|
void | downstreamSearch (const SEGNodeBase *CurrentNode, const SEGNodeBase *PreviousNode, Vulnerability::ValueSitePairType Src, unsigned InlineDepth) |
|
void | search (const SEGNodeBase *CurrentNode, const SEGNodeBase *PreviousNode, Vulnerability::ValueSitePairType Src, unsigned InlineDepth) |
|
void | matchFormalActual (SummaryBase *Smry, const SEGCallSite *CS, std::unordered_map< std::string, SMTExpr > &) |
| Add constraints: "formal == actual".
|
|
bool | inlineReturnSymbolicSummary (const SEGCallSiteOutputNode *Symbol) |
|
bool | inlineReturnSymbolicSummary (Vulnerability::ValueSitePairType Src) |
|
void | inlineCalleeSummaryStartWithParam (const SEGCallSite *CS, TraceSummary *Smry, Vulnerability::ValueSitePairType Src, const SEGOperandNode *ActualNode, unsigned InlineDepth, int Case=0) |
|
void | inlineCalleeSummaryEndWithReturn (const SEGCallSite *CS, TraceSummary *Smry, const SEGCallSiteOutputNode *CallSiteOutput, Vulnerability::ValueSitePairType Src, unsigned InlineDepth, int Case=0) |
|
bool | canReport (Vulnerability::ValueSitePairType Src) const |
|
int | checkUseSite (const SEGOperandNode *Node, const SEGSiteBase *UseSite, std::unordered_map< const BasicBlock *, SMTSolver::SMTResultType > &, bool UpdateCache) |
|
void | processUseSite (Vulnerability::ValueSitePairType Src, const SEGOperandNode *Node, const SEGSiteBase *UseSite, Vulnerability::SiteType USTy, unsigned InlineDepth) |
| It processes use sites according to the type of use sites.
|
|
template<class TraceSummaryType > |
TraceSummaryType * | createTraceSummary (SMTExprVec Constraints, std::shared_ptr< VulnerabilityTrace > Trace, const std::unordered_set< const SEGArgumentNode * > *Inputs, unsigned InlineDepth) |
|
void | collectVarMapping (const std::vector< SummaryCacheItem > &ConstraintsCache, std::string Suffix, std::unordered_map< std::string, SMTExpr > &VariableMapping) |
|
void | addCachedConstraintsToSummary (SummaryBase *S) |
| Add the cached constraints to build summary.
|
|
void | tryReport (std::shared_ptr< VulnerabilityTrace > Trace, unsigned Depth) |
|
SailfishChecker * | Parent |
| the parent checker
|
|
Function * | F |
| current function
|
|
SailfishSummary * | Smry |
| the summary of this function
|
|
const DomTree * | DT |
| dom tree and post-dom tree
|
|
const DomTree * | PDT |
|
const SymbolicExprGraph * | SEG |
| the symbolic expr graph IR
|
|
SMTFactory | ConstraintFactory |
| the factory to create constraints
|
|
SailfishStateBuilder * | StateBuilder |
|
Timer * | TimeChecker |
|
std::shared_ptr< Vulnerability > | TSV |
| The vulnerability instance.
|
|
std::map< const SEGSiteBase *, std::set< const SEGOperandNode * > > | Sources |
| Taint sources.
|
|
ParallelThreadLocal * | PTL |
|