Class TaintTransferFunctions<E extends ISSABasicBlock>

java.lang.Object

org.scandroid.flow.functions.TaintTransferFunctions<E>

All Implemented Interfaces:

IFlowFunctionMap<BasicBlockInContext<E>>

public class TaintTransferFunctions<E extends ISSABasicBlock>
extends Object
implements IFlowFunctionMap<BasicBlockInContext<E>>

Field Summary

Fields

Modifier and Type	Field	Description
static final IntSet	EMPTY_SET
static final IntSet	ZERO_SET

Constructor Summary

Constructors

Constructor	Description
TaintTransferFunctions(IFDSTaintDomain<E> domain, PointerAnalysis<InstanceKey> pa)
TaintTransferFunctions(IFDSTaintDomain<E> domain, PointerAnalysis<InstanceKey> pa, boolean taintStaticFields)

Method Summary

Modifier and Type	Method	Description
IUnaryFlowFunction	getCallFlowFunction(BasicBlockInContext<E> src, BasicBlockInContext<E> dest, BasicBlockInContext<E> ret)
IUnaryFlowFunction	getCallNoneToReturnFlowFunction(BasicBlockInContext<E> src, BasicBlockInContext<E> dest)
IUnaryFlowFunction	getCallToReturnFlowFunction(BasicBlockInContext<E> src, BasicBlockInContext<E> dest)
IUnaryFlowFunction	getNormalFlowFunction(BasicBlockInContext<E> src, BasicBlockInContext<E> dest)
IFlowFunction	getReturnFlowFunction(BasicBlockInContext<E> call, BasicBlockInContext<E> src, BasicBlockInContext<E> dest)	The usual arguments:
IUnaryFlowFunction	makeStaticFieldTaints(BasicBlockInContext<E> dest, SSAInstruction inst, org.scandroid.flow.functions.PairBasedFlowFunction<E> flowFunction)

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

EMPTY_SET

public static final IntSet EMPTY_SET

ZERO_SET

public static final IntSet ZERO_SET

Constructor Details

TaintTransferFunctions

public TaintTransferFunctions(IFDSTaintDomain<E> domain,
 PointerAnalysis<InstanceKey> pa)

TaintTransferFunctions

public TaintTransferFunctions(IFDSTaintDomain<E> domain,
 PointerAnalysis<InstanceKey> pa,
 boolean taintStaticFields)

Method Details

getCallFlowFunction

public IUnaryFlowFunction getCallFlowFunction(BasicBlockInContext<E> src,
 BasicBlockInContext<E> dest,
 BasicBlockInContext<E> ret)

Specified by:

getCallFlowFunction in interface IFlowFunctionMap<E extends ISSABasicBlock>

Parameters:

src - the call block

dest - the entry of the callee

ret - the block that will be returned to, in the caller. This can be null .. signifying that facts can flow into the callee but not return

Returns:

the flow function for a "call" edge in the supergraph from src -> dest

getCallNoneToReturnFlowFunction

public IUnaryFlowFunction getCallNoneToReturnFlowFunction(BasicBlockInContext<E> src,
 BasicBlockInContext<E> dest)

Specified by:

getCallNoneToReturnFlowFunction in interface IFlowFunctionMap<E extends ISSABasicBlock>

Returns:

the flow function for a "call-to-return" edge in the supergraph from src -> dest, when the supergraph does not contain any callees of src. This happens via, e.g., slicing.

getCallToReturnFlowFunction

public IUnaryFlowFunction getCallToReturnFlowFunction(BasicBlockInContext<E> src,
 BasicBlockInContext<E> dest)

Specified by:

getCallToReturnFlowFunction in interface IFlowFunctionMap<E extends ISSABasicBlock>

Returns:

the flow function for a "call-to-return" edge in the supergraph from src -> dest

getNormalFlowFunction

public IUnaryFlowFunction getNormalFlowFunction(BasicBlockInContext<E> src,
 BasicBlockInContext<E> dest)

Specified by:

getNormalFlowFunction in interface IFlowFunctionMap<E extends ISSABasicBlock>

Returns:

the flow function for a "normal" edge in the supergraph from src -> dest

makeStaticFieldTaints

public IUnaryFlowFunction makeStaticFieldTaints(BasicBlockInContext<E> dest,
 SSAInstruction inst,
 org.scandroid.flow.functions.PairBasedFlowFunction<E> flowFunction)

getReturnFlowFunction

public IFlowFunction getReturnFlowFunction(BasicBlockInContext<E> call,
 BasicBlockInContext<E> src,
 BasicBlockInContext<E> dest)

The usual arguments:

call: the invoke instruction that took us into this method

src: a block that's the postdominator of this method, usually with no instructions

dest: whatever instruction followed the invoke instruction in call

What we want to accomplish:

1. Map taints from the value being returned to a LocalElement in the caller's context

2. Pass through any global information that the callee may have changed

3. Process ins/outs of dest block as well (it will never be the dest of a NormalFlowFunction)

Specified by:

getReturnFlowFunction in interface IFlowFunctionMap<E extends ISSABasicBlock>

Parameters:

call - supergraph node of the call instruction for this return edge.

Returns:

the flow function for a "return" edge in the supergraph from src -> dest