Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Miss locations for variable declaration inside method #431

Open
Ao-senXiong opened this issue Dec 2, 2023 · 0 comments
Open

Miss locations for variable declaration inside method #431

Ao-senXiong opened this issue Dec 2, 2023 · 0 comments

Comments

@Ao-senXiong
Copy link

Conside the code for security-demo,

public class Demo {
        String[] arr = new String[1];
        String a = new String("a");
        String b = "b";
        void test() {
           String[] arr = new String[1];
           String a = new String("a");
           String b = "b";
        }

        Demo(){
           String[] arr = new String[1];
           String a = new String("a");
           String b = "b";
        }
}

After run ./run-security.sh Demo.java use the debug solver, the output is

import checkers.inference.qual.VarAnnot;
@VarAnnot(15)
public class Demo {
        @VarAnnot(5)
        String @VarAnnot(4) [] arr = new @VarAnnot(8) String @VarAnnot(7) [((@VarAnnot(6) int) (1))];
        @VarAnnot(9)
        String a = new @VarAnnot(11) String(((@VarAnnot(10) String) ("a")));
        @VarAnnot(12)
        String b = ((@VarAnnot(13) String) ("b"));
        void test(@VarAnnot(43) Demo this) {
           @VarAnnot(20)
           String[] arr = new @VarAnnot(18) String @VarAnnot(17) [((@VarAnnot(16) int) (1))];
           String a = new @VarAnnot(23) String(((@VarAnnot(22) String) ("a")));
           String b = ((@VarAnnot(26) String) ("b"));
        }

        @VarAnnot(29)
        Demo(){
           @VarAnnot(34)
           String[] arr = new @VarAnnot(32) String @VarAnnot(31) [((@VarAnnot(30) int) (1))];
           String a = new @VarAnnot(37) String(((@VarAnnot(36) String) ("a")));
           String b = ((@VarAnnot(40) String) ("b"));
        }
}

There is no arraytype and Object on the lhs for variable declaration inside method. Since the security demo did not override any method from CFI, this should be improved in framework level.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant