Skip to content

Commit 6a4bbb0

Browse files
StevenArztStevenArzt
authored
Merge pull request #554 from MarcMil/marc-improvements
Some improvements
2 parents b7f4e24 + c160818 commit 6a4bbb0

12 files changed

Lines changed: 136 additions & 38 deletions

File tree

‎soot-infoflow-android/src/soot/jimple/infoflow/android/callbacks/AbstractCallbackAnalyzer.java‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -586,10 +586,6 @@ protected void analyzeMethodForViewPagers(SootClass clazz, SootMethod method) {
586586

587587
Body body = method.retrieveActiveBody();
588588

589-
if (method.getDeclaringClass().getName().equals("org.liberty.android.fantastischmemo.ui.AnyMemo")
590-
&& method.getName().equals("initDrawer"))
591-
System.out.println("x");
592-
593589
// look for invocations of ViewPager.setAdapter
594590
for (Unit u : body.getUnits()) {
595591
Stmt stmt = (Stmt) u;

‎soot-infoflow-summaries/src/soot/jimple/infoflow/methodSummary/data/provider/MergingSummaryProvider.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
public class MergingSummaryProvider extends AbstractMethodSummaryProvider {
1717

1818
protected final Collection<IMethodSummaryProvider> innerProviders;
19+
private ClassSummaries cachedSummaries;
1920

2021
protected MergingSummaryProvider() {
2122
this.innerProviders = new HashSet<>();
@@ -108,7 +109,9 @@ public Collection<IMethodSummaryProvider> getInnerProviders() {
108109

109110
@Override
110111
public ClassSummaries getSummaries() {
111-
ClassSummaries summaries = null;
112+
ClassSummaries summaries = cachedSummaries;
113+
if (summaries != null)
114+
return summaries;
112115
for (IMethodSummaryProvider provider : innerProviders) {
113116
ClassSummaries providerSummaries = provider.getSummaries();
114117
if (providerSummaries != null) {
@@ -117,6 +120,7 @@ public ClassSummaries getSummaries() {
117120
summaries.merge(providerSummaries);
118121
}
119122
}
123+
this.cachedSummaries = summaries;
120124
return summaries;
121125
}
122126

‎soot-infoflow-summaries/src/soot/jimple/infoflow/methodSummary/taintWrappers/SummaryTaintWrapper.java‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1425,13 +1425,7 @@ protected AccessPathFragment cutSubFields(MethodFlow flow, AccessPathFragment ac
14251425
*/
14261426
protected boolean isCutSubFields(MethodFlow flow) {
14271427
Boolean cut = flow.getCutSubFields();
1428-
Boolean typeChecking = flow.getTypeChecking();
1429-
if (cut == null) {
1430-
if (typeChecking != null)
1431-
return !typeChecking.booleanValue();
1432-
return false;
1433-
}
1434-
return cut.booleanValue();
1428+
return cut != null && cut.booleanValue();
14351429
}
14361430

14371431
/**

‎soot-infoflow/src/soot/jimple/infoflow/InfoflowConfiguration.java‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1304,6 +1304,7 @@ public boolean equals(Object obj) {
13041304
private long dataFlowTimeout = 0;
13051305
private double memoryThreshold = 0.9d;
13061306
private boolean oneSourceAtATime = false;
1307+
private int maxAliasingBases = Integer.MAX_VALUE;
13071308

13081309
private static String baseDirectory = "";
13091310

@@ -2240,4 +2241,12 @@ public SourceSinkConfiguration getSourceSinkConfig() {
22402241
return sourceSinkConfig;
22412242
}
22422243

2244+
public int getMaxAliasingBases() {
2245+
return maxAliasingBases;
2246+
}
2247+
2248+
public void setMaxAliasingBases(int value) {
2249+
maxAliasingBases = value;
2250+
}
2251+
22432252
}

