Enum TaintedType

pub enum TaintedType {
    UntaintedValue,
    TaintedValue,
    UntaintedPointer(Pointee),
    TaintedPointer(Pointee),
    ArrayOrVector(Pointee),
    Struct(Vec<Pointee>),
    NamedStruct(String),
    UntaintedFnPtr,
    TaintedFnPtr,
}

The type system which we use for taint-tracking

Variants

UntaintedValue

An untainted value which is not a pointer, struct, array, or vector.

TaintedValue

A tainted value which is not a pointer, struct, array, or vector.

UntaintedPointer(Pointee)

An untainted pointer to either a scalar or an (implicit) array. By implicit we mean that this represents LLVM i8*, not LLVM [300 x i8]*.

TaintedPointer(Pointee)

A tainted pointer to either a scalar or an (implicit) array. By implicit we mean that this represents LLVM i8*, not LLVM [300 x i8]*.

ArrayOrVector(Pointee)

An array or vector, with the given element type (and any number of elements). All elements are assumed to have the same type, which means that if any of them is tainted, all of them are tainted.

Struct(Vec<Pointee>)

A struct, with the given element types

NamedStruct(String)

A named struct, with the given name. To get the actual type of the named struct’s contents, use get_named_struct_type in the TaintState or TaintResult. (This avoids infinite recursion in TaintedType.)

UntaintedFnPtr

An untainted function pointer

TaintedFnPtr

A tainted function pointer

Implementations

impl TaintedType

pub fn untainted_ptr_to(pointee: TaintedType) -> Self

Create a (fresh, unaliased) pointer to the given TaintedType

pub fn tainted_ptr_to(pointee: TaintedType) -> Self

Create a (fresh, unaliased) tainted pointer to the given TaintedType

pub fn untainted_ptr_to_pointee(pointee: Pointee) -> Self

Create a pointer to the given Pointee

pub fn tainted_ptr_to_pointee(pointee: Pointee) -> Self

Create a tainted pointer to the given Pointee

pub fn array_or_vec_of(element_ty: TaintedType) -> Self

Create an array or vector with the given element type, assuming that no pointers to the elements already exist

pub fn array_or_vec_of_pointee(pointee: Pointee) -> Self

Create an array or vector with the given Pointee as its element type

pub fn struct_of(elements: impl IntoIterator<Item = TaintedType>) -> Self

Create a struct of the given elements, assuming that no pointers to those elements already exist

pub fn struct_of_pointees(elements: impl IntoIterator<Item = Pointee>) -> Self

Create a struct of the given Pointees

pub fn from_llvm_type(llvm_ty: &Type) -> Self

Produce the equivalent (untainted) TaintedType for a given LLVM type. Pointers will point to fresh TaintedTypes to represent their element types; they will be assumed not to point to existing variables.

pub fn is_tainted_nonamedstruct(&self) -> bool

Is this type tainted?

This function panics on named struct types. (It does work on array, vector, and anonymous struct types, as long as the element type isn’t a named struct type.)

For a more generic function that works on all types, use TaintedType::is_tainted() (below), TaintState::is_type_tainted(), or TaintResult::is_type_tainted().

pub fn is_tainted<'m>( &self, named_structs: Rc<RefCell<NamedStructs<'m>>>, cur_fn: &'m str, ) -> bool

Is this type tainted?

This function handles all types, including named struct types.

Alternately you can also use TaintState::is_type_tainted() or TaintResult::is_type_tainted().

pub fn taint_contents<'m>(&self, named_structs: &mut NamedStructs<'m>)

Mark everything pointed to by this pointer as tainted.

Recurses into structs/arrays/vectors, but not pointers:

• if this pointer points to a struct/array/vector, we will taint all elements of that struct/array/vector
• if this pointer points to another pointer P, we will taint P, but not things pointed to by P. Of course, if config.dereferencing_tainted_ptr_gives_tainted is true, then things pointed to by P will also become tainted if they are ever loaded through P.

Trait Implementations

impl Clone for TaintedType

fn clone(&self) -> TaintedType

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TaintedType

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for TaintedType

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl PartialEq for TaintedType

fn eq(&self, other: &TaintedType) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for TaintedType

impl StructuralPartialEq for TaintedType