Nullptr dereference detector

svf-llvm/tools/AE/ae.cpp

@@ -885,6 +885,8 @@ int main(int argc, char** argv)
     AbstractInterpretation& ae = AbstractInterpretation::getAEInstance();
     if (Options::BufferOverflowCheck())
         ae.addDetector(std::make_unique<BufOverflowDetector>());
+    if (Options::NullPtrDereference())
+        ae.addDetector(std::make_unique<NullPtrDerefDetector>());
     ae.runOnModule(pag->getICFG());
 
     LLVMModuleSet::releaseLLVMModuleSet();

svf/include/AE/Core/AddressValue.h

@@ -32,6 +32,8 @@
 
 #define AddressMask 0x7f000000
 #define FlippedAddressMask (AddressMask^0xffffffff)
+// the address of the null pointer
+#define NullPtrAddr 0x7f000000 + 0
 // the address of the black hole, getVirtualMemAddress(2);
 #define BlackHoleAddr 0x7f000000 + 2
 
@@ -219,7 +221,7 @@ class AddressValue
     /// Check bit value of val start with 0x7F000000, filter by 0xFF000000
     static inline bool isVirtualMemAddress(u32_t val)
     {
-        return (val & 0xff000000) == AddressMask && val != AddressMask + 0;
+        return (val & 0xff000000) == AddressMask;
     }
 
     /// Return the internal index if idx is an address otherwise return the value of idx

svf/include/AE/Svfexe/AEDetector.h

@@ -45,7 +45,8 @@ class AEDetector
     enum DetectorKind
     {
         BUF_OVERFLOW,   ///< Detector for buffer overflow issues.
-        UNKNOWN,    ///< Default type if the kind is not specified.
+        NULLPTR_DEREF,  ///< Detector for null pointer dereference issues.
+        UNKNOWN,        ///< Default type if the kind is not specified.
     };
 
     /**
@@ -307,4 +308,112 @@ class BufOverflowDetector : public AEDetector
     SVFBugReport recoder; ///< Recorder for abstract execution bugs.
     Map<const ICFGNode*, std::string> nodeToBugInfo; ///< Maps ICFG nodes to bug information.
 };
+
+
+/**
+ * @class NullPtrDerefDetector
+ * @brief Detector for identifying null pointer dereference issues.
+ */
+class NullPtrDerefDetector: public AEDetector {
+    friend class AbstractInterpretation;
+public:
+    /**
+     * @brief Constructor initializes the detector kind to NULLPTR_DEREF.
+     */
+    NullPtrDerefDetector()
+    {
+        kind = NULLPTR_DEREF;
+    }
+
+    /**
+     * @brief Destructor.
+     */
+    ~NullPtrDerefDetector() = default;
+
+    /**
+     * @brief Check if the detector is of the NULLPTR_DEREF kind.
+     * @param detector Pointer to the detector.
+     * @return True if the detector is of type NULLPTR_DEREF, false otherwise.
+     */
+    static bool classof(const AEDetector* detector)
+    {
+        return detector->getKind() == AEDetector::NULLPTR_DEREF;
+    }
+
+
+    /**
+     * @brief Detect null pointer dereferece issues within a node.
+     * @param as Reference to the abstract state.
+     * @param node Pointer to the ICFG node.
+     */
+    void detect(AbstractState& as, const ICFGNode* node);
+
+    /**
+     * @brief Check if an Abstract Value is NULL (or uninitialized).
+     *
+     * @param v An Abstract Value of loaded from an address in an Abstract State.
+     */
+    bool isNull(AbstractValue v) {
+        bool is = (v.getInterval().isBottom() && v.getAddrs().isBottom()) ||
+            v.getAddrs().contains(NullPtrAddr);
+        return is;
+    }
+
+    /**
+     * @brief Check if an Abstract Value is uninitialized.
+     *
+     * @param v An Abstract Value in an Abstract State.
+     */
+    bool isUninit(AbstractValue v) {
+        bool is = (v.getInterval().isBottom() && v.getAddrs().isBottom());
+        return is;
+    }
+
+    /**
+     * @brief Reports all detected null pointer dereference bugs.
+     */
+    void reportBug()
+    {
+        std::cerr << "###################### Null Pointer Dereference (" + std::to_string(stmtToBugInfo.size())
+                    + " found) ######################\n";
+        std::cerr << "---------------------------------------------\n";
+        for (const auto& it : stmtToBugInfo) {
+            const SVFStmt *s = it.first;
+            std::cerr << "Location: " << s->toString() << "\n---------------------------------------------\n";
+        }
+    }
+
+    /**
+     * @brief record a bug.
+     * @param stmt The SVF statement that triggers the null pointer dereference.
+     */
+    void recordBug(const SVFStmt *stmt)
+    {
+        const ICFGNode *eventInst = stmt->getICFGNode();
+        SVFBugEvent sourceInstEvent(SVFBugEvent::EventType::SourceInst, eventInst);
+
+        std::string loc = sourceInstEvent.getEventLoc(); // Get the location of the last event in the stack
+
+        if (loc == "") {
+            stmtToBugInfo[stmt] = loc;
+        } else if (bugLoc.find(loc) == bugLoc.end()) {
+            bugLoc.insert(loc);
+            stmtToBugInfo[stmt] = loc;
+        }
+    }
+
+    /**
+     * @brief Checks if pointer can be safely dereferenced.
+     * @param as Reference to the abstract state.
+     * @param value Pointer to the SVF value.
+     * @return True if the pointer dereference is safe, false otherwise.
+     */
+    bool canSafelyDerefPtr(AbstractState& as, const SVF::SVFValue* value);
+
+
+private:
+    Set<std::string> bugLoc;    ///< Set of locations where bugs have been reported.
+    Map<const SVFStmt*, std::string> stmtToBugInfo; ///< Maps SVF stmt to bug information.
+};
+
 }

