Use of points-to analysis (PTA) to get indirect edges
- Dominant language
- C
- Stars
- 31
- Forks
- 6
- PR merge metrics
- No merged PRs in 30d
Description
First, really cool work! :)
I was experimenting with your prototype and found out that it takes a really long time and memory to compute the graphs in the server component (SVF) for some large real-world programs, regardless of the use of the `--get-indirect` flag.
Digging into the code I see that regardless of the `--get-indirect` flag it's computing a full pointer analysis: https://github.com/HexHive/SieveFuzz/blob/1751673ed6c56b7dc69b71ef07ace49867e3cfa4/patches/svf/svf-ex.cpp#L101-L113
For reference, see SVF's code:
- `createAndersenWaveDiff` calls `analyze`: https://github.com/SVF-tools/SVF/blob/a99ee34ed34a67ce72f028ca9dbd8005b5463d05/include/WPA/Andersen.h#L427-L436
- `Andersen::analyze`: https://github.com/SVF-tools/SVF/blob/a99ee34ed34a67ce72f028ca9dbd8005b5463d05/lib/WPA/Andersen.cpp#L106-L128
Hence, regardless of the `--get-indirect` flag, SieveFuzz is using a call graph augmented with the indirect edges found by PTA.
In case the `--get-indirect` flag is given, it will also add the indirect edges from the PTA to the ICFG.
Given that the paper does not discuss the use of PTA, I was wondering if the intended use of SieveFuzz (i.e. what is evaluated in the paper) is with or without PTA and the `--get-indirect` flag.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.