[semantics] merge library and api functions for patron

Author: spearo2

src/semantics/apiSem.ml

@@ -90,6 +90,7 @@ let api_map =
   |> ApiMap.add "memmove"
        { arg_typs = [ dst; arr_src; Size ]; ret_typ = DstArg }
   |> ApiMap.add "strcpy" { arg_typs = [ dst; arr_src ]; ret_typ = DstArg }
+  |> ApiMap.add "g_strdup" { arg_typs = [ arr_src ]; ret_typ = AllocDst }
   |> ApiMap.add "strncpy"
        { arg_typs = [ dst; arr_src; Size ]; ret_typ = DstArg }
   |> ApiMap.add "strxfrm"
@@ -239,6 +240,7 @@ let api_map =
   |> ApiMap.add "pclose" { arg_typs = [ Skip ]; ret_typ = int_v }
   |> ApiMap.add "_IO_getc" { arg_typs = [ Skip ]; ret_typ = tainted_v }
   |> ApiMap.add "getchar" { arg_typs = []; ret_typ = tainted_v }
+  |> ApiMap.add "getc" { arg_typs = [ Skip ]; ret_typ = tainted_v }
   |> ApiMap.add "read" { arg_typs = [ Skip; buf; Size ]; ret_typ = SizeArg }
   |> ApiMap.add "fread"
        { arg_typs = [ buf; Skip; Size; Skip ]; ret_typ = SizeArg }
@@ -261,6 +263,7 @@ let api_map =
   |> ApiMap.add "getenv" { arg_typs = [ Skip ]; ret_typ = tainted_arr }
   (* etc *)
   |> ApiMap.add "scanf" { arg_typs = [ Skip; buf_va ]; ret_typ = int_v }
+  |> ApiMap.add "fscanf" { arg_typs = [ Skip; Skip; buf_va ]; ret_typ = int_v }
   |> ApiMap.add "sscanf"
        { arg_typs = [ arr_src; Skip; dst_va ]; ret_typ = int_v }
   |> ApiMap.add "fgets" { arg_typs = [ buf; Size; Skip ]; ret_typ = BufArg }
@@ -303,3 +306,7 @@ let api_map =
   (* libssh *)
   |> ApiMap.add "_ssh_buffer_unpack"
        { arg_typs = [ arr_src; Skip; Skip; dst_va ]; ret_typ = int_v }
+  |> ApiMap.add "g_get_num_processors" { arg_typs = []; ret_typ = int_v }
+  (* patron experiment *)
+  |> ApiMap.add "TIFFGetField"
+       { arg_typs = [ Skip; Skip; buf_va ]; ret_typ = int_v }

src/semantics/taintSem.ml

@@ -50,14 +50,33 @@ let eval_bop b v1 v2 itv1 itv2 =
   | Cil.Lt | Cil.Gt | Cil.Le | Cil.Ge | Cil.Eq | Cil.Ne | Cil.LAnd | Cil.LOr ->
       Val.bot
 
-let rec eval pid e itvmem mem =
+let rec resolve_offset pid offset itvmem mem =
+  match offset with
+  | Cil.NoOffset -> ()
+  | Cil.Field (_, o) -> resolve_offset pid o itvmem mem
+  | Cil.Index (e, o) ->
+      let _ = eval pid e itvmem mem in
+      resolve_offset pid o itvmem mem
+
+and eval_lv pid lv itvmem mem =
+  (match fst lv with
+  | Cil.Mem e ->
+      let _ = eval pid e itvmem mem in
+      ()
+  | _ -> ());
+  resolve_offset pid (snd lv) itvmem mem
+
+and eval pid e itvmem mem =
   match e with
   | Cil.Const _ | Cil.SizeOf _ | Cil.SizeOfE _ | Cil.SizeOfStr _ | Cil.AlignOf _
   | Cil.AlignOfE _
   | Cil.UnOp (_, _, _)
   | Cil.AddrOf _ | Cil.AddrOfLabel _ | Cil.StartOf _ ->
       Val.bot
-  | Cil.Lval l -> lookup (ItvSem.eval_lv pid l itvmem) mem
+  | Cil.Lval l ->
+      (* for access analysis *)
+      eval_lv pid l itvmem mem;
+      lookup (ItvSem.eval_lv pid l itvmem) mem
   | Cil.BinOp (b, e1, e2, _) ->
       let itv1, itv2 =
         ( ItvSem.eval pid e1 itvmem |> ItvDom.Val.itv_of_val,