svf/include/Util/Options.h

@@ -250,6 +250,8 @@ class Options
     static const Option<std::string> OutputName;
     /// buffer overflow checker, Default: false
     static const Option<bool> BufferOverflowCheck;
+    /// null pointer dereference checker, Default: false
+    static const Option<bool> NullPtrDereference;
     /// memory leak check, Default: false
     static const Option<bool> MemoryLeakCheck;
     /// file open close checker, Default: false

svf/lib/AE/Core/AbstractState.cpp

@@ -165,6 +165,10 @@ AddressValue AbstractState::getGepObjAddrs(u32_t pointer, IntervalValue offset)
         AbstractValue addrs = (*this)[pointer];
         for (const auto& addr : addrs.getAddrs())
         {
+            if (isNullPtr(addr)) {
+                gepAddrs.insert(NullPtrAddr);
+                continue;
+            }
             s64_t baseObj = AbstractState::getInternalID(addr);
             assert(SVFUtil::isa<ObjVar>(PAG::getPAG()->getGNode(baseObj)) && "Fail to get the base object address!");
             NodeID gepObj = PAG::getPAG()->getGepObjVar(baseObj, i);
@@ -437,6 +441,7 @@ void AbstractState::printAbstractState() const
 
     for (const auto& item: addrToAbsValVec)
     {
+        if (item.first == 0) continue;
         std::ostringstream oss;
         oss << "0x" << std::hex << AbstractState::getVirtualMemAddress(item.first);
         SVFUtil::outs() << std::left << std::setw(fieldWidth) << oss.str();

svf/lib/AE/Svfexe/AEDetector.cpp

@@ -426,3 +426,53 @@ bool BufOverflowDetector::canSafelyAccessMemory(AbstractState& as, const SVF::SV
     }
     return true;
 }
+
+/**
+ * @brief Detects null pointer dereference issues within a given ICFG node.
+ *
+ * @param as Reference to the abstract state.
+ * @param node Pointer to the ICFG node.
+ */
+void NullPtrDerefDetector::detect(AbstractState& as, const ICFGNode* node) {
+    for (const SVFStmt* stmt : node->getSVFStmts()) {
+        if (const LoadStmt* load = SVFUtil::dyn_cast<LoadStmt>(stmt)) {
+            u32_t rhs = load->getRHSVarID();
+            AbstractValue &addrs = as[rhs];
+            for (const auto &addr: addrs.getAddrs()) {
+                AbstractValue v = as.load(addr);
+                if (isNull(v)) {
+                    recordBug(load);
+                }
+            }
+        } else if (const StoreStmt* store = SVFUtil::dyn_cast<StoreStmt>(stmt)) {
+            u32_t lhs = store->getLHSVarID();
+            AbstractValue &addrs = as[lhs];
+            for (const auto &addr: addrs.getAddrs()) {
+                AbstractValue v = as.load(addr);
+                if (isNull(v)) {
+                    recordBug(store);
+                }
+            }
+        }
+    }
+}
+
+/**
+ * @brief Checks if pointer can be safely dereferenced.
+ * @param as Reference to the abstract state.
+ * @param ptr_id Pointer to the SVF value.
+ * @return True if the pointer dereference is safe, false otherwise.
+ */
+bool NullPtrDerefDetector::canSafelyDerefPtr(AbstractState& as, const SVF::SVFValue* value) {
+    SVFIR* svfir = PAG::getPAG();
+    NodeID value_id = svfir->getValueNode(value);
+    if (isUninit(as[value_id])) return false;
+    assert(as[value_id].isAddr());
+    AbstractValue &addrs = as[value_id];
+    for (const auto &addr: addrs.getAddrs()) {
+        AbstractValue v = as.load(addr);
+        if (isNull(v))
+            return false;
+    }
+    return true;
+}

