HexHive / HexHive/SieveFuzz

Use of points-to analysis (PTA) to get indirect edges

Open
#4 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
31
Forks
6
PR merge metrics
No merged PRs in 30d

Description

First, really cool work! :)

I was experimenting with your prototype and found out that it takes a really long time and memory to compute the graphs in the server component (SVF) for some large real-world programs, regardless of the use of the `--get-indirect` flag.

Digging into the code I see that regardless of the `--get-indirect` flag it's computing a full pointer analysis: https://github.com/HexHive/SieveFuzz/blob/1751673ed6c56b7dc69b71ef07ace49867e3cfa4/patches/svf/svf-ex.cpp#L101-L113

For reference, see SVF's code:
- `createAndersenWaveDiff` calls `analyze`: https://github.com/SVF-tools/SVF/blob/a99ee34ed34a67ce72f028ca9dbd8005b5463d05/include/WPA/Andersen.h#L427-L436
- `Andersen::analyze`: https://github.com/SVF-tools/SVF/blob/a99ee34ed34a67ce72f028ca9dbd8005b5463d05/lib/WPA/Andersen.cpp#L106-L128

Hence, regardless of the `--get-indirect` flag, SieveFuzz is using a call graph augmented with the indirect edges found by PTA.

In case the `--get-indirect` flag is given, it will also add the indirect edges from the PTA to the ICFG.

Given that the paper does not discuss the use of PTA, I was wondering if the intended use of SieveFuzz (i.e. what is evaluated in the paper) is with or without PTA and the `--get-indirect` flag.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.