Skip to content

Commit 6a0cfdf

Browse files
authored
Merge pull request #83 from thientc/main
Add result to README resolve #82
2 parents a501649 + 2533b7a commit 6a0cfdf

File tree

15 files changed

+294
-51
lines changed

15 files changed

+294
-51
lines changed

README.md

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
- [4. Авторы](#4-авторы)
88
- [5. Статьи и материалы](#5-статьи-и-материалы)
99
- [6. Найденные ошибки](#6-найденные-ошибки)
10+
- [7. Результаты](#7-результаты)
1011

1112
# 1. Описание
1213

@@ -211,4 +212,15 @@ context_generator.compile_targets( #компиляция сгенерирова
211212
| libpng | 1.6.37 | png_convert_from_time_t | AddressSanitizer:DEADLYSIGNAL | [Feb 8, 2021](https://github.com/glennrp/libpng/issues/362) | Sep 13, 2022 |
212213
| tinyxml2 | 9.0.0 | ErrorIDToName | AddressSanitizer: global-buffer-overflow | [Nov 2, 2022](https://github.com/leethomason/tinyxml2/issues/923) | Nov 12, 2022 |
213214
| pugixml | 1.13 | default_allocate | AddressSanitizer: allocation-size-too-big | [Apr 11, 2023](https://github.com/zeux/pugixml/issues/560) | Apr 15, 2023 |
214-
| | | | | | |
215+
| | | | | | |
216+
217+
## 7. Результаты
218+
219+
| **Библиотека** | **Время генерации** | **Кол-во фаззинг-оберток** | **Время компиляции** | **Кол-во строк кода** |
220+
|:---:|---:|:---:|:---:|:---:|
221+
| lib json-c | 180 | **3111** | 612 | 280.019 |
222+
| libpostgres | 105 | **749** | 29 | 84.387 |
223+
| curl | 4.210 | **152** | 21 | 9.617 |
224+
| openssl | 2.172 | **269** | 255 | 19.458 |
225+
| pugixml | 55 | **61** | 58 | 2.815 |
226+
| libopus | 75 | **422** | 7 | 12.606 |

src/Checkers/include/Checkers.td

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -240,6 +240,7 @@ def NonnullGlobalConstantsChecker: Checker<"NonnilStringConstants">,
240240
//===----------------------------------------------------------------------===//
241241
let ParentPackage = Futag in {
242242

243+
243244
def FutagAnalyzer : Checker<"FutagAnalyzer">,
244245
HelpText<"Futag Checker for finding potential fuzzing functions.">,
245246
CheckerOptions<[
@@ -251,6 +252,10 @@ let ParentPackage = Futag in {
251252
]>,
252253
Documentation<NotDocumented>;
253254

255+
def FutagSimpleChecker : Checker<"FutagSimpleChecker">,
256+
HelpText<"Futag Simple Checker for traversing nodes in AST.">,
257+
Documentation<NotDocumented>;
258+
254259
def FutagConsumerAnalyzer : Checker<"FutagConsumerAnalyzer">,
255260
HelpText<"Futag Checker for finding potential fuzzing functions. Use scan-build for viewing result and generating list of needed function">,
256261
CheckerOptions<[

src/Checkers/include/Checkers13.td

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -237,6 +237,10 @@ def NonnullGlobalConstantsChecker: Checker<"NonnilStringConstants">,
237237
//===----------------------------------------------------------------------===//
238238
let ParentPackage = Futag in {
239239

240+
def SimpleChecker : Checker<"FutagSimpleChecker">,
241+
HelpText<"Futag Simple Checker for traversing nodes in AST.">,
242+
Documentation<NotDocumented>;
243+
240244
def FutagAnalyzer : Checker<"FutagAnalyzer">,
241245
HelpText<"Futag Checker for finding potential fuzzing functions. Use scan-build for viewing result and generating list of needed function">,
242246
CheckerOptions<[

src/Checkers/lib/CMakeLists.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ add_clang_library(clangStaticAnalyzerCheckers
4646
FutagAnalyzer.cpp
4747
FutagConsumerAnalyzer.cpp
4848
FutagCatchInfo.cpp
49+
FutagSimpleChecker.cpp
4950
GCDAntipatternChecker.cpp
5051
GenericTaintChecker.cpp
5152
GTestChecker.cpp

src/Checkers/lib/CMakeLists13.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ add_clang_library(clangStaticAnalyzerCheckers
4646
FutagAnalyzer.cpp
4747
FutagConsumerAnalyzer.cpp
4848
FutagCatchInfo.cpp
49+
FutagSimpleChecker.cpp
4950
GCDAntipatternChecker.cpp
5051
GenericTaintChecker.cpp
5152
GTestChecker.cpp

src/Checkers/lib/FutagAnalyzer.cpp

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
* @file FutagAnalyzer.cpp
33
* @author Tran Chi Thien (thientcgithub@gmail.com)
44
* @brief
5-
* @version 2.0.5
6-
* @date 2023-04-17
5+
* @version 2.1.0
6+
* @date 2023-08-30
77
*
88
* @copyright Copyright (c) 2023
99
*
@@ -286,7 +286,7 @@ void FutagAnalyzer::CollectBasicFunctionInfo(
286286
}
287287
// We may have already collected information about xrefs, but other fields
288288
// should not exist
289-
if(!curr_json_context[curr_func_hash].contains("fuzz_it")){
289+
if(!curr_json_context[curr_func_hash].contains("fuzz_it")){
290290
curr_json_context[curr_func_hash].update(basic_function_info);
291291
}
292292

@@ -371,7 +371,7 @@ void FutagAnalyzer::checkASTDecl(const TranslationUnitDecl *TUD,
371371
// Save all relevant includes
372372
const SourceManager &sm = Mgr.getASTContext().getSourceManager();
373373
if (!sm.getMainFileID().isValid()) {
374-
return;
374+
return;
375375
}
376376
for (auto it = sm.fileinfo_begin(); it != sm.fileinfo_end(); it++) {
377377

@@ -380,8 +380,6 @@ void FutagAnalyzer::checkASTDecl(const TranslationUnitDecl *TUD,
380380
string include_path =
381381
utils::PathProcessor::RemoveUnnecessaryPathComponents(
382382
it->first->getName().str());
383-
// include_path[0] != '/' - is probably an awfully bad check to avoid
384-
// system headers, but I couldn't find any way around
385383
if (includeLoc.isValid() && sm.isInMainFile(includeLoc)) {
386384
mIncludesInfo["includes"].push_back(include_path);
387385
}
@@ -448,13 +446,13 @@ void FutagAnalyzer::VisitFunction(const FunctionDecl *func,
448446
if (!func->hasBody() || !func->isThisDeclarationADefinition()) {
449447
return;
450448
}
451-
449+
452450
FullSourceLoc func_begin_loc =
453451
Mgr.getASTContext().getFullLoc(func->getBeginLoc());
454452
FullSourceLoc func_end_loc =
455453
Mgr.getASTContext().getFullLoc(func->getEndLoc());
456454
if (!func_begin_loc.getFileEntry()) {
457-
return;
455+
return;
458456
}
459457
int32_t curr_func_begin_loc = func_begin_loc.getSpellingLineNumber();
460458
auto fe = func_begin_loc.getFileEntry();
@@ -470,7 +468,7 @@ void FutagAnalyzer::VisitFunction(const FunctionDecl *func,
470468
} else {
471469
file_name = fe->tryGetRealPathName().str();
472470
}
473-
futag::FunctionType function_type = futag::_FUNC_UNKNOW_RECORD;
471+
futag::FunctionType function_type = futag::_FUNC_UNKNOW_RECORD;
474472
if (isa<CXXMethodDecl>(func)) {
475473
auto method_decl = dyn_cast<CXXMethodDecl>(func);
476474
function_type = futag::_FUNC_CXXMETHOD;
@@ -503,7 +501,7 @@ void FutagAnalyzer::VisitFunction(const FunctionDecl *func,
503501
// Collect basic information about current function
504502
CollectBasicFunctionInfo(m_func_decl_info, func, Mgr, curr_func_begin_loc,
505503
file_name, function_type, parent_hash);
506-
CollectAdvancedFunctionInfo(m_call_context_info, func, Mgr, file_name);
504+
CollectAdvancedFunctionInfo(m_call_context_info, func, Mgr, file_name);
507505
return;
508506
}
509507

