|
| region_model (region_model_manager *mgr) |
|
| region_model (const region_model &other) |
|
| ~region_model () |
|
region_model & | operator= (const region_model &other) |
|
bool | operator== (const region_model &other) const |
|
bool | operator!= (const region_model &other) const |
|
hashval_t | hash () const |
|
void | print (pretty_printer *pp) const |
|
void | dump_to_pp (pretty_printer *pp, bool simple, bool multiline) const |
|
void | dump (FILE *fp, bool simple, bool multiline) const |
|
void | dump (bool simple) const |
|
void | dump () const |
|
void | debug () const |
|
std::unique_ptr< json::object > | to_json () const |
|
std::unique_ptr< text_art::tree_widget > | make_dump_widget (const text_art::dump_widget_info &dwi) const |
|
void | validate () const |
|
void | canonicalize () |
|
bool | canonicalized_p () const |
|
void | on_stmt_pre (const gimple *stmt, bool *out_unknown_side_effects, region_model_context *ctxt) |
|
void | on_assignment (const gassign *stmt, region_model_context *ctxt) |
|
const svalue * | get_gassign_result (const gassign *assign, region_model_context *ctxt) |
|
void | on_asm_stmt (const gasm *asm_stmt, region_model_context *ctxt) |
|
bool | on_call_pre (const gcall *stmt, region_model_context *ctxt) |
|
void | on_call_post (const gcall *stmt, bool unknown_side_effects, region_model_context *ctxt) |
|
void | purge_state_involving (const svalue *sval, region_model_context *ctxt) |
|
void | impl_deallocation_call (const call_details &cd) |
|
const svalue * | maybe_get_copy_bounds (const region *src_reg, const svalue *num_bytes_sval) |
|
void | update_for_int_cst_return (const call_details &cd, int retval, bool unmergeable) |
|
void | update_for_zero_return (const call_details &cd, bool unmergeable) |
|
void | update_for_nonzero_return (const call_details &cd) |
|
void | handle_unrecognized_call (const gcall *call, region_model_context *ctxt) |
|
void | get_reachable_svalues (svalue_set *out, const svalue *extra_sval, const uncertainty_t *uncertainty) |
|
void | on_return (const greturn *stmt, region_model_context *ctxt) |
|
void | on_setjmp (const gcall *stmt, const exploded_node *enode, region_model_context *ctxt) |
|
void | on_longjmp (const gcall *longjmp_call, const gcall *setjmp_call, int setjmp_stack_depth, region_model_context *ctxt) |
|
void | update_for_phis (const supernode *snode, const cfg_superedge *last_cfg_superedge, region_model_context *ctxt) |
|
void | handle_phi (const gphi *phi, tree lhs, tree rhs, const region_model &old_state, hash_set< const svalue * > &svals_changing_meaning, region_model_context *ctxt) |
|
bool | maybe_update_for_edge (const superedge &edge, const gimple *last_stmt, region_model_context *ctxt, std::unique_ptr< rejected_constraint > *out) |
|
void | update_for_gcall (const gcall *call_stmt, region_model_context *ctxt, function *callee=NULL) |
|
void | update_for_return_gcall (const gcall *call_stmt, region_model_context *ctxt) |
|
const region * | push_frame (const function &fun, const vec< const svalue * > *arg_sids, region_model_context *ctxt) |
|
const frame_region * | get_current_frame () const |
|
const function * | get_current_function () const |
|
void | pop_frame (tree result_lvalue, const svalue **out_result, region_model_context *ctxt, const gcall *call_stmt, bool eval_return_svalue=true) |
|
int | get_stack_depth () const |
|
const frame_region * | get_frame_at_index (int index) const |
|
const region * | get_lvalue (path_var pv, region_model_context *ctxt) const |
|
const region * | get_lvalue (tree expr, region_model_context *ctxt) const |
|
const svalue * | get_rvalue (path_var pv, region_model_context *ctxt) const |
|
const svalue * | get_rvalue (tree expr, region_model_context *ctxt) const |
|
const region * | deref_rvalue (const svalue *ptr_sval, tree ptr_tree, region_model_context *ctxt, bool add_nonnull_constraint=true) const |
|
const svalue * | get_rvalue_for_bits (tree type, const region *reg, const bit_range &bits, region_model_context *ctxt) const |
|
void | set_value (const region *lhs_reg, const svalue *rhs_sval, region_model_context *ctxt) |
|
void | set_value (tree lhs, tree rhs, region_model_context *ctxt) |
|
void | clobber_region (const region *reg) |
|
void | purge_region (const region *reg) |
|
void | fill_region (const region *reg, const svalue *sval, region_model_context *ctxt) |
|
void | zero_fill_region (const region *reg, region_model_context *ctxt) |
|
