Skip to content
Snippets Groups Projects
SMPDataFlowAnalysis.cpp 215 KiB
Newer Older
clc5q's avatar
clc5q committed
			FoundSetBit = true;
			--ByteIndex;
			BitIndex = HighestBitSet(this->STARSBits[ByteIndex]);
			break;
		}
	}

	if (FoundSetBit) {
		return (int)(8 * ByteIndex + BitIndex);
	}
	else {
		return -1;
	}
} // end of STARSBitSet::FindHighestBitSet()
// Return lowest index set; -1 if no bits set.
int STARSBitSet::FindLowestBitSet(void) const {
	bool FoundSetBit = false;
	size_t ByteIndex, BitIndex, BitSetSize = this->STARSBits.size();
	assert(0 < BitSetSize);
	for (ByteIndex = 0; ByteIndex < BitSetSize; ++ByteIndex) {
		if (0 != this->STARSBits[ByteIndex]) {
			FoundSetBit = true;
			BitIndex = LowestBitSet(this->STARSBits[ByteIndex]);
			break;
		}
	}

	if (FoundSetBit) {
		return (int)(8 * ByteIndex + BitIndex);
	}
	else {
		return -1;
	}
} // end of STARSBitSet::FindLowestBitSet()

clc5q's avatar
clc5q committed
// return count of set bits
size_t STARSBitSet::CountSetBits(void) const {
	size_t ByteIndex, BitCount = 0, BitSetSize = this->STARSBits.size();
	assert(0 < BitSetSize);
	for (ByteIndex = 0; ByteIndex < BitSetSize; ++ByteIndex) {
		uint8_t CurrByte = this->STARSBits[ByteIndex];
clc5q's avatar
clc5q committed
		if (0 != CurrByte) {
			BitCount += CountBitsSet((unsigned int) CurrByte);
		}
	}
	return BitCount;
} // end of STARSBitSet::CountSetBits()

// Debugging output of bits set
void STARSBitSet::DumpBitsSet(void) const {
	size_t ByteIndex, BitCount = 0, BitSetSize = this->STARSBits.size();
	assert(0 < BitSetSize);
	for (ByteIndex = 0; ByteIndex < BitSetSize; ++ByteIndex) {
		uint8_t CurrByte = this->STARSBits[ByteIndex];
		if (0 != CurrByte) {
			size_t CurrBitLimit = 8 + (8 * ByteIndex);
			if (CurrBitLimit > this->GetNumBits())
				CurrBitLimit = this->GetNumBits();
			for (size_t BitIndex = 8 * ByteIndex; BitIndex < CurrBitLimit; ++BitIndex) {
				if (this->GetBit(BitIndex)) {
					SMP_msg("%zu ", BitIndex);
				}
			}
		}
	}
	return;
} // end of STARSBitSet::DumpBitsSet()

void STARSBitSet::SetByte(const std::size_t ByteIndex, const uint8_t ByteValue) {
	assert(ByteIndex < this->STARSBits.size());
	this->STARSBits[ByteIndex] = ByteValue;
	return;
}

void STARSBitSet::UnionSets(const STARSBitSet &BitSet2) {
	assert(this->GetNumBits() == BitSet2.GetNumBits());
	for (size_t ByteIndex = 0; ByteIndex < this->STARSBits.size(); ++ByteIndex) {
		this->STARSBits[ByteIndex] = (this->STARSBits[ByteIndex] | BitSet2.GetByte(ByteIndex));
	}

	return;
} // end of STARSBitSet::UnionSets()

STARSBitSet STARSBitSetIntersection(const STARSBitSet &BitSet1, const STARSBitSet &BitSet2) {
	size_t NumBits = BitSet1.GetNumBits();
	assert(NumBits == BitSet2.GetNumBits());
	STARSBitSet ReturnBitSet;
	ReturnBitSet.AllocateBits(NumBits);
	size_t NumBytes = (NumBits / 8);
	if (0 != (NumBits % 8))
		++NumBytes;
	for (size_t ByteIndex = 0; ByteIndex < NumBytes; ++ByteIndex) {
		ReturnBitSet.SetByte(ByteIndex, (BitSet1.GetByte(ByteIndex) & BitSet2.GetByte(ByteIndex)));
	}

	return ReturnBitSet;
} // end of STARSBitSetIntersection()

