Пример #1
0
  @Override
  public AbstractState strengthen(
      AbstractState s, Iterable<AbstractState> otherStates, CFAEdge cfaEdge, Precision precision) {

    ValuationState state = (ValuationState) s;
    ValuationState strengthenedState = null;

    for (AbstractState t : otherStates) {
      // TODO: Does not work correctly if BoundedAddressTracking returns more than
      // 		 one successor state.
      if (t instanceof BasedNumberValuation) {
        BasedNumberValuation exState = (BasedNumberValuation) t;
        for (Map.Entry<RTLVariable, BasedNumberElement> entry : exState.getVariableValuation()) {
          RTLVariable var = entry.getKey();
          BasedNumberElement exVal = entry.getValue();
          if (exVal.isTop() || exVal.isNumberTop()) continue;
          if (state.getVariableValue(var).isTop()) {
            if (strengthenedState == null) {
              strengthenedState = new ValuationState(state);
            }
            strengthenedState.setVariableValue(
                var, new IntervalElement(exVal.getRegion(), exVal.getNumber()));
            // logger.debug("Strengthened state " + state.getIdentifier() +
            //		" by setting " + var + " to " + state.getValue(var));
          }
        }
      }
    }

    return strengthenedState == null ? state : strengthenedState;
  }
Пример #2
0
  /*
   * @see org.jakstab.analysis.ConfigurableProgramAnalysis#merge(org.jakstab.analysis.AbstractState, org.jakstab.analysis.AbstractState)
   */
  @Override
  public AbstractState merge(AbstractState s1, AbstractState s2, Precision precision) {

    // Widen s2 towards s1.
    // return ((IntervalState)s2).widen((IntervalState)s1);

    if (s2.isTop() || s1.isBot()) return s2;
    if (s1.isTop()) return s1;

    ValuationState current = (ValuationState) s2;
    ValuationState towards = (ValuationState) s1;

    ValuationState widenedState = new ValuationState(valueFactory);
    // Widen variable valuations
    for (Iterator<Map.Entry<RTLVariable, AbstractDomainElement>> entryIt =
            current.variableIterator();
        entryIt.hasNext(); ) {
      Map.Entry<RTLVariable, AbstractDomainElement> entry = entryIt.next();
      RTLVariable var = entry.getKey();
      IntervalElement v = (IntervalElement) entry.getValue();
      widenedState.setVariableValue(var, v.widen((IntervalElement) towards.getVariableValue(var)));
    }

    // Widen memory
    for (EntryIterator<MemoryRegion, Long, AbstractDomainElement> entryIt = current.storeIterator();
        entryIt.hasEntry();
        entryIt.next()) {
      MemoryRegion region = entryIt.getLeftKey();
      Long offset = entryIt.getRightKey();
      IntervalElement v = (IntervalElement) entryIt.getValue();
      int bitWidth = v.getBitWidth();
      widenedState.setMemoryValue(
          region,
          offset,
          bitWidth,
          v.widen((IntervalElement) towards.getMemoryValue(region, offset, bitWidth)));
    }

    return widenedState;
  }
Пример #3
0
  public RTLExpression getStateFormula(ValuationState state) {
    RTLExpression result = null;

    for (Iterator<Map.Entry<RTLVariable, AbstractDomainElement>> entryIt = state.variableIterator();
        entryIt.hasNext(); ) {
      Map.Entry<RTLVariable, AbstractDomainElement> entry = entryIt.next();
      RTLVariable var = entry.getKey();
      IntervalElement interval = (IntervalElement) entry.getValue();

      if (interval.size() == 1) {
        result =
            addClause(
                result,
                ExpressionFactory.createEqual(
                    var, ExpressionFactory.createNumber(interval.getLeft(), var.getBitWidth())));
      } else {
        if (!interval.leftOpen()) {
          result =
              addClause(
                  result,
                  ExpressionFactory.createLessOrEqual(
                      ExpressionFactory.createNumber(interval.getLeft(), var.getBitWidth()), var));
        }

        if (!interval.rightOpen()) {
          result =
              addClause(
                  result,
                  ExpressionFactory.createLessOrEqual(
                      var, ExpressionFactory.createNumber(interval.getRight(), var.getBitWidth())));
        }
      }
    }

    if (result == null) {
      result = ExpressionFactory.TRUE;
    }

    return result;
  }