Lines changed: 225 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
/**
2+
* @file FutagSimpleChecker.cpp
3+
* @author Tran Chi Thien (thientcgithub@gmail.com)
4+
* @brief
5+
* @version 2.0.5
6+
* @date 2023-04-17
7+
*
8+
* @copyright Copyright (c) 2023
9+
*
10+
*/
11+
12+
#include <algorithm>
13+
#include <fstream>
14+
#include <iomanip>
15+
#include <iostream>
16+
#include <sstream>
17+
#include <string>
18+
#include <thread>
19+
#include <utility>
20+
#include <vector>
21+
22+
#include "Futag/MatchFinder.h"
23+
#include "nlohmann/json.hpp"
24+
#include "clang/AST/Decl.h"
25+
#include "clang/AST/ODRHash.h"
26+
#include "clang/AST/RecursiveASTVisitor.h"
27+
#include "clang/AST/Type.h"
28+
#include "clang/ASTMatchers/ASTMatchFinder.h"
29+
#include "clang/ASTMatchers/ASTMatchers.h"
30+
#include "clang/Analysis/AnalysisDeclContext.h"
31+
#include "clang/Analysis/CFG.h"
32+
#include "clang/Basic/SourceManager.h"
33+
#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
34+
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
35+
#include "clang/StaticAnalyzer/Core/Checker.h"
36+
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
37+
#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
38+
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
39+
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
40+
#include "clang/Tooling/Tooling.h"
41+
#include "llvm/ADT/SmallVector.h"
42+
#include "llvm/ADT/StringRef.h"
43+
#include "llvm/Support/ErrorHandling.h"
44+
#include "llvm/Support/FileSystem.h"
45+
#include "llvm/Support/Path.h"
46+
47+
#include "llvm/Support/raw_ostream.h"
48+
49+
#include "Futag/Basic.h"
50+
#include "Futag/Utils.h"
51+
52+
using namespace llvm;
53+
using namespace clang;
54+
using namespace ento;
55+
using namespace nlohmann;
56+
using namespace futag;
57+
58+
//===----------------------------------------------------------------------===//
59+
// Checker to analyze function declarations
60+
//===----------------------------------------------------------------------===//
61+
namespace {
62+
63+
class FutagMatchFuncDeclCallBack : public MatchFinder::MatchCallback {
64+
public:
65+
FutagMatchFuncDeclCallBack( AnalysisManager &Mgr)
66+
: Mgr{Mgr} {}
67+
AnalysisManager &Mgr; // For passing the AnalysisManager
68+
virtual void run(const MatchFinder::MatchResult &Result);
69+
};
70+
71+
class FutagSimpleChecker : public Checker<check::ASTDecl<TranslationUnitDecl>> {
72+
73+
public:
74+
// Entry point. Collects all needed information using recursive ast visitor
75+
void checkASTDecl(const TranslationUnitDecl *TUD, AnalysisManager &Mgr,
76+
BugReporter &BR) const;
77+
78+
/* Collects information about function */
79+
void VisitFunction(const FunctionDecl *func, AnalysisManager &Mgr) const;
80+
/* Collects information about struct declarations*/
81+
void VisitRecord(const RecordDecl *func, AnalysisManager &Mgr) const;
82+
/* Collects information about typedefs */
83+
void VisitTypedef(const TypedefDecl *func, AnalysisManager &Mgr) const;
84+
/* Collects information about enums */
85+
void VisitEnum(const EnumDecl *func, AnalysisManager &Mgr) const;
86+
};
87+
88+
} // namespace
89+
90+
void FutagMatchFuncDeclCallBack::run(const MatchFinder::MatchResult &Result) {
91+
const auto *func_decl = Result.Nodes.getNodeAs<FunctionDecl>("functionDe");
92+
93+
if (!func_decl) {
94+
return;
95+
}
96+
llvm::outs()<< "\n-- Found function declaration: \"" << func_decl->getDeclName().getAsString() << " ";
97+
// If the available function is defined in system header file, then skip.
98+
99+
FullSourceLoc func_begin_loc =
100+
Mgr.getASTContext().getFullLoc(func_decl->getBeginLoc());
101+
int32_t curr_func_begin_loc = func_begin_loc.getSpellingLineNumber();
102+
auto fe = func_begin_loc.getFileEntry();
103+
std::string file_name;
104+
std::string parent_hash = "";
105+
106+
if (fe->tryGetRealPathName().empty()) {
107+
if (fe->getName().empty()) {
108+
std::cerr << " -- Debug info: Cannot find filename and filepath!\n";
109+
} else {
110+
file_name = fe->getName().str();
111+
}
112+
} else {
113+
file_name = fe->tryGetRealPathName().str();
114+