STARSBitSet STARSBitSetUnion(const STARSBitSet &BitSet1, const STARSBitSet &BitSet2) {
	size_t NumBits = BitSet1.GetNumBits();
	assert(NumBits == BitSet2.GetNumBits());
	STARSBitSet ReturnBitSet;
	ReturnBitSet.AllocateBits(NumBits);
	size_t NumBytes = (NumBits / 8);
	if (0 != (NumBits % 8))
		++NumBytes;
	for (size_t ByteIndex = 0; ByteIndex < NumBytes; ++ByteIndex) {
		ReturnBitSet.SetByte(ByteIndex, (BitSet1.GetByte(ByteIndex) | BitSet2.GetByte(ByteIndex)));
// Map system or library call name to FG info about its return value.
map<string, struct FineGrainedInfo> ReturnRegisterTypeMap;
// Map system or library call name to the annotation substring that
//  guides saturating arithmetic or other continuation policies in 
//  the case of integer error detection of a value passed to that call.
// If we don't care about a certain call, we return an empty string.
static map<string, string> IntegerErrorCallSinkMap;

void InitIntegerErrorCallSinkMap(void) {

	// in case STARS was invoked before.
	IntegerErrorCallSinkMap.clear();

	pair<string, string> MapEntry;
	pair<map<string, string>::iterator, bool> InsertResult;

	MapEntry.first = string("malloc");
	MapEntry.second = string("SINKMALLOC");
	InsertResult = IntegerErrorCallSinkMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("calloc");
	MapEntry.second = string("SINKMALLOC");
	InsertResult = IntegerErrorCallSinkMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("realloc");
	MapEntry.second = string("SINKMALLOC");
	InsertResult = IntegerErrorCallSinkMap.insert(MapEntry);
	assert(InsertResult.second);

	return;
}

// Return sink string for call name from the sink map.
// If we don't care find the call name, we return an empty string.
void GetSinkStringForCallName(string CalleeName, string &SinkString) {
	map<string, string>::iterator MapIter;

	SinkString.clear(); // empty string, append map string if found later
	MapIter = IntegerErrorCallSinkMap.find(CalleeName);

	if (MapIter != IntegerErrorCallSinkMap.end()) { // found it
		SinkString.append(MapIter->second);
	}
	return;
}

// Map system or library call name to the argument number that
//  should have an unsigned value and should be guarded from the
//  signedness error that results from copying a signed value
//  into the outgoing argument. Argument numbers are zero-based.
//  We will return 0 when there is no argument to worry about
//  for a particular library or system call name.
static map<string, unsigned int> UnsignedArgPositionMap;

void InitUnsignedArgPositionMap(void) {
	// clear in case stars invoked multiple times.
	UnsignedArgPositionMap.clear();

	pair<string, unsigned int> MapEntry;
	pair<map<string, unsigned int>::iterator, bool> InsertResult;

	// <string.h>
	MapEntry.first = string("memchr");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("memcmp");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("memcpy");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("memmove");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("memset");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strncat");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strncmp");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strncpy");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strxfrm");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	// <stdlib.h>
	MapEntry.first = string("malloc");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("calloc");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("realloc");
	MapEntry.second = STARS_ARG_POS_1;
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("bsearch");
	MapEntry.second = (STARS_ARG_POS_2 | STARS_ARG_POS_3);
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("qsort");
	MapEntry.second = (STARS_ARG_POS_1 | STARS_ARG_POS_2);
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("mblen");
	MapEntry.second = STARS_ARG_POS_1;
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("mbtowc");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("mbstowcs");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("wcstombs");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	// <stdio.h>
	MapEntry.first = string("setvbuf");
	MapEntry.second = STARS_ARG_POS_3;
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	// <time.h>
	MapEntry.first = string("strftime");
	MapEntry.second = STARS_ARG_POS_1;
	InsertResult = UnsignedArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

} // end of InitUnsignedArgPositionMap()
// Return unsigned arg position bitset for call name from the unsigned arg map.
// If we don't find the call name, we return 0 in ArgPosBits.
void GetUnsignedArgPositionsForCallName(string CalleeName, unsigned int &ArgPosBits) {
	map<string, unsigned int>::iterator MapIter;

	ArgPosBits = 0; // Change if found later
	MapIter = UnsignedArgPositionMap.find(CalleeName);

	if (MapIter != UnsignedArgPositionMap.end()) { // found it
		ArgPosBits = MapIter->second;
	}
	return;
}

// Map of function names to arguments that are dangerous to supply
//  with user-tainted input values.
static map<string, unsigned int> TaintWarningArgPositionMap;

void InitTaintWarningArgPositionMap(void) {
	// clear in case STARS re-init'd.
	TaintWarningArgPositionMap.clear();

	pair<string, unsigned int> MapEntry;
	pair<map<string, unsigned int>::iterator, bool> InsertResult;

