Skip to content

[PR] Apply multiple sanitizers #166

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
elazaro-riverside merged 4 commits into from
Mar 31, 2026
+18 −3
Merged

[PR] Apply multiple sanitizers #166

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
13ec3a8
Vulnerability.hpp: Updating variable name to reflect usage.
Mar 25, 2026
3e5f250
CVEAssert.cpp: Changed WeaknessID field to a string. Added logic to p…
Mar 25, 2026
c58ae30
CVEAssert.cpp: WIP adding support to apply multiple sanitizers at the…
Mar 30, 2026
e7774da
CVEAssert.cpp: Use '0' as sentinel value to indicate instrument all.
Mar 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions resolve-cveassert/src/CVEAssert.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,7 @@ struct LabelCVEPass : public PassInfoMixin<LabelCVEPass> {
std::vector<Vulnerability> vulnerabilities;

enum VulnID {
ALL = 0,
STACK_BASED_BUF_OVERFLOW = 121,
HEAP_BASED_BUF_OVERFLOW = 122,
WRITE_WHAT_WHERE = 123,
Expand Down Expand Up @@ -174,6 +175,15 @@ struct LabelCVEPass : public PassInfoMixin<LabelCVEPass> {
}
}

void applyAutomaticSanitizers(Function &F, Vulnerability::RemediationStrategies strategy) {
/// applies all automatic sanitizers (operation masking excluded)
sanitizeFreeOfNonHeap(&F, strategy);
sanitizeMemInstBounds(&F, strategy);
sanitizeNullPointers(&F, strategy);
sanitizeDivideByZero(&F, strategy);
sanitizeIntOverflow(&F, strategy);
}

/// For each function, if it matches the target function name, insert calls to
/// the vulnerability handlers as specified in the JSON. Each call receives
/// the triggering argument parsed from the JSON.
Expand Down Expand Up @@ -259,6 +269,11 @@ struct LabelCVEPass : public PassInfoMixin<LabelCVEPass> {
result = PreservedAnalyses::none();
break;

case VulnID::ALL:
applyAutomaticSanitizers(F, vuln.Strategy);
result = PreservedAnalyses::none();
break;

default:
errs() << "[CVEAssert] Error: CWE " << vuln.WeaknessID
<< " not implemented\n";
Expand Down
6 changes: 3 additions & 3 deletions resolve-cveassert/src/Vulnerability.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,8 +52,8 @@ struct Vulnerability {
return std::nullopt;
}

auto vulnType = jsonObj->getString("cwe-id");
if (!vulnType) {
auto vulnID = jsonObj->getString("cwe-id");
if (!vulnID) {
llvm::errs() << "[CVEAssert] Error: No 'cwe-id' field found in JSON.\n";
return std::nullopt;
}
Expand Down Expand Up @@ -95,7 +95,7 @@ struct Vulnerability {

Vulnerability vuln{
targetFile->str(), targetFunction->str(),
static_cast<uint32_t>(std::stoi(vulnType->str())),
static_cast<uint32_t>(std::stoi(vulnID->str())),
undesirableFunction, strategy,
};
return std::make_optional(vuln);
Expand Down