[analyzer] Support partially tainted records.
authorArtem Dergachev <artem.dergachev@gmail.com>
Mon, 29 May 2017 15:42:56 +0000 (15:42 +0000)
committerArtem Dergachev <artem.dergachev@gmail.com>
Mon, 29 May 2017 15:42:56 +0000 (15:42 +0000)
commiteed7a3102c51d863ff9035d31a33313e77364692
tree1513579135006000236c91d69cbe271a2995f7e5
parent4c4baf5093c808f41044f32ddef0c62855f1b39c
[analyzer] Support partially tainted records.

The analyzer's taint analysis can now reason about structures or arrays
originating from taint sources in which only certain sections are tainted.

In particular, it also benefits modeling functions like read(), which may
read tainted data into a section of a structure, but RegionStore is incapable of
expressing the fact that the rest of the structure remains intact, even if we
try to model read() directly.

Patch by Vlad Tsyrklevich!

Differential revision: https://reviews.llvm.org/D28445

llvm-svn: 304162
clang/include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h
clang/include/clang/StaticAnalyzer/Core/PathSensitive/TaintManager.h
clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
clang/lib/StaticAnalyzer/Core/ProgramState.cpp
clang/lib/StaticAnalyzer/Core/RegionStore.cpp
clang/test/Analysis/taint-generic.c