	// <string.h>
	MapEntry.first = string("memchr");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("memcmp");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("memcpy");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("memmove");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("memset");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strncat");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strncmp");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strncpy");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strxfrm");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	// <stdlib.h>
	MapEntry.first = string("malloc");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("calloc");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("realloc");
	MapEntry.second = STARS_ARG_POS_1;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("bsearch");
	MapEntry.second = (STARS_ARG_POS_2 | STARS_ARG_POS_3);
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("qsort");
	MapEntry.second = (STARS_ARG_POS_1 | STARS_ARG_POS_2);
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("mblen");
	MapEntry.second = STARS_ARG_POS_1;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("mbtowc");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("mbstowcs");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("wcstombs");
	MapEntry.second = STARS_ARG_POS_2;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	// <stdio.h>
	MapEntry.first = string("setvbuf");
	MapEntry.second = STARS_ARG_POS_3;
	InsertResult = TaintWarningArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	return;
} // end of InitTaintWarningArgPositionMap()
// Return dangerous-to-taint arg position bitset for call name from the taint warning map.
// If we don't find the call name, we return 0 in ArgPosBits.
void GetTaintWarningArgPositionsForCallName(string CalleeName, unsigned int &ArgPosBits) {
	map<string, unsigned int>::iterator MapIter;

	ArgPosBits = 0; // Change if found later
	MapIter = TaintWarningArgPositionMap.find(CalleeName);

	if (MapIter != TaintWarningArgPositionMap.end()) { // found it
		ArgPosBits = MapIter->second;
	}
	return;
}

// Map of function names to POINTER argument positions.
static map<string, unsigned int> PointerArgPositionMap;

// Init map of system or library call name to the argument number that
//  should have a POINTER value.
void InitPointerArgPositionMap(void) {
	// clear in case re-initing.
	PointerArgPositionMap.clear();

	pair<string, unsigned int> MapEntry;
	pair<map<string, unsigned int>::iterator, bool> InsertResult;

	// <locale.h>
	MapEntry.first = string("setlocale");
	MapEntry.second = STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	// <math.h>
	MapEntry.first = string("modf");
	MapEntry.second = STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	// <string.h>
	MapEntry.first = string("memchr");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("memcmp");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("memcpy");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("memmove");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("memset");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strcat");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strncat");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strcmp");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strncmp");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strcpy");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strcpy_chk");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strncpy");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strcoll");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strxfrm");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strchr");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strcspn");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strpbrk");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strrchr");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strspn");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strstr");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strtok");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strlen");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	// <stdlib.h>
	MapEntry.first = string("atof");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("atoi");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("atol");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strtod");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strtol");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strtoul");
	MapEntry.second = STARS_ARG_POS_0 | STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("free");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("realloc");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("getenv");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("system");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("bsearch");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("qsort");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("mblen");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("mbtowc");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("wctomb");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("mbstowcs");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("wcstombs");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	// <stdio.h>
	MapEntry.first = string("remove");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("rename");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("tmpnam");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fclose");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fflush");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fopen");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("freopen");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1 | STARS_ARG_POS_2);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("setbuf");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("setvbuf");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fprintf");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fscanf");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

clc5q's avatar
clc5q committed
	MapEntry.first = string("isoc99_fscanf");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("printf");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("scanf");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

clc5q's avatar
clc5q committed
	MapEntry.first = string("isoc99_scanf");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("sprintf");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("sscanf");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("vfprintf");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("vprintf");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("vsprintf");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fgetc");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fgets");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_2);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fputc");
	MapEntry.second = STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fputs");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("getc");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("gets");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("putc");
	MapEntry.second = STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("puts");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("ungetc");
	MapEntry.second = STARS_ARG_POS_1;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fread");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_3);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fwrite");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_3);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fgetpos");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fseek");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("fsetpos");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_1);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("ftell");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("rewind");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("clearerr");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("feof");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("ferror");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("perror");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	// <time.h>
	MapEntry.first = string("mktime");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("time");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("asctime");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("ctime");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("gmtime");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("localtime");
	MapEntry.second = STARS_ARG_POS_0;
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	MapEntry.first = string("strftime");
	MapEntry.second = (STARS_ARG_POS_0 | STARS_ARG_POS_2 | STARS_ARG_POS_3);
	InsertResult = PointerArgPositionMap.insert(MapEntry);
	assert(InsertResult.second);

	return;
} // end of InitPointerArgPositionMap()

// Return POINTER arg position bitset for call name from the POINTER arg map.
// If we don't find the call name, we return 0 in ArgPosBits.
void GetPointerArgPositionsForCallName(string CalleeName, unsigned int &ArgPosBits) {
	map<string, unsigned int>::iterator MapIter;

