mirror of
https://github.com/hohn/codeql-workshop-dataflow-c.git
synced 2025-12-15 18:23:04 +01:00
Add some source<->CFG node annotations
This commit is contained in:
Michael Hohn
committed by
=Michael Hohn
=Michael Hohn
parent
cc088b2d9e
commit
9f4a8fe033
214
cfg.dot/cpp/cfg-annotated.dot
Normal file
214
cfg.dot/cpp/cfg-annotated.dot
Normal file
@@ -0,0 +1,214 @@
|
||||
digraph {
|
||||
compound=true;
|
||||
0[label="ExprStmt (0)"; ];
|
||||
1[label="call to memcpy (1)"; ];
|
||||
2[label="input (2)"; ];
|
||||
3[label="0 (3)"; ];
|
||||
4[label="access to array (4)"; ];
|
||||
5[label="ptr (5)"; ];
|
||||
6[label="buf (6)"; ];
|
||||
7[label="input (7)"; ];
|
||||
8[label="1 (8)"; ];
|
||||
9[label="access to array (9)"; ];
|
||||
10[label="ptr (10)"; ];
|
||||
11[label="buf (11)"; ];
|
||||
12[label="input (12)"; ];
|
||||
13[label="1 (13)"; ];
|
||||
14[label="access to array (14)"; ];
|
||||
15[label="ptr (15)"; ];
|
||||
16[label="size (16)"; ];
|
||||
17[label="ExprStmt (17)"; ];
|
||||
18[label="call to copy_mem_nested (18)"; ];
|
||||
19[label="input (19)"; ];
|
||||
20[label="if (...) ... (20)"; ];
|
||||
21[label="input_types (21)"; ];
|
||||
22[label="call to DYN_INPUT_TYPE (22)"; ];
|
||||
23[label="1 (23)"; ];
|
||||
24[label="1 (24)"; ];
|
||||
25[label="... != ... (25)"; ];
|
||||
26[label="{ ... } (26)"; ];
|
||||
27[label="ExprStmt (27)"; ];
|
||||
28[label="call to memcpy (28)"; ];
|
||||
29[label="input (29)"; ];
|
||||
30[label="0 (30)"; ];
|
||||
31[label="access to array (31)"; ];
|
||||
32[label="ptr (32)"; ];
|
||||
33[label="buf (33)"; ];
|
||||
34[label="input (34)"; ];
|
||||
35[label="1 (35)"; ];
|
||||
36[label="access to array (36)"; ];
|
||||
37[label="ptr (37)"; ];
|
||||
38[label="buf (38)"; ];
|
||||
39[label="input (39)"; ];
|
||||
40[label="1 (40)"; ];
|
||||
41[label="access to array (41)"; ];
|
||||
42[label="ptr (42)"; ];
|
||||
43[label="size (43)"; ];
|
||||
44[label="ExprStmt (44)"; ];
|
||||
45[label="call to copy_mem_nested (45)"; ];
|
||||
46[label="input (46)"; ];
|
||||
47[label="if (...) ... (47)"; ];
|
||||
48[label="call to DYN_INPUT_TYPE (48)"; ];
|
||||
49[label="1 (49)"; ];
|
||||
50[label="1 (50)"; ];
|
||||
51[label="100 (51)"; ];
|
||||
52[label="... == ... (52)"; ];
|
||||
53[label="ExprStmt (53)"; ];
|
||||
54[label="call to memcpy (54)"; ];
|
||||
55[label="input (55)"; ];
|
||||
56[label="0 (56)"; ];
|
||||
57[label="access to array (57)"; ];
|
||||
58[label="ptr (58)"; ];
|
||||
59[label="buf (59)"; ];
|
||||
60[label="input (60)"; ];
|
||||
61[label="1 (61)"; ];
|
||||
62[label="access to array (62)"; ];
|
||||
63[label="ptr (63)"; ];
|
||||
64[label="buf (64)"; ];
|
||||
65[label="input (65)"; ];
|
||||
66[label="1 (66)"; ];
|
||||
67[label="access to array (67)"; ];
|
||||
68[label="ptr (68)"; ];
|
||||
69[label="size (69)"; ];
|
||||
70[label="{ ... } (70)"; ];
|
||||
71[label="if (...) ... (71)"; ];
|
||||
72[label="input_types (72)"; ];
|
||||
73[label="call to DYN_INPUT_TYPE (73)"; ];
|
||||
74[label="1 (74)"; ];
|
||||
75[label="1 (75)"; ];
|
||||
76[label="... != ... (76)"; ];
