ClCombinePointerLabelsOnLoad ("dfsan-combine-pointer-labels-on-load", cl::desc("Combine the label of the pointer with the label of the data when " "loading from memory."), cl::Hidden, cl::init(true))
ClCombinePointerLabelsOnStore ("dfsan-combine-pointer-labels-on-store", cl::desc("Combine the label of the pointer with the label of the data when " "storing in memory."), cl::Hidden, cl::init(false))
ClCombineOffsetLabelsOnGEP ("dfsan-combine-offset-labels-on-gep", cl::desc("Combine the label of the offset with the label of the pointer when " "doing pointer arithmetic."), cl::Hidden, cl::init(true))
ClCombineTaintLookupTables ("dfsan-combine-taint-lookup-table", cl::desc("When dfsan-combine-offset-labels-on-gep and/or " "dfsan-combine-pointer-labels-on-load are false, this flag can " "be used to re-enable combining offset and/or pointer taint when " "loading specific constant global variables (i.e. lookup tables)."), cl::Hidden)
ClDebugNonzeroLabels ("dfsan-debug-nonzero-labels", cl::desc("Insert calls to __dfsan_nonzero_label on observing a parameter, " "load or return with a nonzero label"), cl::Hidden)
ClIgnorePersonalityRoutine ("dfsan-ignore-personality-routine", cl::desc("If a personality routine is marked uninstrumented from the ABI " "list, do not create a wrapperfor it."), cl::Hidden, cl::init(false))
This file is a part of DataFlowSanitizer, a generalised dynamic data flow analysis.
Unlike other Sanitizer tools, this tool is not designed to detect a specific class of bugs on its own. Instead, it provides a generic dynamic data flow analysis framework to be used by clients to help detect application-specific issues within their own code.
The analysis is based on automatic propagation of data flow labels (also known as taint labels) through a program as it performs computation.
Argument and return value labels are passed through TLS variables __dfsan_arg_tls and __dfsan_retval_tls.
Each byte of application memory is backed by a shadow memory byte. The shadow byte can represent up to 8 labels. On Linux/x86_64, memory is then laid out as follows:
cl::opt< bool > ClAddGlobalNameSuffix("dfsan-add-global-name-suffix", cl::desc("Whether to add .dfsan suffix to global names"), cl::Hidden, cl::init(true)) ( "dfsan-add-global-name-suffix" , cl::desc("Whether to add .dfsan suffix to global names") , cl::Hidden , cl::init(true) )
cl::opt< bool > ClCombineOffsetLabelsOnGEP("dfsan-combine-offset-labels-on-gep", cl::desc( "Combine the label of the offset with the label of the pointer when " "doing pointer arithmetic."), cl::Hidden, cl::init(true)) ( "dfsan-combine-offset-labels-on-gep" , cl::desc( "Combine the label of the offset with the label of the pointer when " "doing pointer arithmetic.") , cl::Hidden , cl::init(true) )
cl::opt< bool > ClCombinePointerLabelsOnLoad("dfsan-combine-pointer-labels-on-load", cl::desc("Combine the label of the pointer with the label of the data when " "loading from memory."), cl::Hidden, cl::init(true)) ( "dfsan-combine-pointer-labels-on-load" , cl::desc("Combine the label of the pointer with the label of the data when " "loading from memory.") , cl::Hidden , cl::init(true) )
cl::opt< bool > ClCombinePointerLabelsOnStore("dfsan-combine-pointer-labels-on-store", cl::desc("Combine the label of the pointer with the label of the data when " "storing in memory."), cl::Hidden, cl::init(false)) ( "dfsan-combine-pointer-labels-on-store" , cl::desc("Combine the label of the pointer with the label of the data when " "storing in memory.") , cl::Hidden , cl::init(false) )
cl::list< std::string > ClCombineTaintLookupTables("dfsan-combine-taint-lookup-table", cl::desc( "When dfsan-combine-offset-labels-on-gep and/or " "dfsan-combine-pointer-labels-on-load are false, this flag can " "be used to re-enable combining offset and/or pointer taint when " "loading specific constant global variables (i.e. lookup tables)."), cl::Hidden) ( "dfsan-combine-taint-lookup-table" , cl::desc( "When dfsan-combine-offset-labels-on-gep and/or " "dfsan-combine-pointer-labels-on-load are false, this flag can " "be used to re-enable combining offset and/or pointer taint when " "loading specific constant global variables (i.e. lookup tables).") , cl::Hidden )
cl::opt< bool > ClDebugNonzeroLabels("dfsan-debug-nonzero-labels", cl::desc("Insert calls to __dfsan_nonzero_label on observing a parameter, " "load or return with a nonzero label"), cl::Hidden) ( "dfsan-debug-nonzero-labels" , cl::desc("Insert calls to __dfsan_nonzero_label on observing a parameter, " "load or return with a nonzero label") , cl::Hidden )
cl::opt< bool > ClEventCallbacks("dfsan-event-callbacks", cl::desc("Insert calls to __dfsan_*_callback functions on data events."), cl::Hidden, cl::init(false)) ( "dfsan-event-callbacks" , cl::desc("Insert calls to __dfsan_*_callback functions on data events.") , cl::Hidden , cl::init(false) )
cl::opt< bool > ClIgnorePersonalityRoutine("dfsan-ignore-personality-routine", cl::desc("If a personality routine is marked uninstrumented from the ABI " "list, do not create a wrapperfor it."), cl::Hidden, cl::init(false)) ( "dfsan-ignore-personality-routine" , cl::desc("If a personality routine is marked uninstrumented from the ABI " "list, do not create a wrapperfor it.") , cl::Hidden , cl::init(false) )