Skip to content
Snippets Groups Projects
SMPDataFlowAnalysis.cpp 203 KiB
Newer Older
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	// <stdlib.h>
	MapEntry.first = string("malloc");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("calloc");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("realloc");
	MapEntry.second = STARS_ARG_POS_1;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("bsearch");
	MapEntry.second = (STARS_ARG_POS_2 | STARS_ARG_POS_3);
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("qsort");
	MapEntry.second = (STARS_ARG_POS_1 | STARS_ARG_POS_2);
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("mblen");
	MapEntry.second = STARS_ARG_POS_1;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("mbtowc");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("mbstowcs");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("wcstombs");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	// <stdio.h>
	MapEntry.first = string("setvbuf");
	MapEntry.second = STARS_ARG_POS_3;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	return;
} // end of InitTaintWarningArgPositionMap()
// Return dangerous-to-taint arg position bitset for call name from the taint warning map.
// If we don't find the call name, we return 0 in ArgPosBits.
void GetTaintWarningArgPositionsForCallName(string CalleeName, unsigned int &ArgPosBits) {
	map<string, unsigned int>::iterator MapIter;

	ArgPosBits = 0; // Change if found later
	MapIter = TaintWarningArgPositionMap.find(CalleeName);

	if (MapIter != TaintWarningArgPositionMap.end()) { // found it
		ArgPosBits = MapIter->second;
	}
	return;
}

// Map of function names to POINTER argument positions.
static map<string, unsigned int> PointerArgPositionMap;

// Init map of system or library call name to the argument number that
//  should have a POINTER value.
void InitPointerArgPositionMap(void) {
	// clear in case re-initing.
	PointerArgPositionMap.clear();

	pair<string, unsigned int> MapEntry;
	pair<map<string, unsigned int>::iterator, bool> InsertResult;

	// <locale.h>
	MapEntry.first = string("setlocale");
	MapEntry.second = STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	// <math.h>
	MapEntry.first = string("modf");
	MapEntry.second = STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	// <string.h>
	MapEntry.first = string("memchr");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("memcmp");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("memcpy");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("memmove");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("memset");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strcat");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strncat");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strcmp");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strncmp");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strcpy");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strncpy");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strcoll");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strxfrm");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strchr");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strcspn");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strpbrk");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strrchr");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strspn");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strstr");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strtok");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strlen");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	// <stdlib.h>
	MapEntry.first = string("atof");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("atoi");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("atol");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strtod");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strtol");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strtoul");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("free");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("realloc");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("getenv");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("system");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("bsearch");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("qsort");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("mblen");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("mbtowc");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("wctomb");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("mbstowcs");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("wcstombs");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	// <stdio.h>
	MapEntry.first = string("remove");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("rename");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("tmpnam");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fclose");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fflush");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fopen");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("freopen");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1 | STARS_ARG_POS_2);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("setbuf");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("setvbuf");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fprintf");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fscanf");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

clc5q's avatar
clc5q committed
	MapEntry.first = string("isoc99_fscanf");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("printf");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("scanf");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

clc5q's avatar
clc5q committed
	MapEntry.first = string("isoc99_scanf");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("sprintf");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("sscanf");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("vfprintf");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("vprintf");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("vsprintf");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fgetc");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fgets");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_2);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fputc");
	MapEntry.second = STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fputs");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("getc");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("gets");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("putc");
	MapEntry.second = STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("puts");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("ungetc");
	MapEntry.second = STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fread");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_3);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fwrite");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_3);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fgetpos");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fseek");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fsetpos");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("ftell");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("rewind");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("clearerr");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("feof");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("ferror");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("perror");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	// <time.h>
	MapEntry.first = string("mktime");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("time");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("asctime");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("ctime");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("gmtime");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("localtime");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strftime");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_2 | STARS_ARG_POS_3);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	return;
} // end of InitPointerArgPositionMap()

// Return POINTER arg position bitset for call name from the POINTER arg map.
// If we don't find the call name, we return 0 in ArgPosBits.
void GetPointerArgPositionsForCallName(string CalleeName, unsigned int &ArgPosBits) {
	map<string, unsigned int>::iterator MapIter;

