Svadev mailing list

[John Criswell <criswell AT illinois.edu>]

On 12/21/11 4:45 PM, Sean McBride wrote:
> On Wed, 21 Dec 2011 16:38:09 -0600, John Criswell said:
>
> > I haven't tried SAFECode on Objective-C and Objective-C++ programs, so
> > there's a good chance that it won't work.  That said, this looks like a
> > bug that could trigger in C/C++ applications.
> Ah.  Can you give me a rough idea of where SAFECode is known to work?  ie with 
> something more than toy examples, or large C/C++ codebases too?  Can it 
> build&  analyze clang itself for example?

We've run SAFECode on GNU flex, GNU zip, GNU tar, Bonjour, and the 
DotGNU C# compiler (which is about 300,000 source lines of code).  It 
found an unknown buffer overflow in Bonjour (which we reported to Apple) 
and two invalid strcpy() calls in one of the DotGNU utilities.

We compiled these programs using our libLTO extension which performs 
whole-program, inter-procedural points-to analysis and makes the 
run-time checks more stringent (i.e., they can catch more errors).  
There is still some work to do to make the points-to analysis consume 
less memory (which is why the install directions don't mention libLTO at 
present), but hopefully we'll get that fixed soon.
> > Can you send to the list a small Objective-C++ program that reproduces
> > the error?
> I will try...

Thanks.

> > Can you try the compile with an unmodified Clang from LLVM 3.0?
> I could, but I do know that this codebase builds with the gcc, llvm-gcc, and 
> clang included in both Xcode 3.2.6 and 4.2, as well as with clang trunk from 
> a few weeks ago.  I suspect it would build with clang 3.

Okay.  I'm just wondering if it's a problem with the original Clang upon 
which SAFECode is based or the changes we made to integrate SAFECode 
into Clang.


> I got a smaller Obj-C app to compile and link and run.  I introduced a buffer 
> overrun but it was not caught, or I'm not looking in the right place for the 
> output.  I checked in both Xcode's console and Console.app.

Hrm.  How do you create the out-of-bounds pointer?  Do you dereference 
the out of bounds pointer, or do you merely create it?  SAFECode permits 
pointers to go out-of-bounds; it only creates an error alert if the 
out-of-bounds pointer is used in a load or store.

-- John T.

> Cheers,