void | write_bytes (const region *dest_reg, const svalue *num_bytes_sval, const svalue *sval, region_model_context *ctxt) |
|
const svalue * | read_bytes (const region *src_reg, tree src_ptr_expr, const svalue *num_bytes_sval, region_model_context *ctxt) const |
|
void | copy_bytes (const region *dest_reg, const region *src_reg, tree src_ptr_expr, const svalue *num_bytes_sval, region_model_context *ctxt) |
|
void | mark_region_as_unknown (const region *reg, uncertainty_t *uncertainty) |
|
tristate | eval_condition (const svalue *lhs, enum tree_code op, const svalue *rhs) const |
|
tristate | compare_initial_and_pointer (const initial_svalue *init, const region_svalue *ptr) const |
|
tristate | symbolic_greater_than (const binop_svalue *a, const svalue *b) const |
|
tristate | structural_equality (const svalue *a, const svalue *b) const |
|
tristate | eval_condition (tree lhs, enum tree_code op, tree rhs, region_model_context *ctxt) const |
|
bool | add_constraint (tree lhs, enum tree_code op, tree rhs, region_model_context *ctxt) |
|
bool | add_constraint (tree lhs, enum tree_code op, tree rhs, region_model_context *ctxt, std::unique_ptr< rejected_constraint > *out) |
|
const region * | get_or_create_region_for_heap_alloc (const svalue *size_in_bytes, region_model_context *ctxt, bool update_state_machine=false, const call_details *cd=nullptr) |
|
const region * | create_region_for_alloca (const svalue *size_in_bytes, region_model_context *ctxt) |
|
void | get_referenced_base_regions (auto_bitmap &out_ids) const |
|
tree | get_representative_tree (const svalue *sval, logger *logger=nullptr) const |
|
tree | get_representative_tree (const region *reg, logger *logger=nullptr) const |
|
path_var | get_representative_path_var (const svalue *sval, svalue_set *visited, logger *logger) const |
|
path_var | get_representative_path_var (const region *reg, svalue_set *visited, logger *logger) const |
|
constraint_manager * | get_constraints () |
|
store * | get_store () |
|
const store * | get_store () const |
|
const dynamic_extents_t & | get_dynamic_extents () const |
|
const svalue * | get_dynamic_extents (const region *reg) const |
|
void | set_dynamic_extents (const region *reg, const svalue *size_in_bytes, region_model_context *ctxt) |
|
void | unset_dynamic_extents (const region *reg) |
|
region_model_manager * | get_manager () const |
|
bounded_ranges_manager * | get_range_manager () const |
|
void | unbind_region_and_descendents (const region *reg, enum poison_kind pkind) |
|
bool | can_merge_with_p (const region_model &other_model, const program_point &point, region_model *out_model, const extrinsic_state *ext_state=NULL, const program_state *state_a=NULL, const program_state *state_b=NULL) const |
|
tree | get_fndecl_for_call (const gcall *call, region_model_context *ctxt) |
|
void | get_regions_for_current_frame (auto_vec< const decl_region * > *out) const |
|
const svalue * | get_store_value (const region *reg, region_model_context *ctxt) const |
|
const svalue * | get_store_bytes (const region *base_reg, const byte_range &bytes, region_model_context *ctxt) const |
|
const svalue * | scan_for_null_terminator (const region *reg, tree expr, const svalue **out_sval, region_model_context *ctxt) const |
|
const svalue * | scan_for_null_terminator_1 (const region *reg, tree expr, const svalue **out_sval, region_model_context *ctxt) const |
|
bool | region_exists_p (const region *reg) const |
|
void | loop_replay_fixup (const region_model *dst_state) |
|
const svalue * | get_capacity (const region *reg) const |
|
bool | replay_call_summary (call_summary_replay &r, const region_model &summary) |
|
void | maybe_complain_about_infoleak (const region *dst_reg, const svalue *copied_sval, const region *src_reg, region_model_context *ctxt) |
|
void | set_errno (const call_details &cd) |
|
void | mark_as_valid_fd (const svalue *sval, region_model_context *ctxt) |
|
void | on_realloc_with_move (const call_details &cd, const svalue *old_ptr_sval, const svalue *new_ptr_sval) |
|
void | transition_ptr_sval_non_null (region_model_context *ctxt, const svalue *new_ptr_sval) |
|
void | mark_as_tainted (const svalue *sval, region_model_context *ctxt) |
|
bool | add_constraint (const svalue *lhs, enum tree_code op, const svalue *rhs, region_model_context *ctxt) |
|
const svalue * | check_for_poison (const svalue *sval, tree expr, const region *src_region, region_model_context *ctxt) const |
|
void | check_region_for_write (const region *dest_reg, const svalue *sval_hint, region_model_context *ctxt) const |