	ArgPosBits = 0; // Change if found later
	MapIter = PointerArgPositionMap.find(CalleeName);

	if (MapIter != PointerArgPositionMap.end()) { // found it
		ArgPosBits = MapIter->second;
	}
	return;
}

static set<string> MathLibraryFuncNames;
static set<string> StdioLibraryFuncNames;
clc5q's avatar
clc5q committed
static set<string> StdlibLibraryFuncNames;

void InitLibraryFuncNames(void) {
	// <math.h>
	MathLibraryFuncNames.insert("acos");
	MathLibraryFuncNames.insert("cos");
	MathLibraryFuncNames.insert("sin");
	MathLibraryFuncNames.insert("asin");
	MathLibraryFuncNames.insert("tan");
	MathLibraryFuncNames.insert("atan");
	MathLibraryFuncNames.insert("cosh");
	MathLibraryFuncNames.insert("sinh");
	MathLibraryFuncNames.insert("tanh");
	MathLibraryFuncNames.insert("atan2");
	MathLibraryFuncNames.insert("exp");
	MathLibraryFuncNames.insert("ldexp");
	MathLibraryFuncNames.insert("frexp");
	MathLibraryFuncNames.insert("log");
	MathLibraryFuncNames.insert("modf");
	MathLibraryFuncNames.insert("log10");
	MathLibraryFuncNames.insert("pow");
	MathLibraryFuncNames.insert("sqrt");
	MathLibraryFuncNames.insert("ceil");
	MathLibraryFuncNames.insert("fmod");
	MathLibraryFuncNames.insert("fabs");
	MathLibraryFuncNames.insert("floor");

	StdioLibraryFuncNames.insert("printf");
	StdioLibraryFuncNames.insert("scanf");
clc5q's avatar
clc5q committed
	StdioLibraryFuncNames.insert("isoc99_scanf");
	StdioLibraryFuncNames.insert("printf_chk");
	StdioLibraryFuncNames.insert("fprintf");
	StdioLibraryFuncNames.insert("fscanf");
clc5q's avatar
clc5q committed
	StdioLibraryFuncNames.insert("isoc99_fscanf");
	StdioLibraryFuncNames.insert("sprintf");
	StdioLibraryFuncNames.insert("sscanf");
	StdioLibraryFuncNames.insert("vfprintf");
	StdioLibraryFuncNames.insert("fgetc");
	StdioLibraryFuncNames.insert("vprintf");
	StdioLibraryFuncNames.insert("fgets");
	StdioLibraryFuncNames.insert("vsprintf");
	StdioLibraryFuncNames.insert("fputc");
	StdioLibraryFuncNames.insert("getc");
	StdioLibraryFuncNames.insert("fputs");
	StdioLibraryFuncNames.insert("getchar");
	StdioLibraryFuncNames.insert("putchar");
	StdioLibraryFuncNames.insert("gets");
	StdioLibraryFuncNames.insert("putc");
	StdioLibraryFuncNames.insert("ungetc");
	StdioLibraryFuncNames.insert("puts");
	StdioLibraryFuncNames.insert("fwrite");
	StdioLibraryFuncNames.insert("fread");
	StdioLibraryFuncNames.insert("fgetpos");
	StdioLibraryFuncNames.insert("printf");
	StdioLibraryFuncNames.insert("fseek");
	StdioLibraryFuncNames.insert("rewind");
	StdioLibraryFuncNames.insert("fsetpos");
	StdioLibraryFuncNames.insert("clearerr");
	StdioLibraryFuncNames.insert("ftell");
	StdioLibraryFuncNames.insert("perror");
	StdioLibraryFuncNames.insert("feof");
	StdioLibraryFuncNames.insert("remove");
	StdioLibraryFuncNames.insert("ferror");
	StdioLibraryFuncNames.insert("rename");
	StdioLibraryFuncNames.insert("fopen");
	StdioLibraryFuncNames.insert("tmpfile");
	StdioLibraryFuncNames.insert("freopen");
	StdioLibraryFuncNames.insert("tmpnam");
	StdioLibraryFuncNames.insert("fclose");
	StdioLibraryFuncNames.insert("setbuf");
	StdioLibraryFuncNames.insert("fflush");
	StdioLibraryFuncNames.insert("setvbuf");