‎soot-infoflow/src/soot/jimple/infoflow/aliasing/Aliasing.java‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
import soot.jimple.infoflow.InfoflowManager;
3131
import soot.jimple.infoflow.data.Abstraction;
3232
import soot.jimple.infoflow.data.AccessPath;
33+
import soot.jimple.infoflow.data.AccessPathFactory;
3334
import soot.jimple.infoflow.data.AccessPathFragment;
3435
import soot.jimple.infoflow.typing.TypeUtils;
3536
import soot.jimple.toolkits.pointer.LocalMustAliasAnalysis;
@@ -116,9 +117,13 @@ public AccessPath getReferencedAPBase(AccessPath taintedAP, SootField[] referenc
116117
*/
117118
public static AccessPath getReferencedAPBase(AccessPath taintedAP, SootField[] referencedFields,
118119
InfoflowManager manager) {
120+
final AccessPathFactory af = manager.getAccessPathFactory();
119121
final Collection<AccessPathFragment[]> bases = taintedAP.isStaticFieldRef()
120-
? manager.getAccessPathFactory().getBaseForType(taintedAP.getFirstFieldType())
121-
: manager.getAccessPathFactory().getBaseForType(taintedAP.getBaseType());
122+
? af.getBaseForType(taintedAP.getFirstFieldType())
123+
: af.getBaseForType(taintedAP.getBaseType());
124+
if (bases != null && bases.size() > manager.getConfig().getMaxAliasingBases())
125+
// Too much stuff, possibly overtainted
126+
return null;
122127

123128
int fieldIdx = 0;
124129
while (fieldIdx < referencedFields.length) {

‎soot-infoflow/src/soot/jimple/infoflow/data/AccessPathFactory.java‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@
77
import org.slf4j.Logger;
88
import org.slf4j.LoggerFactory;
99

10+
import gnu.trove.set.hash.TCustomHashSet;
11+
import gnu.trove.strategy.HashingStrategy;
1012
import soot.ArrayType;
1113
import soot.Local;
1214
import soot.PrimType;
@@ -21,7 +23,6 @@
2123
import soot.jimple.StaticFieldRef;
2224
import soot.jimple.infoflow.InfoflowConfiguration;
2325
import soot.jimple.infoflow.InfoflowConfiguration.AccessPathConfiguration;
24-
import soot.jimple.infoflow.collect.ConcurrentHashSet;
2526
import soot.jimple.infoflow.collect.MyConcurrentHashMap;
2627
import soot.jimple.infoflow.data.AccessPath.ArrayTaintType;
2728
import soot.jimple.infoflow.typing.TypeUtils;
@@ -415,7 +416,20 @@ public AccessPath createAccessPath(Value val, Type valType, AccessPathFragment[]
415416
}
416417

417418
private void registerBase(Type eiType, AccessPathFragment[] base) {
418-
Set<AccessPathFragment[]> bases = baseRegister.computeIfAbsent(eiType, t -> new ConcurrentHashSet<>());
419+
Set<AccessPathFragment[]> bases = baseRegister.computeIfAbsent(eiType,
420+
t -> new TCustomHashSet<>(new HashingStrategy<AccessPathFragment[]>() {
421+
422+
@Override
423+
public int computeHashCode(AccessPathFragment[] arg0) {
424+
return Arrays.hashCode(arg0);
425+
}
426+
427+
@Override
428+
public boolean equals(AccessPathFragment[] arg0, AccessPathFragment[] arg1) {
429+
return Arrays.equals(arg0, arg1);
430+
}
431+
432+
}));
419433
bases.add(base);
420434
}
421435

‎soot-infoflow/src/soot/jimple/infoflow/nativeCallHandler/DefaultNativeCallHandler.java‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,18 @@ public Set<Abstraction> getTaintedValues(Stmt call, Abstraction source, Value[]
7676

7777
@Override
7878
public boolean supportsCall(Stmt call) {
79-
return call.containsInvokeExpr() && call.getInvokeExpr().getMethod().getSignature().equals(SIG_ARRAYCOPY);
79+
if (!call.containsInvokeExpr())
80+
return false;
81+
String sig = call.getInvokeExpr().getMethod().getSignature();
82+
switch (sig) {
83+
case SIG_ARRAYCOPY:
84+
case SIG_COMPARE_AND_SWAP_OBJECT:
85+
case SIG_NEW_ARRAY:
86+
return true;
87+
88+
default:
89+
return false;
90+
}
8091
}
8192

8293
}

‎soot-infoflow/src/soot/jimple/infoflow/problems/InfoflowProblem.java‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -501,6 +501,7 @@ public FlowFunction<Abstraction> getReturnFlowFunction(final Unit callSite, fina
501501
public Set<Abstraction> computeTargets(Abstraction source, Abstraction d1,
502502
Collection<Abstraction> callerD1s) {
503503
Set<Abstraction> res = computeTargetsInternal(source, d1, callerD1s);
504+
504505
return notifyOutFlowHandlers(exitStmt, d1, source, res, FlowFunctionType.ReturnFlowFunction);
505506
}
506507

