*/</div><div class="">if (use_default) {</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>config = default_config // in this path, taint does not flow to condition expr</div><div class="">}</div><div class="">else {</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>config = config_from_file // taint flow to config</div><div class="">}</div><div class="">should_enc = (config.secure_level > 10) // taint flow to should_enc</div><div class="">if (should_enc) { // branch is tainted in one path</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>do_encrypt(data) // the execution of sensitive function is affected by taint source in one path.</div><div class="">}</div><div class="">else { // this block is also tainted if use_default</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>...</div><div class="">} // after exiting the block, everything should be fine.</div><div class="">other_sensitive_func(); // not affected by taint source in both paths</div><div class=""><br class=""></div><div class="">@Kristof, I think ControlDependencyCalculator might do the trick. I do not need to use a stack structure to track the blocks myself. Here's what I might do:</div><div class="">-in checkPreStmt(const CallExpr *CE, CheckerContext &C) , check if the statement is a sensitive function call</div><div class="">-get cfg from C->ExplodedNode()->getCFG, and create cdc = ControlDependencyCalculator(cfg)</div><div class="">-get dependent blocks from cdc->getControlDependencies(C->ExplodedNode()->getCFGBlock())</div><div class="">-for each returned block, check if the condition expr is tainted in current state. </div><div class=""><br class=""></div><div class="">If ControlDependencyCalculator can correctly calculate the dependence, I think the above steps should work. I am not sure if the getLastCondition()s return from dependency blocks overlaps, but it will not affect the result.</div><div class=""><br class=""></div><div class="">Gavin</div><div><br class=""><blockquote type="cite" class=""><div class="">On Sep 20, 2019, at 4:00 PM, Kristóf Umann <<a href="mailto:dkszelethus@gmail.com" class="">dkszelethus@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div dir="ltr" class=""><br class=""></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, 20 Sep 2019 at 21:35, Artem Dergachev <<a href="mailto:noqnoqneo@gmail.com" class="">noqnoqneo@gmail.com</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div bgcolor="#FFFFFF" class="">
@Gavin: I'm worried that you're choosing a wrong strategy here.
Branches with tainted conditions can be used for sanitizing the
input, but it sounds like you want to ban them rather than promote
them. That said, i can't figure out what's the right solution for
you unless i understand the original problem that you're trying to
solve.<br class="">
<br class="">
@Kristof: Do you think you can implement a
checkBeginControlDependentSection / checkEndControlDependentSection
callback pair on top of your control dependency tracking mechanisms,
so that they behaved intuitively and always perfectly paired each
other, even in the more complicated cases like for-loops and Duff's
devices? (there's no indication so far that we really need them -
scope contexts are much more valuable and might actually be helpful
here as well - but i'm kinda curious).<br class=""></div></blockquote><div class=""><br class=""></div><div class="">I guess so. I'm seeing a couple things to keep track of (inlined function calls to name one), but nothing too bad.</div><div class=""><br class=""></div><div class="">It raises (haha) a question about exceptions, if we ever end up supporting them, what happens if an exception is raised? Also, just came to my mind, should any block with a non-<font face="monospace" class="">noexcept</font><font face="arial, sans-serif" class=""> function call have an edge to the exit block if we take exceptions into account?</font></div><div class=""> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div bgcolor="#FFFFFF" class="">
<div class="gmail-m_-4944449558918191960moz-cite-prefix">On 9/20/19 10:46 AM, Kristóf Umann via
cfe-dev wrote:<br class="">
</div>
<blockquote type="cite" class="">
<div dir="ltr" class="">
<div dir="ltr" class="">+ Artem because he knows everything about the
analyzer and symbolic execution, + Balázs because he is
currently working on TaintChecker.
<div class=""><br class="">
</div>
<div class="">My first instinct here would be to combine pathsensitive
analysis with control flow analysis. In the header file <font face="monospace" class="">clang/include/clang/Analysis/Analyses/Dominators.h</font>
you will find the class <font face="monospace" class="">ControlDependencyCalculator</font>.
You could calculate the control dependencies of the block in
which <font face="monospace" class="">sensitive_func() </font>is
called (you can retrieve that through the current <font face="monospace" class="">ExplodedNode</font>) and find that the <font face="monospace" class="">CFGBlock</font> whose <font face="monospace" class="">getLastCondition()</font> is <font face="monospace" class="">value < xxx</font> is in fact a
control dependency. Then, you could, in theory, check
whether parts of this expression is tainted.</div>
<div class=""><br class="">
</div>
<div class="">Artem, do you think this makes any sense?</div>
</div>
<br class="">
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Fri, 20 Sep 2019 at
16:10, Gavin Cui via cfe-dev <<a href="mailto:cfe-dev@lists.llvm.org" target="_blank" class="">cfe-dev@lists.llvm.org</a>>
wrote:<br class="">
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hello all,<br class="">
I want to check if a tainted value can affect the control
flow of some sensitive functions. For example:<br class="">
<br class="">
value = taint_source()<br class="">
if (value < xxx) {<br class="">
sensitive_func()<br class="">
}<br class="">
<br class="">
The taint propagation in clang static analyzer fit part of
my need. One approach I can think of is: <br class="">
Whenever I encounter a branch condition (register
checkBranchCondition() call back), I will push a tag(tainted
or not) to a taintStack variable in ProgramState.<br class="">
After the branch block closed, I will pop one tag. <br class="">
If sensitive_function() get encountered, I will check all
the tags in taintStack to see if any of them is tainted.<br class="">
<br class="">
The problem is I did not find a callback like
checkBranchCondition() which will be called every time
exiting a branch block. Then what should be a good approach
for this control flow checking?<br class="">
<br class="">
Any suggestions would be appreciated.<br class="">
<br class="">
Thank you,<br class="">
Gavin<br class="">
_______________________________________________<br class="">
cfe-dev mailing list<br class="">
<a href="mailto:cfe-dev@lists.llvm.org" target="_blank" class="">cfe-dev@lists.llvm.org</a><br class="">
<a href="https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev" rel="noreferrer" target="_blank" class="">https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev</a><br class="">
</blockquote>
</div>
</div>
<br class="">
<fieldset class="gmail-m_-4944449558918191960mimeAttachmentHeader"></fieldset>
<pre class="gmail-m_-4944449558918191960moz-quote-pre">_______________________________________________
cfe-dev mailing list
<a class="gmail-m_-4944449558918191960moz-txt-link-abbreviated" href="mailto:cfe-dev@lists.llvm.org" target="_blank">cfe-dev@lists.llvm.org</a>
<a class="gmail-m_-4944449558918191960moz-txt-link-freetext" href="https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev" target="_blank">https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-dev</a>
</pre>
</blockquote>
<br class="">
</div>
</blockquote></div></div>
</div></blockquote></div><br class=""></body></html>