clc5q's avatar
clc5q committed
	StdlibLibraryFuncNames.insert("atol");
	StdlibLibraryFuncNames.insert("atof");
	StdlibLibraryFuncNames.insert("atoi");
	StdlibLibraryFuncNames.insert("strtod");
	StdlibLibraryFuncNames.insert("strtol");
	StdlibLibraryFuncNames.insert("strtoul");
	StdlibLibraryFuncNames.insert("rand");
	StdlibLibraryFuncNames.insert("srand");
	StdlibLibraryFuncNames.insert("calloc");
	StdlibLibraryFuncNames.insert("free");
	StdlibLibraryFuncNames.insert("malloc");
	StdlibLibraryFuncNames.insert("realloc");
	StdlibLibraryFuncNames.insert("abort");
	StdlibLibraryFuncNames.insert("atexit");
	StdlibLibraryFuncNames.insert("exit");
	StdlibLibraryFuncNames.insert("getenv");
	StdlibLibraryFuncNames.insert("system");
	StdlibLibraryFuncNames.insert("bsearch");
	StdlibLibraryFuncNames.insert("qsort");
	StdlibLibraryFuncNames.insert("abs");
	StdlibLibraryFuncNames.insert("div");
	StdlibLibraryFuncNames.insert("labs");
	StdlibLibraryFuncNames.insert("ldiv");
	StdlibLibraryFuncNames.insert("mblen");
	StdlibLibraryFuncNames.insert("mbtowc");
	StdlibLibraryFuncNames.insert("wctomb");
	StdlibLibraryFuncNames.insert("mbstowcs");
	StdlibLibraryFuncNames.insert("wcstombs");

	// Add special functions often inserted by gcc.
	StdlibLibraryFuncNames.insert("stack_chk_fail");

	return;
} // end of InitLibraryFuncNames()

bool IsMathLibraryFunc(string CalleeName) {
	set<string>::const_iterator FuncIter = MathLibraryFuncNames.find(CalleeName);
	return (FuncIter != MathLibraryFuncNames.cend());
}

bool IsStdioLibraryFunc(string CalleeName) {
	set<string>::const_iterator FuncIter = StdioLibraryFuncNames.find(CalleeName);
	return (FuncIter != StdioLibraryFuncNames.cend());
}

clc5q's avatar
clc5q committed
bool IsStdlibLibraryFunc(string CalleeName) {
	set<string>::const_iterator FuncIter = StdlibLibraryFuncNames.find(CalleeName);
	return (FuncIter != StdlibLibraryFuncNames.cend());
}

// Utility to count bits set in an unsigned int, e.g. ArgPosBits.
unsigned int CountBitsSet(unsigned int ArgPosBits) {
	unsigned int count; // count accumulates the total bits set in ArgPosBits
	for (count = 0; ArgPosBits; ++count) {
		ArgPosBits &= (ArgPosBits - 1); // clear the least significant bit set
	}
	// Brian Kernighan's method goes through as many iterations as there are set bits. 
	//  So if we have a 32-bit word with only the high bit set, then it will only go once through the loop.
	// Published in 1988, the C Programming Language 2nd Ed. (by Brian W. Kernighan and Dennis M. Ritchie) mentions this in exercise 2-9.
	//  On April 19, 2006 Don Knuth pointed out to me that this method "was first published by Peter Wegner in CACM 3 (1960), 322.
	//  (Also discovered independently by Derrick Lehmer and published in 1964 in a book edited by Beckenbach.)"
	return count;
}

// Utility to get highest bit set in a byte, numbered 0 (lowest) to 7 (highest).
clc5q's avatar
clc5q committed
unsigned int HighestBitSet(unsigned char Byte) {
	unsigned int RetVal = 0;
	if (Byte & 0xf0) { // check upper 4 bits
		RetVal |= 4;  // at least bit 4 or higher is set
		Byte >>= 4;   // shift upper nibble to lower nibble
	}
	if (Byte & 0xc) { // check upper two bits of lower nibble
		RetVal |= 2;  // At least bit 2 or higher is set
		Byte >>= 2;   // shift upper two bits of lower nibble into lowest two bits
	}
	if (Byte & 0x2) { // Check second least significant bit
		RetVal |= 1;
	}
	return RetVal;
}

// Utility to get lowest bit set in a byte, numbered 0 (lowest) to 7 (highest).
unsigned int LowestBitSet(unsigned char Byte) {
	unsigned int RetVal = 0;
	if (Byte & 0x03) { // check lower 2 bits
		RetVal = (Byte & 1) ? 0 : 1;
	}
	else if (Byte & 0x0c) { // check upper two bits of lower nibble
		RetVal = (Byte & 4) ? 2 : 3;
	}
	else if (Byte & 0x30) { // Check lower two bits of upper nibble
		RetVal = (Byte & 16) ? 4 : 5;
	}
	else {
		assert(Byte & 0xc0);
		RetVal = (Byte & 64) ? 6 : 7;
	}
	return RetVal;
}