@@ -511,9 +512,6 @@ private Set<Abstraction> computeTargetsInternal(Abstraction source, Abstraction
511512
if (source == getZeroValue())
512513
return null;
513514

514-
if (callee.getName().equals("sendMessage"))
515-
System.out.println("x");
516-
517515
// Notify the handler if we have one
518516
if (taintPropagationHandler != null)
519517
taintPropagationHandler.notifyFlowIn(exitStmt, source, manager,

‎soot-infoflow/src/soot/jimple/infoflow/solver/cfg/InfoflowCFG.java‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -284,7 +284,7 @@ public boolean isStaticFieldUsed(SootMethod method, SootField variable) {
284284
return use == StaticFieldUse.Write || use == StaticFieldUse.ReadWrite || use == StaticFieldUse.Unknown;
285285
}
286286

287-
protected synchronized StaticFieldUse checkStaticFieldUsed(SootMethod smethod, SootField variable) {
287+
protected StaticFieldUse checkStaticFieldUsed(SootMethod smethod, SootField variable) {
288288
// Skip over phantom methods
289289
if (!smethod.isConcrete() || !smethod.hasActiveBody())
290290
return StaticFieldUse.Unused;
@@ -383,8 +383,10 @@ else if (writes)
383383
}
384384

385385
// Merge the temporary results into the global cache
386-
for (Entry<SootMethod, StaticFieldUse> tempEntry : tempUses.entrySet()) {
387-
registerStaticVariableUse(tempEntry.getKey(), variable, tempEntry.getValue());
386+
synchronized (tempUses) {
387+
for (Entry<SootMethod, StaticFieldUse> tempEntry : tempUses.entrySet()) {
388+
registerStaticVariableUse(tempEntry.getKey(), variable, tempEntry.getValue());
389+
}
388390
}
389391

390392
StaticFieldUse outerUse = tempUses.get(smethod);

‎soot-infoflow/src/soot/jimple/infoflow/solver/fastSolver/IFDSSolver.java‎

Lines changed: 33 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,18 @@
6565
public class IFDSSolver<N, D extends FastSolverLinkedNode<D, N>, I extends BiDiInterproceduralCFG<N, SootMethod>>
6666
implements IMemoryBoundedSolver {
6767

68+
public enum ScheduleTarget {
69+
/**
70+
* Try to run on the same thread within the executor
71+
*/
72+
LOCAL,
73+
74+
/**
75+
* Run possibly on another executor
76+
*/
77+
EXECUTOR;
78+
}
79+
6880
public static CacheBuilder<Object, Object> DEFAULT_CACHE_BUILDER = CacheBuilder.newBuilder()
6981
.concurrencyLevel(Runtime.getRuntime().availableProcessors()).initialCapacity(10000).softValues();
7082

@@ -200,7 +212,7 @@ protected void submitInitialSeeds() {
200212
for (Entry<N, Set<D>> seed : initialSeeds.entrySet()) {
201213
N startPoint = seed.getKey();
202214
for (D val : seed.getValue())
203-
propagate(zeroValue, startPoint, val, null, false);
215+
propagate(zeroValue, startPoint, val, null, false, ScheduleTarget.EXECUTOR);
204216
addFunction(new PathEdge<N, D>(zeroValue, startPoint, zeroValue));
205217
}
206218
}
@@ -253,15 +265,21 @@ private void runExecutorAndAwaitCompletion() {
253265
* Dispatch the processing of a given edge. It may be executed in a different
254266
* thread.
255267
*
256-
* @param edge the edge to process
268+
* @param edge the edge to process
269+
* @param scheduleTarget
257270
*/
258-
protected void scheduleEdgeProcessing(PathEdge<N, D> edge) {
271+
protected void scheduleEdgeProcessing(PathEdge<N, D> edge, ScheduleTarget scheduleTarget) {
259272
// If the executor has been killed, there is little point
260273
// in submitting new tasks
261274
if (killFlag != null || executor.isTerminating() || executor.isTerminated())
262275
return;
263276

264-
executor.execute(new PathEdgeProcessingTask(edge, solverId));
277+
IFDSSolver<N, D, I>.PathEdgeProcessingTask task = new PathEdgeProcessingTask(edge, solverId);
278+
if (scheduleTarget == ScheduleTarget.EXECUTOR)
279+
executor.execute(task);
280+
else {
281+
LocalWorklistTask.scheduleLocal(task);
282+
}
265283
propagationCount++;
266284
}
267285

