StaticAnalyzer/Checkers/Taint.cpp

29 void taint::printTaint(ProgramStateRef State, raw_ostream &Out, const char *NL,
31   TaintMapTy TM = State->get<TaintMap>();
40 void dumpTaint(ProgramStateRef State) { printTaint(State, llvm::errs()); }
42 ProgramStateRef taint::addTaint(ProgramStateRef State, const Stmt *S,
45   return addTaint(State, State->getSVal(S, LCtx), Kind);
48 ProgramStateRef taint::addTaint(ProgramStateRef State, SVal V,
52     return addTaint(State, Sym, Kind);
65             State->getStateManager().getStoreManager().getDefaultBinding(
68         return addPartialTaint(State, Sym, LCV->getRegion(), Kind);
73   return addTaint(State, R, Kind);
76 ProgramStateRef taint::addTaint(ProgramStateRef State, const MemRegion *R,
79     return addTaint(State, SR->getSymbol(), Kind);
80   return State;
83 ProgramStateRef taint::addTaint(ProgramStateRef State, SymbolRef Sym,
90   ProgramStateRef NewState = State->set<TaintMap>(Sym, Kind);
95 ProgramStateRef taint::removeTaint(ProgramStateRef State, SVal V) {
98     return removeTaint(State, Sym);
101   return removeTaint(State, R);
104 ProgramStateRef taint::removeTaint(ProgramStateRef State, const MemRegion *R) {
106     return removeTaint(State, SR->getSymbol());
107   return State;
110 ProgramStateRef taint::removeTaint(ProgramStateRef State, SymbolRef Sym) {
116   ProgramStateRef NewState = State->remove<TaintMap>(Sym);
121 ProgramStateRef taint::addPartialTaint(ProgramStateRef State,
126   if (const TaintTagType *T = State->get<TaintMap>(ParentSym))
128       return State;
132     return addTaint(State, ParentSym, Kind);
134   const TaintedSubRegions *SavedRegs = State->get<DerivedSymTaint>(ParentSym);
135   TaintedSubRegions::Factory &F = State->get_context<TaintedSubRegions>();
139   ProgramStateRef NewState = State->set<DerivedSymTaint>(ParentSym, Regs);
144 bool taint::isTainted(ProgramStateRef State, const Stmt *S,
146   SVal val = State->getSVal(S, LCtx);
147   return isTainted(State, val, Kind);
150 bool taint::isTainted(ProgramStateRef State, SVal V, TaintTagType Kind) {
152     return isTainted(State, Sym, Kind);
154     return isTainted(State, Reg, Kind);
158 bool taint::isTainted(ProgramStateRef State, const MemRegion *Reg,
166     return isTainted(State, ER->getSuperRegion(), K) ||
167            isTainted(State, ER->getIndex(), K);
170     return isTainted(State, SR->getSymbol(), K);
173     return isTainted(State, ER->getSuperRegion(), K);
178 bool taint::isTainted(ProgramStateRef State, SymbolRef Sym, TaintTagType Kind) {
189     if (const TaintTagType *Tag = State->get<TaintMap>(*SI)) {
196       if (isTainted(State, SD->getParentSymbol(), Kind))
203               State->get<DerivedSymTaint>(SD->getParentSymbol())) {
218       if (isTainted(State, SRV->getRegion(), Kind))
224       if (isTainted(State, SC->getOperand(), Kind))