Assignment 3 - SVF-tools/Software-Security-Analysis GitHub Wiki
Assignment-3 folder layout
$tree Assignment-3
├── Assignment-3-Helper.cpp
├── Assignment-3.cpp
├── Assignment-3.h
├── CMakeLists.txt
└── Tests
├── CMakeLists.txt
├── ae
│ ├── test1.c
│ ├── test1.ll
│ ├── test2.c
│ ├── test2.ll
│ ├── test3.c
│ ├── test3.ll
│ ├── test4.c
│ ├── test4.ll
│ ├── test5.c
│ ├── test5.ll
│ ├── test6.c
│ └── test6.ll
├── buf
│ ├── test1.c
│ ├── test1.ll
│ ├── test2.c
│ └── test2.ll
└── test-ae.cpp
1. Get the latest code template
cd $HOME/Software-Security-Analysis
and git pull
in your terminal to make sure you always have the latest version of the code template before each assignment.
* Before coding, please type Make sure to switch your program to ass3
before coding.
2. Assignment 3 task
Method | Description |
---|---|
updateStateOnCopy |
Handle COPYStmt |
updateStateOnStore |
Handle StoreStmt |
updateStateOnLoad |
Handle LoadStmt |
updateStateOnGep |
Handle GepStmt |
updateStateOnBinary |
Handle BinaryStmt. |
updateStateOnPhi |
Handle PhiStmt. |
bufOverflowDetection |
Check buffer overflow at GepStmt. |
handleCycleWTO |
Widening and narrowing for loops. |
- Implement the above methods of class
AbstractExecution
inAssignment-3.cpp
- Run
ctest -R ass3 -VV
Pass the test without any assertion bytest-ae.cpp
. - Upload
Assignment-3.cpp
to UNSWWebCMS
for your submission when you are finished with this assignment. Your implementation will be evaluated against X number of our internal tests. If you pass Y tests, you will receive Y/X * 100% marks. Here, we only provided several simple test cases underAssignment-3/Tests/ae
for assertion validation andAssignment-3/Tests/buf
for buffer overflow detection. You are encouraged to add more test cases by yourself to validate the correctness of your implementation.
Assignment-3.cpp
only and there is NO need to modify other files under the Assignment-3 folder
*You will be working on SVF AE API to help with your implementation.
updateState
2.1 Implementing The updateStateOnStore
function should store the RHS value at the memory address corresponding to the LHS value in AEState
which is from calling getAbsStateFromTrace
. Note that the RHS variable can be either IntervalValue
or AddressValue
.
The updateStateOnGep
function aims to compute the virtual address by adding an offset to the base pointer and then store the updated state in LHS value in AEState
which is from calling getAbsStateFromTrace
.
The updateStateOnCopy
function should copy the RHS value to the LHS value in AEState
which is from calling getAbsStateFromTrace
.
The updateStateOnBinary
function should perform the binary operation specified by the BinaryStmt
and store the result in the LHS value in AEState
which is from calling getAbsStateFromTrace
.
The updateStateOnLoad
function should load the value from the memory address corresponding to the RHS value and store it in the LHS value in AEState
which is from calling getAbsStateFromTrace
.
The updateStateOnPhi
function should merge the values from the predecessor blocks and store the merged value in the LHS value in AEState
which is from calling getAbsStateFromTrace
.
handleCycleWTO
2.2 Implementing The handleCycleWTO function needs to include widening and narrowing logic. This will enable the function to handle loop bounds efficiently (e.g., for i = 0; i < 10000; ++i
), allowing it to exit the loop after several iterations and determine the correct value of i.
bufOverflowDetection
2.3 Implementing This function takes an SVFStmt
as input. If the statement is a GepStmt
, it indicates an attempt to access an offset of a pointer or array. An overflow checking is needed to make sure the access offset is smaller than the size of the underlying object.
The provided framework already includes the following steps:
- Identifying if the statement is a
GepStmt
. - Using the
updateGepObjOffsetFromBase
function to update the offsets for the GEP objects.
You need to complete the following tasks:
- Check Object Sizes and Access Offsets: After updating the offsets using
updateGepObjOffsetFromBase
, you need to check if the access offset exceeds the effective byte size of the object. - Report Buffer Overflow: If an access offset is found to exceed the object's size, you should report a buffer overflow.
Specifically, in the bufOverflowDetection
function, you need to:
- Retrieve the base address and size of the object.
- Get the access offset.
- Compare the access offset with the object's size. If the offset exceeds the size, report a buffer overflow.
Ensure you use the provided tools and functions correctly to perform these checks and report any buffer overflows.
It is important to note that a buffer overflow bug may occur during a GepStmt
. For example:
int arr[5];
arr[10] = 1;
A buffer overflow might also occur after multiple GepStmt
s, such as:
int arr[5];
int* ptr = arr + 3;
ptr[4] = 1;
Therefore, each GepStmt
must be checked to ensure that the RHS variable's effective length still supports the current offset. If a bug is detected, invoke reportBufOverflow
to report a bug.
3. Configuration && debugging
launch.json
3.1To enable debugging and running, switch your executable by setting the program
and args
fields as described here or follow the below screenshot.
3.2 Debugging
If you want to see the value of AbstractValue
, you can call toString()
to print the value (either IntervalValue
or AddressValue
).
int main() {
AbstractValue a = IntervalValue(1, 1);
std::cout << a.toString() << std::end;
}