@@ -309,7 +327,7 @@ public void accept(SootMethod sCalledProcN) {
309327
// for each callee's start point(s)
310328
for (N sP : startPointsOf) {
311329
// create initial self-loop
312-
propagate(d3, sP, d3, n, false); // line 15
330+
propagate(d3, sP, d3, n, false, ScheduleTarget.EXECUTOR); // line 15
313331
}
314332

315333
// register the fact that <sp,d3> has an incoming edge from
@@ -337,7 +355,7 @@ public void accept(SootMethod sCalledProcN) {
337355
if (memoryManager != null)
338356
d3 = memoryManager.handleGeneratedMemoryObject(d2, d3);
339357
if (d3 != null)
340-
propagate(d1, returnSiteN, d3, n, false);
358+
propagate(d1, returnSiteN, d3, n, false, ScheduleTarget.EXECUTOR);
341359
}
342360
}
343361
}
@@ -401,7 +419,7 @@ protected void applyEndSummaryOnCall(final D d1, final N n, final D d2, Collecti
401419
d5p = d2;
402420
break;
403421
}
404-
propagate(d1, retSiteN, d5p, n, false);
422+
propagate(d1, retSiteN, d5p, n, false, ScheduleTarget.EXECUTOR);
405423
}
406424
}
407425
}
@@ -503,7 +521,7 @@ protected void processExit(PathEdge<N, D> edge) {
503521
d5p = predVal;
504522
break;
505523
}
506-
propagate(d4, retSiteC, d5p, c, false);
524+
propagate(d4, retSiteC, d5p, c, false, ScheduleTarget.EXECUTOR);
507525
}
508526
}
509527
}
@@ -528,7 +546,7 @@ protected void processExit(PathEdge<N, D> edge) {
528546
if (memoryManager != null)
529547
d5 = memoryManager.handleGeneratedMemoryObject(d2, d5);
530548
if (d5 != null)
531-
propagate(zeroValue, retSiteC, d5, c, true);
549+
propagate(zeroValue, retSiteC, d5, c, true, ScheduleTarget.EXECUTOR);
532550
}
533551
}
534552
}
@@ -585,7 +603,7 @@ private void processNormalFlow(PathEdge<N, D> edge) {
585603
if (memoryManager != null && d2 != d3)
586604
d3 = memoryManager.handleGeneratedMemoryObject(d2, d3);
587605
if (d3 != null)
588-
propagate(d1, m, d3, null, false);
606+
propagate(d1, m, d3, null, false, ScheduleTarget.LOCAL);
589607
}
590608
}
591609
}
@@ -618,10 +636,11 @@ protected Set<D> computeNormalFlowFunction(FlowFunction<D> flowFunction, D d1, D
618636
* unbalanced return (this value is not used within
619637
* this implementation but may be useful for
620638
* subclasses of {@link IFDSSolver})
639+
* @param local
621640
*/
622641
protected void propagate(D sourceVal, N target, D targetVal,
623642
/* deliberately exposed to clients */ N relatedCallSite,
624-
/* deliberately exposed to clients */ boolean isUnbalancedReturn) {
643+
/* deliberately exposed to clients */ boolean isUnbalancedReturn, ScheduleTarget scheduleTarget) {
625644
// Let the memory manager run
626645
if (memoryManager != null) {
627646
sourceVal = memoryManager.handleMemoryObject(sourceVal);
@@ -651,7 +670,7 @@ protected void propagate(D sourceVal, N target, D targetVal,
651670
}
652671
}
653672
} else {
654-
scheduleEdgeProcessing(edge);
673+
scheduleEdgeProcessing(edge, scheduleTarget);
655674
}
656675
}
657676

@@ -733,7 +752,7 @@ public void printStats() {
733752
}
734753
}
735754

736-
private class PathEdgeProcessingTask implements Runnable {
755+
private class PathEdgeProcessingTask extends LocalWorklistTask {
737756

738757
private final PathEdge<N, D> edge;
739758
private final boolean solverId;
@@ -743,7 +762,7 @@ public PathEdgeProcessingTask(PathEdge<N, D> edge, boolean solverId) {
743762
this.solverId = solverId;
744763
}
745764

746-
public void run() {
765+
public void runInternal() {
747766
final N target = edge.getTarget();
748767
if (icfg.isCallStmt(target)) {
749768
processCall(edge);

0 commit comments

Comments
 (0)