SailfishFunctionChecker.h

//
// Created by yongchao on 12/20/22.
//
 
#ifndef CLEARBLUE_YAPSAFUNCTIONCHECKER_H
#define CLEARBLUE_YAPSAFUNCTIONCHECKER_H
 
#include <map>
 
#include "Analysis/Graph/DomTreePass.h"
#include "Checker/PSA/TraceSummary.h"
#include "Checker/PSA/VulnerabilityTrace.h"
#include "Checker/PSA/VulnerabilityTraceBuilder.h"
#include "Checker/Sailfish/SailfishChecker.h"
#include "Checker/Sailfish/SailfishStateBuilder.h"
#include "Checker/Sailfish/SummaryMapper.h"
#include "IR/SEG/SymbolicExprGraphSolver.h"
#include "Utils/Timer.h"
 
using namespace llvm;
 
class SailfishFunctionChecker {
protected:
  SailfishChecker *Parent;
 
  Function *F;
 
  SailfishSummary *Smry;
 
  const DomTree *DT, *PDT;
 
  const SymbolicExprGraph *SEG;
 
  SMTFactory ConstraintFactory;
 
  SailfishStateBuilder *StateBuilder;
 
  Timer *TimeChecker;
 
  std::shared_ptr<Vulnerability> TSV;
 
  std::map<const SEGSiteBase *, std::set<const SEGOperandNode *>> Sources;
 
  ParallelThreadLocal *PTL;
 
public:
  SailfishFunctionChecker(SailfishChecker *P, Function *F);
 
  virtual ~SailfishFunctionChecker();
 
  virtual void run() = 0;
 
  virtual void handleException() {}
 
  virtual void storeSummary(SummaryBase *) = 0;
 
protected:
  void downstreamSearch(const SEGNodeBase *CurrentNode,
                        const SEGNodeBase *PreviousNode,
                        Vulnerability::ValueSitePairType Src,
                        unsigned InlineDepth);
 
  void search(const SEGNodeBase *CurrentNode, const SEGNodeBase *PreviousNode,
              Vulnerability::ValueSitePairType Src, unsigned InlineDepth);
 
  void matchFormalActual(SummaryBase *Smry, const SEGCallSite *CS,
                         std::unordered_map<std::string, SMTExpr> &);
 
  bool inlineReturnSymbolicSummary(const SEGCallSiteOutputNode *Symbol);
  bool inlineReturnSymbolicSummary(Vulnerability::ValueSitePairType Src);
 
  void inlineCalleeSummaryStartWithParam(const SEGCallSite *CS,
                                         TraceSummary *Smry,
                                         Vulnerability::ValueSitePairType Src,
                                         const SEGOperandNode *ActualNode,
                                         unsigned InlineDepth, int Case = 0);
 
  void
  inlineCalleeSummaryEndWithReturn(const SEGCallSite *CS, TraceSummary *Smry,
                                   const SEGCallSiteOutputNode *CallSiteOutput,
                                   Vulnerability::ValueSitePairType Src,
                                   unsigned InlineDepth, int Case = 0);
 
  // Return true, if a trace, having *Src* as source pair (Value and Site), can
  // be reported
  bool canReport(Vulnerability::ValueSitePairType Src) const;
 
  int checkUseSite(
      const SEGOperandNode *Node, const SEGSiteBase *UseSite,
      std::unordered_map<const BasicBlock *, SMTSolver::SMTResultType> &,
      bool UpdateCache);
 
  void processUseSite(Vulnerability::ValueSitePairType Src,
                      const SEGOperandNode *Node, const SEGSiteBase *UseSite,
                      Vulnerability::SiteType USTy, unsigned InlineDepth);
 
  template <class TraceSummaryType>
  TraceSummaryType *
  createTraceSummary(SMTExprVec Constraints,
                     std::shared_ptr<VulnerabilityTrace> Trace,
                     const std::unordered_set<const SEGArgumentNode *> *Inputs,
                     unsigned InlineDepth) {
    TraceSummaryType *Smry = new TraceSummaryType(F, Trace, InlineDepth);
    Smry->setVulnerabilityMask(-1);
    auto NonSymDep = Constraints.toAndExpr();
    Smry->addNonSymDeps(SummaryCacheItem(&NonSymDep, "", 0));
    if (Inputs)
      Smry->setInputs(*Inputs);
 
    return Smry;
  }
 
  void
  collectVarMapping(const std::vector<SummaryCacheItem> &ConstraintsCache,
                    std::string Suffix,
                    std::unordered_map<std::string, SMTExpr> &VariableMapping);
 
  void addCachedConstraintsToSummary(SummaryBase *S);
 
  void tryReport(std::shared_ptr<VulnerabilityTrace> Trace, unsigned Depth);
};
 
#endif // CLEARBLUE_YAPSAFUNCTIONCHECKER_H