|
||||
77[label="return ... (77)"; ];
|
||||
78[label="1 (78)"; ];
|
||||
79[label="{ ... } (79)"; ];
|
||||
80[label="ExprStmt (80)"; ];
|
||||
81[label="call to memcpy (81)"; ];
|
||||
82[label="input (82)"; ];
|
||||
83[label="0 (83)"; ];
|
||||
84[label="access to array (84)"; ];
|
||||
85[label="ptr (85)"; ];
|
||||
86[label="buf (86)"; ];
|
||||
87[label="input (87)"; ];
|
||||
88[label="1 (88)"; ];
|
||||
89[label="access to array (89)"; ];
|
||||
90[label="ptr (90)"; ];
|
||||
91[label="buf (91)"; ];
|
||||
92[label="input (92)"; ];
|
||||
93[label="1 (93)"; ];
|
||||
94[label="access to array (94)"; ];
|
||||
95[label="ptr (95)"; ];
|
||||
96[label="size (96)"; ];
|
||||
97[label="ExprStmt (97)"; ];
|
||||
98[label="call to copy_mem_nested (98)"; ];
|
||||
99[label="input (99)"; ];
|
||||
100[label="return ... (100)"; ];
|
||||
101[label="0 (101)"; ];
|
||||
102[label="{ ... } (102)"; ];
|
||||
103[label="copy_mem (103)"; ];
|
||||
|
||||
0 -> 2[];
|
||||
1 -> 17[];
|
||||
2 -> 3[];
|
||||
3 -> 4[];
|
||||
4 -> 5[];
|
||||
5 -> 6[];
|
||||
6 -> 7[];
|
||||
7 -> 8[];
|
||||
8 -> 9[];
|
||||
9 -> 10[];
|
||||
10 -> 11[];
|
||||
11 -> 12[];
|
||||
12 -> 13[];
|
||||
13 -> 14[];
|
||||
14 -> 15[];
|
||||
15 -> 16[];
|
||||
16 -> 1[];
|
||||
17 -> 19[];
|
||||
18 -> 20[];
|
||||
19 -> 18[];
|
||||
20 -> 21[];
|
||||
21 -> 23[];
|
||||
22 -> 25[];
|
||||
23 -> 24[];
|
||||
24 -> 22[];
|
||||
25 -> 26[];
|
||||
25 -> 27[];
|
||||
26 -> 27[];
|
||||
27 -> 29[];
|
||||
28 -> 44[];
|
||||
29 -> 30[];
|
||||
30 -> 31[];
|
||||
31 -> 32[];
|
||||
32 -> 33[];
|
||||
33 -> 34[];
|
||||
34 -> 35[];
|
||||
35 -> 36[];
|
||||
36 -> 37[];
|
||||
37 -> 38[];
|
||||
38 -> 39[];
|
||||
39 -> 40[];
|
||||
40 -> 41[];
|
||||
41 -> 42[];
|
||||
42 -> 43[];
|
||||
43 -> 28[];
|
||||
44 -> 46[];
|
||||
45 -> 47[];
|
||||
46 -> 45[];
|
||||
47 -> 49[];
|
||||
48 -> 51[];
|
||||
49 -> 50[];
|
||||
50 -> 48[];
|
||||
51 -> 52[];
|
||||
52 -> 70[];
|
||||
52 -> 71[];
|
||||
53 -> 55[];
|
||||
54 -> 71[];
|
||||
55 -> 56[];
|
||||
56 -> 57[];
|
||||
57 -> 58[];
|
||||
58 -> 59[];
|
||||
59 -> 60[];
|
||||
60 -> 61[];
|
||||
61 -> 62[];
|
||||
62 -> 63[];
|
||||
63 -> 64[];
|
||||
64 -> 65[];
|
||||
65 -> 66[];
|
||||
66 -> 67[];
|
||||
67 -> 68[];
|
||||
68 -> 69[];
|
||||
69 -> 54[];
|
||||
70 -> 53[];
|
||||
71 -> 72[];
|
||||
72 -> 74[];
|
||||
73 -> 76[];
|
||||
74 -> 75[];
|
||||
75 -> 73[];
|
||||
76 -> 79[];
|
||||
76 -> 80[];
|
||||
77 -> 78[];
|
||||
78 -> 103[];
|
||||
79 -> 77[];
|
||||
80 -> 82[];
|
||||
81 -> 97[];
|
||||
82 -> 83[];
|
||||
83 -> 84[];
|
||||
84 -> 85[];
|
||||
85 -> 86[];
|
||||
86 -> 87[];
|
||||
87 -> 88[];
|
||||
88 -> 89[];
|
||||
89 -> 90[];
|
||||
90 -> 91[];
|
||||
91 -> 92[];
|
||||
92 -> 93[];
|
||||
93 -> 94[];
|
||||
94 -> 95[];
|
||||
95 -> 96[];
|
||||
96 -> 81[];
|
||||
97 -> 99[];
|
||||
98 -> 100[];
|
||||
99 -> 98[];
|
||||
100 -> 101[];
|
||||
101 -> 103[];
|
||||
102 -> 0[];
|
||||
}
|
||||
BIN
cfg.dot/cpp/cfg-annotated.pdf
Normal file
BIN
cfg.dot/cpp/cfg-annotated.pdf
Normal file
Binary file not shown.