svf/lib/AE/Svfexe/AbstractInterpretation.cpp

@@ -168,7 +168,7 @@ void AbstractInterpretation::handleGlobalNode()
 {
     const ICFGNode* node = icfg->getGlobalICFGNode();
     abstractTrace[node] = AbstractState();
-    abstractTrace[node][SymbolTableInfo::NullPtr] = AddressValue();
+    abstractTrace[node][SymbolTableInfo::NullPtr] = AddressValue(NullPtrAddr);    //
     // Global Node, we just need to handle addr, load, store, copy and gep
     for (const SVFStmt *stmt: node->getSVFStmts())
     {
@@ -1289,10 +1289,75 @@ void AbstractInterpretation::initExtFunMap()
     };
     func_map["UNSAFE_BUFACCESS"] = unsafe_bufaccess;
 
+    auto unsafe_load = [&](const CallICFGNode *callNode)
+    {
+        checkpoints.erase(callNode);
+        // void UNSAFE_LOAD(void* data);
+        if (callNode->arg_size() < 1) return;
+        AbstractState &as = getAbsStateFromTrace(callNode);
+
+
+        for (auto& detector: detectors)
+        {
+            // if detector is a buffer overflow detector, call it
+            if (SVFUtil::isa<NullPtrDerefDetector>(detector))
+            {
+                NullPtrDerefDetector* nullDetector = SVFUtil::cast<NullPtrDerefDetector>(detector.get());
+                bool isSafe = nullDetector->canSafelyDerefPtr(as, callNode->getArgument(0));
+                if (!isSafe)
+                {
+                    std::cout << "detect null pointer deference success: " << callNode->toString() << std::endl;
+                    return;
+                }
+                else
+                {
+                    std::string err_msg = "this UNSAFE_LOAD should be a null pointer dereference but not detected. Pos: ";
+                    err_msg += callNode->getSourceLoc();
+                    std::cerr << err_msg << std::endl;
+                    assert(false);
+                }
+            }
+        }
+    };
+    func_map["UNSAFE_LOAD"] = unsafe_load;
+
+    auto safe_load = [&](const CallICFGNode *callNode)
+    {
+        checkpoints.erase(callNode);
+        // void UNSAFE_LOAD(void* data);
+        if (callNode->arg_size() < 1) return;
+        AbstractState &as = getAbsStateFromTrace(callNode);
+
+        for (auto& detector: detectors)
+        {
+            // if detector is a buffer overflow detector, call it
+            if (SVFUtil::isa<NullPtrDerefDetector>(detector))
+            {
+                NullPtrDerefDetector* nullDetector = SVFUtil::cast<NullPtrDerefDetector>(detector.get());
+                bool isSafe = nullDetector->canSafelyDerefPtr(as, callNode->getArgument(0));
+                if (isSafe)
+                {
+                    std::cout << "safe load pointer success: " << callNode->toString() << std::endl;
+                    return;
+                }
+                else
+                {
+                    std::string err_msg = "this SAFE_LOAD should be a safe but a null pointer dereference detected. Pos: ";
+                    err_msg += callNode->getSourceLoc();
+                    std::cerr << err_msg << std::endl;
+                    assert(false);
+                }
+            }
+        }
+    };
+    func_map["SAFE_LOAD"] = safe_load;
+
     // init checkpoint_names
     checkpoint_names.insert("svf_assert");
     checkpoint_names.insert("UNSAFE_ACCESS");
     checkpoint_names.insert("SAFE_ACCESS");
+    checkpoint_names.insert("UNSAFE_LOAD");
+    checkpoint_names.insert("SAFE_LOAD");
 };
 
 std::string AbstractInterpretation::strRead(AbstractState& as, const SVFValue* rhs)

svf/lib/Util/Options.cpp

@@ -785,6 +785,8 @@ const Option<std::string> Options::OutputName(
     "output","output db file","output.db");
 const Option<bool> Options::BufferOverflowCheck(
     "overflow","Buffer Overflow Detection",false);
+const Option<bool> Options::NullPtrDereference(
+    "nullptr_dereference","Null Pointer Dereference Detection",false);
 const Option<bool> Options::MemoryLeakCheck(
     "leak", "Memory Leak Detection",false);
 const Option<bool> Options::FileCheck(