umnsec/crix

MLTA not restricting indirect call targets by struct types

Closed this issue · 1 comments

Paper https://www-users.cs.umn.edu/~kjlu/papers/crix.pdf describes Two-Layer Type Analysis that refines type analysis by restricting the indirect call targets based on struct types. It appears in the code this is referred as MLTA, and implemented in function findCalleesWithMLTA in file CallGraph.cc. However, I notice the code seems to be missing the second layer refinement based on the struct types. You apparently collect struct type definitions to CallGraphPass::typeConfineMap, but it is not used anywhere to actually refine the call targets.

Is the published version perhaps not the final version of the code?

Indeed, typeConfineMap is not used and should have been removed.
The actual map for maintaining collected targets for structs is: typeFuncsMap. It is also used for the struct-type matching.