|
const svalue * | check_for_null_terminated_string_arg (const call_details &cd, unsigned idx) const |
|
const svalue * | check_for_null_terminated_string_arg (const call_details &cd, unsigned idx, bool include_terminator, const svalue **out_sval) const |
|
const builtin_known_function * | get_builtin_kf (const gcall *call, region_model_context *ctxt=NULL) const |
|
bool | called_from_main_p () const |
|
|
const region * | get_lvalue_1 (path_var pv, region_model_context *ctxt) const |
|
const svalue * | get_rvalue_1 (path_var pv, region_model_context *ctxt) const |
|
path_var | get_representative_path_var_1 (const svalue *sval, svalue_set *visited, logger *logger) const |
|
path_var | get_representative_path_var_1 (const region *reg, svalue_set *visited, logger *logger) const |
|
const known_function * | get_known_function (tree fndecl, const call_details &cd) const |
|
const known_function * | get_known_function (enum internal_fn) const |
|
bool | add_constraints_from_binop (const svalue *outer_lhs, enum tree_code outer_op, const svalue *outer_rhs, bool *out, region_model_context *ctxt) |
|
void | update_for_call_superedge (const call_superedge &call_edge, region_model_context *ctxt) |
|
void | update_for_return_superedge (const return_superedge &return_edge, region_model_context *ctxt) |
|
bool | apply_constraints_for_gcond (const cfg_superedge &edge, const gcond *cond_stmt, region_model_context *ctxt, std::unique_ptr< rejected_constraint > *out) |
|
bool | apply_constraints_for_gswitch (const switch_cfg_superedge &edge, const gswitch *switch_stmt, region_model_context *ctxt, std::unique_ptr< rejected_constraint > *out) |
|
bool | apply_constraints_for_ggoto (const cfg_superedge &edge, const ggoto *goto_stmt, region_model_context *ctxt) |
|
bool | apply_constraints_for_exception (const gimple *last_stmt, region_model_context *ctxt, std::unique_ptr< rejected_constraint > *out) |
|
int | poison_any_pointers_to_descendents (const region *reg, enum poison_kind pkind) |
|
void | on_top_level_param (tree param, bool nonnull, region_model_context *ctxt) |
|
const svalue * | get_initial_value_for_global (const region *reg) const |
|
const region * | get_region_for_poisoned_expr (tree expr) const |
|
void | check_dynamic_size_for_taint (enum memory_space mem_space, const svalue *size_in_bytes, region_model_context *ctxt) const |
|
void | check_dynamic_size_for_floats (const svalue *size_in_bytes, region_model_context *ctxt) const |
|
void | check_region_for_taint (const region *reg, enum access_direction dir, region_model_context *ctxt) const |
|
void | check_for_writable_region (const region *dest_reg, region_model_context *ctxt) const |
|
bool | check_region_access (const region *reg, enum access_direction dir, const svalue *sval_hint, region_model_context *ctxt) const |
|
bool | check_region_for_read (const region *src_reg, region_model_context *ctxt) const |
|
void | check_region_size (const region *lhs_reg, const svalue *rhs_sval, region_model_context *ctxt) const |
|
bool | check_symbolic_bounds (const region *base_reg, const svalue *sym_byte_offset, const svalue *num_bytes_sval, const svalue *capacity, enum access_direction dir, const svalue *sval_hint, region_model_context *ctxt) const |
|
bool | check_region_bounds (const region *reg, enum access_direction dir, const svalue *sval_hint, region_model_context *ctxt) const |
|
void | check_call_args (const call_details &cd) const |
|
void | check_call_format_attr (const call_details &cd, tree format_attr) const |
|
void | check_function_attr_access (const gcall *call, tree callee_fndecl, region_model_context *ctxt, rdwr_map &rdwr_idx) const |
|
void | check_function_attr_null_terminated_string_arg (const gcall *call, tree callee_fndecl, region_model_context *ctxt, rdwr_map &rdwr_idx) |
|
void | check_one_function_attr_null_terminated_string_arg (const gcall *call, tree callee_fndecl, region_model_context *ctxt, rdwr_map &rdwr_idx, tree attr) |
|
void | check_function_attrs (const gcall *call, tree callee_fndecl, region_model_context *ctxt) |
|
A region_model encapsulates a representation of the state of memory, with
a tree of regions, along with their associated values.
The representation is graph-like because values can be pointers to
regions.
It also stores:
- a constraint_manager, capturing relationships between the values, and
- dynamic extents, mapping dynamically-allocated regions to svalues (their
capacities).