1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
//! DF-4 - IFDS/IDE interprocedural dataflow framework.
//!
//! Reps & Horwitz & Sagiv (1995): distributive dataflow problems
//! over a finite domain D reduce to graph reachability on the
//! exploded super-graph. Nodes are (statement × fact) pairs; edges
//! encode flow + call-return summary edges. Reaching a sink fact
//! from a source fact = the source taint flows to the sink along
//! some interprocedural path that respects matched call/return.
//!
//! Following the `vyre-libs::security::flows_to` idiom, this module
//! ships ONE dispatch step of forward reachability over the super-
//! graph. The caller-side fixpoint driver iterates it until the
//! reach frontier converges, and the surge stdlib composes the
//! source/sink/sanitizer triple on top.
//!
//! ## Soundness
//!
//! PHASE6_DATAFLOW CRITICAL: previous docstring claimed
//! `Soundness::Exact`. That was a lie - the body is generic forward
//! reachability with `0xFFFF_FFFF` mask, NO call/return matching, NO
//! summary edges, NO sanitizer gating, and NO exploded super-graph
//! construction. Real Reps-Horwitz-Sagiv requires building the
//! exploded super-graph (handled by [`super::ifds_gpu`]) and then
//! running the step kernel over it.
//!
//! This module's [`ifds_reach_step`] is now correctly tagged
//! [`MayOver`](super::Soundness::MayOver) and delegates to
//! [`super::ifds_gpu::ifds_gpu_step`] when the caller passes a real
//! [`super::ifds_gpu::IfdsShape`]. The Tier-3 ProgramGraphShape
//! entry remains for back-compat callers that pre-built the CSR by
//! hand - those callers MUST still iterate to fixpoint and gate
//! sanitizer facts themselves.
//!
//! Rules requiring zero-FP MUST compose this primitive with an
//! explicit sanitizer mask after each step - see surge stdlib
//! `flows_to_with_sanitizer`.
//!
//! Underpins C01, C08, C09, C13, C15, C16, C18.
mod closure;
#[cfg(any(test, feature = "cpu-parity"))]
mod cpu_oracle;
mod program;
mod tag;
#[cfg(test)]
mod tests;
pub(crate) const OP_ID: &str = "weir::ifds";
pub use closure::{
ifds_reach_closure_borrowed_into_result_with_scratch_via, ifds_reach_closure_borrowed_into_via,
ifds_reach_closure_borrowed_into_with_scratch_via, ifds_reach_closure_borrowed_via,
ifds_reach_closure_via,
};
#[cfg(any(test, feature = "cpu-parity"))]
#[allow(deprecated)]
pub(crate) use cpu_oracle::ifds_reach_closure_cpu;
#[cfg(any(test, feature = "cpu-parity"))]
pub(crate) use program::IFDS_REACH_MASK;
pub use program::{ifds_reach_step, ifds_reach_step_exploded};
pub use tag::Ifds;