Handling inttoptr in SVFIR

[karthikbhata97]

Hi,
Thanks for building this valuable tool.

I am interested in how a pointer and the value referenced by it flows through a program. So I am using a SVFIR to track Load/Store/Copy of a pointer. Here is the program I am analyzing

#include <cstdint>

struct Test {
    int a;
    char b;
};

void test(uint64_t ptr) {
    auto t = (Test *)ptr; // 2
    auto x = t->a;
}

int main() {
    auto t = new Test;

    test((uint64_t)t); // 1

    return 0;
}

I am analyzing the arguments to test function, and trying to log all the load instructions on the pointer passed to test. I am using PAG/SVFIR to walk through the graph. It works well, when pointer is passed.

Here the pointer is passed as an integer with ptrtoint (at 1), which is then type casted with inttoptr (at 2). And PAG has no links between them. (2) is treated as coming from a null.

• Is there any specific reason to mark the source as null?
  • Is it okay to create a copy edge between the node 37 -> 38 (in the image above).
  • Ref:

    SVF/svf-llvm/lib/SVFIRBuilder.cpp

    Line 397 in dda7fe5

    // if we meet a int2ptr, then it points-to black hole

• Also, am I using the right method to track the "pointer flows and dereferences"?

Thanks again for building and maintaining SVF!

[yuleisui]

This is a very good question. Previously, we treat int2ptr as sourcing from null or blackhole due to pointer analysis, which does not support analysing values across integers and pointers.

It looks to me that a COPY PAG edge is not a good option for the casting. We may need to define a special edge on PAG to maintain int2ptr if we would like it to be reflected on the graph.

[karthikbhata97]

I see. Do you also recommend to change the edge type for the ptrtoint as well (currently a copy edge)?

Let me know your thoughts on the design/implementation for this change. I can try to take a shot at it.

[yuleisui]

The int2ptr has been added to PAG and this is the patch to fix it. @karthikbhata97

[Achillesed]

I found that int2ptr is reporting errors in wpa using Sparse flow sensitive pointer analysis，Does it need an add patch to fix it?

operate parameter:
wpa -fspta example.ll

Thanks for building and maintaining SVF!

[yuleisui]

Yes, please try to submit a patch. I think the reason might because the instruction was not added to the PAG