Skip to content

Commit b8ae323

Browse files
author
Balazs Benics
committed
Revert "[analyzer] Add failing test case demonstrating buggy taint propagation"
This reverts commit 744745a. I'm reverting this since this patch caused a build breakage. https://lab.llvm.org/buildbot/#/builders/91/builds/3818
1 parent d16c5f4 commit b8ae323

File tree

3 files changed

+3
-98
lines changed

3 files changed

+3
-98
lines changed

clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp

Lines changed: 3 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,6 @@
3232
#include <memory>
3333
#include <utility>
3434

35-
#define DEBUG_TYPE "taint-checker"
36-
3735
using namespace clang;
3836
using namespace ento;
3937
using namespace taint;
@@ -693,13 +691,6 @@ void GenericTaintChecker::checkPostCall(const CallEvent &Call,
693691
if (TaintArgs.isEmpty())
694692
return;
695693

696-
LLVM_DEBUG(for (ArgIdxTy I
697-
: TaintArgs) {
698-
llvm::dbgs() << "PostCall<";
699-
Call.dump(llvm::dbgs());
700-
llvm::dbgs() << "> actually wants to taint arg index: " << I << '\n';
701-
});
702-
703694
for (ArgIdxTy ArgNum : TaintArgs) {
704695
// Special handling for the tainted return value.
705696
if (ArgNum == ReturnValueIndex) {
@@ -777,25 +768,15 @@ void GenericTaintRule::process(const GenericTaintChecker &Checker,
777768

778769
/// Propagate taint where it is necessary.
779770
ForEachCallArg(
780-
[this, &State, WouldEscape, &Call](ArgIdxTy I, const Expr *E, SVal V) {
781-
if (PropDstArgs.contains(I)) {
782-
LLVM_DEBUG(llvm::dbgs() << "PreCall<"; Call.dump(llvm::dbgs());
783-
llvm::dbgs()
784-
<< "> prepares tainting arg index: " << I << '\n';);
771+
[this, &State, WouldEscape](ArgIdxTy I, const Expr *E, SVal V) {
772+
if (PropDstArgs.contains(I))
785773
State = State->add<TaintArgsOnPostVisit>(I);
786-
}
787774

788775
// TODO: We should traverse all reachable memory regions via the
789776
// escaping parameter. Instead of doing that we simply mark only the
790777
// referred memory region as tainted.
791-
if (WouldEscape(V, E->getType())) {
792-
LLVM_DEBUG(if (!State->contains<TaintArgsOnPostVisit>(I)) {
793-
llvm::dbgs() << "PreCall<";
794-
Call.dump(llvm::dbgs());
795-
llvm::dbgs() << "> prepares tainting arg index: " << I << '\n';
796-
});
778+
if (WouldEscape(V, E->getType()))
797779
State = State->add<TaintArgsOnPostVisit>(I);
798-
}
799780
});
800781

801782
C.addTransition(State);

clang/test/Analysis/taint-checker-callback-order-has-definition.c

Lines changed: 0 additions & 42 deletions
This file was deleted.

clang/test/Analysis/taint-checker-callback-order-without-definition.c

Lines changed: 0 additions & 34 deletions
This file was deleted.

0 commit comments

Comments
 (0)