	ArgPosBits = 0; // Change if found later
	MapIter = PointerArgPositionMap.find(CalleeName);

	if (MapIter != PointerArgPositionMap.end()) { // found it
		ArgPosBits = MapIter->second;
	}
	return;
}

static set<string> MathLibraryFuncNames;
static set<string> StdioLibraryFuncNames;
clc5q's avatar
clc5q committed
static set<string> StdlibLibraryFuncNames;
void InitLibraryFuncNames(void) {
	// <math.h>
	MathLibraryFuncNames.insert("acos");
	MathLibraryFuncNames.insert("cos");
	MathLibraryFuncNames.insert("sin");
	MathLibraryFuncNames.insert("asin");
	MathLibraryFuncNames.insert("tan");
	MathLibraryFuncNames.insert("atan");
	MathLibraryFuncNames.insert("cosh");
	MathLibraryFuncNames.insert("sinh");
	MathLibraryFuncNames.insert("tanh");
	MathLibraryFuncNames.insert("atan2");
	MathLibraryFuncNames.insert("exp");
	MathLibraryFuncNames.insert("ldexp");
	MathLibraryFuncNames.insert("frexp");
	MathLibraryFuncNames.insert("log");
	MathLibraryFuncNames.insert("modf");
	MathLibraryFuncNames.insert("log10");
	MathLibraryFuncNames.insert("pow");
	MathLibraryFuncNames.insert("sqrt");
	MathLibraryFuncNames.insert("ceil");
	MathLibraryFuncNames.insert("fmod");
	MathLibraryFuncNames.insert("fabs");
	MathLibraryFuncNames.insert("floor");

	StdioLibraryFuncNames.insert("printf");
	StdioLibraryFuncNames.insert("scanf");
clc5q's avatar
clc5q committed
	StdioLibraryFuncNames.insert("isoc99_scanf");
	StdioLibraryFuncNames.insert("printf_chk");
	StdioLibraryFuncNames.insert("fprintf");
	StdioLibraryFuncNames.insert("fscanf");
clc5q's avatar
clc5q committed
	StdioLibraryFuncNames.insert("isoc99_fscanf");
	StdioLibraryFuncNames.insert("sprintf");
	StdioLibraryFuncNames.insert("sscanf");
	StdioLibraryFuncNames.insert("vfprintf");
	StdioLibraryFuncNames.insert("fgetc");
	StdioLibraryFuncNames.insert("vprintf");
	StdioLibraryFuncNames.insert("fgets");
	StdioLibraryFuncNames.insert("vsprintf");
	StdioLibraryFuncNames.insert("fputc");
	StdioLibraryFuncNames.insert("getc");
	StdioLibraryFuncNames.insert("fputs");
	StdioLibraryFuncNames.insert("getchar");
	StdioLibraryFuncNames.insert("putchar");
	StdioLibraryFuncNames.insert("gets");
	StdioLibraryFuncNames.insert("putc");
	StdioLibraryFuncNames.insert("ungetc");
	StdioLibraryFuncNames.insert("puts");
	StdioLibraryFuncNames.insert("fwrite");
	StdioLibraryFuncNames.insert("fread");
	StdioLibraryFuncNames.insert("fgetpos");
	StdioLibraryFuncNames.insert("printf");
	StdioLibraryFuncNames.insert("fseek");
	StdioLibraryFuncNames.insert("rewind");
	StdioLibraryFuncNames.insert("fsetpos");
	StdioLibraryFuncNames.insert("clearerr");
	StdioLibraryFuncNames.insert("ftell");
	StdioLibraryFuncNames.insert("perror");
	StdioLibraryFuncNames.insert("feof");
	StdioLibraryFuncNames.insert("remove");
	StdioLibraryFuncNames.insert("ferror");
	StdioLibraryFuncNames.insert("rename");
	StdioLibraryFuncNames.insert("fopen");
	StdioLibraryFuncNames.insert("tmpfile");
	StdioLibraryFuncNames.insert("freopen");
	StdioLibraryFuncNames.insert("tmpnam");
	StdioLibraryFuncNames.insert("fclose");
	StdioLibraryFuncNames.insert("setbuf");
	StdioLibraryFuncNames.insert("fflush");
	StdioLibraryFuncNames.insert("setvbuf");

clc5q's avatar
clc5q committed
	StdlibLibraryFuncNames.insert("atol");
	StdlibLibraryFuncNames.insert("atof");
	StdlibLibraryFuncNames.insert("atoi");
	StdlibLibraryFuncNames.insert("strtod");
	StdlibLibraryFuncNames.insert("strtol");
	StdlibLibraryFuncNames.insert("strtoul");
	StdlibLibraryFuncNames.insert("rand");
	StdlibLibraryFuncNames.insert("srand");
	StdlibLibraryFuncNames.insert("calloc");
	StdlibLibraryFuncNames.insert("free");
	StdlibLibraryFuncNames.insert("malloc");
	StdlibLibraryFuncNames.insert("realloc");
	StdlibLibraryFuncNames.insert("abort");
	StdlibLibraryFuncNames.insert("atexit");
	StdlibLibraryFuncNames.insert("exit");
	StdlibLibraryFuncNames.insert("getenv");
	StdlibLibraryFuncNames.insert("system");
	StdlibLibraryFuncNames.insert("bsearch");
	StdlibLibraryFuncNames.insert("qsort");
	StdlibLibraryFuncNames.insert("abs");