1272
cfg.dot/cpp/cfg-annotated.svg
Normal file
1272
cfg.dot/cpp/cfg-annotated.svg
Normal file
File diff suppressed because it is too large
Load Diff
|
After Width: | Height: | Size: 58 KiB |
@@ -96,23 +96,55 @@
|
||||
#+ATTR_HTML: :width 100%
|
||||
[[./cfg.dot/cpp/ast-cfg-hybrid.svg]]
|
||||
|
||||
* Hybrid portion of source code
|
||||
The part of the source code corresponding to the hybrid portion, with space for
|
||||
adding edges:
|
||||
* CFG with numbered nodes
|
||||
The CFG with node numbering is inlined here. For better viewing, open the
|
||||
pdf ([[./cfg.dot/cpp/cfg-annotated.pdf]]) separately.
|
||||
#+ATTR_HTML: :width 100%
|
||||
[[./cfg.dot/cpp/cfg-annotated.svg]]
|
||||
|
||||
As before, this graph is rendered via dot:
|
||||
#+BEGIN_SRC sh
|
||||
dot -Tpdf < cfg.dot/cpp/cfg-annotated.dot > cfg.dot/cpp/cfg-annotated.pdf
|
||||
dot -Tsvg < cfg.dot/cpp/cfg-annotated.dot > cfg.dot/cpp/cfg-annotated.svg
|
||||
|
||||
# View the graph
|
||||
open -a skim cfg.dot/cpp/cfg-annotated.pdf
|
||||
|
||||
#+END_SRC
|
||||
|
||||
|
||||
* Source Annotated with CFG Nodes
|
||||
The CFG entries
|
||||
#+BEGIN_SRC text
|
||||
0[label="ExprStmt (0)"; ];
|
||||
1[label="call to memcpy (1)"; ];
|
||||
2[label="input (2)"; ];
|
||||
3[label="0 (3)"; ];
|
||||
4[label="access to array (4)"; ];
|
||||
5[label="ptr (5)"; ];
|
||||
6[label="buf (6)"; ];
|
||||
7[label="input (7)"; ];
|
||||
8[label="1 (8)"; ];
|
||||
9[label="access to array (9)"; ];
|
||||
10[label="ptr (10)"; ];
|
||||
11[label="buf (11)"; ];
|
||||
#+END_SRC
|
||||
are located in the source code as follows
|
||||
#+BEGIN_SRC c++
|
||||
int copy_mem(unsigned int unused, dyn_input_t *input,
|
||||
|
||||
|
||||
unsigned int input_types) {
|
||||
unsigned int input_types) {
|
||||
0
|
||||
|
||||
memcpy(input[0].ptr.buf, input[1].ptr.buf,
|
||||
1 2 3 7 8
|
||||
4 5 6 9 10 11
|
||||
|
||||
input[1].ptr.size);
|
||||
|
||||
|
||||
memcpy(input[0].ptr.buf, input[1].ptr.buf,
|
||||
|
||||
|
||||
input[1].ptr.size);
|
||||
|
||||
|
||||
copy_mem_nested(input);
|
||||
copy_mem_nested(input);
|
||||
|
||||
...;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user