}
115+
llvm::outs()<< " in file \""<< file_name << "\" \n\n";
116+
return;
117+
}
118+
void FutagSimpleChecker::checkASTDecl(const TranslationUnitDecl *TUD,
119+
AnalysisManager &Mgr, BugReporter &BR) const {
120+
121+
struct LocalVisitor : public RecursiveASTVisitor<LocalVisitor> {
122+
const FutagSimpleChecker *futag_checker;
123+
AnalysisManager &analysisMgr;
124+
125+
explicit LocalVisitor(const FutagSimpleChecker *Checker,
126+
AnalysisManager &AnalysisMgr)
127+
: futag_checker(Checker), analysisMgr(AnalysisMgr) {}
128+
129+
/* callback when a function declaration is encountered */
130+
bool VisitFunctionDecl(FunctionDecl *FD) {
131+
futag_checker->VisitFunction(FD, analysisMgr);
132+
return true;
133+
}
134+
135+
/* callback when a struct declaration is encountered */
136+
bool VisitRecordDecl(RecordDecl *RD) {
137+
futag_checker->VisitRecord(RD, analysisMgr);
138+
return true;
139+
}
140+
141+
/* callback when a typedef declaration is encountered */
142+
bool VisitTypedefDecl(TypedefDecl *TD) {
143+
futag_checker->VisitTypedef(TD, analysisMgr);
144+
return true;
145+
}
146+
147+
/* callback when a enum declaration is encountered */
148+
bool VisitEnumDecl(EnumDecl *ED) {
149+
futag_checker->VisitEnum(ED, analysisMgr);
150+
return true;
151+
}
152+
};
153+
154+
LocalVisitor visitor(this, Mgr);
155+
visitor.TraverseDecl(const_cast<TranslationUnitDecl *>(TUD));
156+
}
157+
158+
// Called for every function declaration
159+
void FutagSimpleChecker::VisitFunction(const FunctionDecl *func,
160+
AnalysisManager &Mgr) const {
161+
llvm::outs()<< "-- Analyzing function: \"" << func->getDeclName().getAsString() << "\"\n";
162+
// If the available function is defined in system header file, then skip.
163+
if (Mgr.getSourceManager().isInSystemHeader(func->getBeginLoc())) {
164+
llvm::outs()<< " } \""<< func->getDeclName().getAsString() << "\" is in system headers!\n";
165+
return;
166+
}
167+
168+
169+
FullSourceLoc func_begin_loc =
170+
Mgr.getASTContext().getFullLoc(func->getBeginLoc());
171+
FullSourceLoc func_end_loc =
172+
Mgr.getASTContext().getFullLoc(func->getEndLoc());
173+
if (!func_begin_loc.getFileEntry()) {
174+
return;
175+
}
176+
int32_t curr_func_begin_loc = func_begin_loc.getSpellingLineNumber();
177+
auto fe = func_begin_loc.getFileEntry();
178+
std::string file_name;
179+
std::string parent_hash = "";
180+
181+
if (fe->tryGetRealPathName().empty()) {
182+
if (fe->getName().empty()) {
183+
std::cerr << " -- Debug info: Cannot find filename and filepath!\n";
184+
} else {
185+
file_name = fe->getName().str();
186+
}
187+
} else {
188+
file_name = fe->tryGetRealPathName().str();
189+
}
190+
llvm::outs()<< " in file \""<< file_name << "\" \n";
191+
192+
MatchFinder Finder;
193+
// Match all CallExpression of target function
194+
auto match_callexpr =
195+
functionDecl(hasName(func->getDeclName().getAsString()))
196+
.bind("functionDe");
197+
198+
FutagMatchFuncDeclCallBack target_func_call_callback{ Mgr};;
199+
Finder.addMatcher(match_callexpr, &target_func_call_callback);
200+
Finder.matchAST(Mgr.getASTContext());
201+
202+
return;
203+
}
204+
205+
void FutagSimpleChecker::VisitRecord(const RecordDecl *RD,
206+
AnalysisManager &Mgr) const {
207+
208+
return;
209+
}
210+
void FutagSimpleChecker::VisitTypedef(const TypedefDecl *TD,
211+
AnalysisManager &Mgr) const {
212+
return;
213+
}
214+
215+
void FutagSimpleChecker::VisitEnum(const EnumDecl *ED, AnalysisManager &Mgr) const {
216+
return;
217+
}
218+
219+
void ento::registerFutagSimpleChecker(CheckerManager &Mgr) {
220+
Mgr.registerChecker<FutagSimpleChecker>();
221+
}
222+
223+
bool ento::shouldRegisterFutagSimpleChecker(const CheckerManager &mgr) {
224+
return true;
225+
}

src/python/futag-package/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ This python package is for building library, generating and compiling fuzz-drive
2020
## 1. Install
2121

2222
```bash
23-
pip install dist/futag-2.0.5.tar.gz
23+
pip install dist/futag-2.1.0.tar.gz
2424
```
2525

2626
## 2. Preprocessor
78.6 KB
Binary file not shown.
78.7 KB
Binary file not shown.

0 commit comments

Comments
 (0)