// Utility to get highest bit set in an uint32_t, numbered 0 (lowest) to 31 (highest).
// Assumes that UintVal is non-zero and has some bit set.
unsigned int HighestBitSetInUint(uint32_t UintVal) {
	unsigned int RetVal = 0;
	unsigned char Byte0 = UintVal & 0xff;
	unsigned char Byte1 = UintVal & 0xff00;
	unsigned char Byte2 = UintVal & 0xff0000;
	unsigned char Byte3 = UintVal & 0xff000000;
	if (Byte3 > 0) {
		RetVal = HighestBitSet(Byte3) + 24;
	}
	else if (Byte2 > 0) {
		RetVal = HighestBitSet(Byte2) + 16;
	}
	else if (Byte1 > 0) {
		RetVal = HighestBitSet(Byte1) + 8;
	}
	else if (Byte0 > 0) {
		RetVal = HighestBitSet(Byte0);
	}
	return RetVal;
}

// Initialize the FG info for the return register from any library function
//  whose name implies that we know certain return values (e.g. atoi() returns
//  a signed integer, while strtoul() returns an unsigned long).
void GetLibFuncFGInfo(string FuncName, struct FineGrainedInfo &InitFGInfo) {
	map<string, struct FineGrainedInfo>::iterator FindIter;

	FindIter = ReturnRegisterTypeMap.find(FuncName);
	if (FindIter == ReturnRegisterTypeMap.end()) { // not found
		InitFGInfo.SignMiscInfo = 0;
		InitFGInfo.SizeInfo = 0;
	}
	else { // found
		InitFGInfo = FindIter->second;
	}
	return;
} // end of GetLibFuncFGInfo()

// Is FuncName a standard library function name?
bool IsLibFuncName(std::string CalleeName) {
	// Return true if we find the name in any of our function type maps.

	map<string, struct FineGrainedInfo>::iterator RetTypeIter = ReturnRegisterTypeMap.find(CalleeName);
	if (RetTypeIter != ReturnRegisterTypeMap.end()) { // found
		return true;
	}

	map<string, unsigned int>::iterator PtrArgIter = PointerArgPositionMap.find(CalleeName);
	if (PtrArgIter != PointerArgPositionMap.end()) { // found it
		return true;
	}

	map<string, unsigned int>::iterator TaintIter = TaintWarningArgPositionMap.find(CalleeName);
	if (TaintIter != TaintWarningArgPositionMap.end()) { // found it
		return true;
	}

	map<string, unsigned int>::iterator UnsignedIter = UnsignedArgPositionMap.find(CalleeName);
	if (UnsignedIter != UnsignedArgPositionMap.end()) { // found it
		return true;
	}

	map<string, string>::iterator SinkIter = IntegerErrorCallSinkMap.find(CalleeName);
	if (SinkIter != IntegerErrorCallSinkMap.end()) { // found it
		return true;
	}

	// Put searches for additional library function names here.
	if (0 == CalleeName.compare("setuid")) {
		return true;
	}
	else if (IsStdioLibraryFunc(CalleeName)) {
		return true;
	}
	else if (IsMathLibraryFunc(CalleeName)) {
		return true;
	}
clc5q's avatar
clc5q committed
	else if (IsStdlibLibraryFunc(CalleeName)) {
		return true;
	}

// Is FuncName a startup func called before main(), or a wrapup function called by the system?
bool IsStartupFuncName(const std::string FuncName) {
	bool NameMatched = false;
	char IDA_func_name[STARS_MAXSTR];
	std::size_t SkipCount;

	SkipCount = strspn(FuncName.c_str(), "._");
	std::string TempFuncName = FuncName.substr(SkipCount); // remove leading periods and underscores

	if (0 == TempFuncName.compare("init_proc")) {
		NameMatched = true;
	}
	else if (0 == TempFuncName.compare("init")) {
		NameMatched = true;
	}
	else if (0 == TempFuncName.compare("start")) {
		NameMatched = true;
	}
	else if (0 == TempFuncName.compare("gmon_start")) {
		NameMatched = true;
	}
	else if (0 == TempFuncName.compare("call_gmon_start")) {
		NameMatched = true;
	}
	else if (0 == TempFuncName.compare("libc_start_main")) {
		NameMatched = true;
	}
	else if (0 == TempFuncName.compare("call_gmon_start__")) {
		NameMatched = true;
	}
	else if (0 == TempFuncName.compare("libc_start_main__")) {
		NameMatched = true;
	}
	else if (0 == TempFuncName.compare("libc_csu_init")) {
		NameMatched = true;
	}
	else if (0 == TempFuncName.compare("libc_csu_fini")) {
		NameMatched = true;
	}
	else if (0 == TempFuncName.compare("do_global_dtors_aux")) {
		NameMatched = true;
	}
	else if (0 == TempFuncName.compare("term_proc")) {
		NameMatched = true;
	}
	else if (0 == TempFuncName.compare("fini")) {
		NameMatched = true;
	}
	else if (0 == TempFuncName.compare("frame_dummy")) {
		NameMatched = true;
	}