Swap Detector
Module that checks for swapped arguments in function calls. For instance, the library can be used to detect swaps in code like:
/* Apparent swap of 'e' and 'n' based on parameter names. */
RSA_get0_key(rkey, &e, &n, NULL);Prerequisites
- CMake 3.10
- GCC 7 or Visual Studio 2017
- If enabling Clang plugin support: Clang 10 source
Getting Started
Setup for building Clang
- Check out Clang from git.
git clone https://github.com/llvm/llvm-project.git
git checkout llvmorg-10.0.0- Build and install LLVM.
mkdir llvm-build; pushd llvm-build
cmake -G Ninja -DCMAKE_BUILD_TYPE=RelWithDebInfo -DLLVM_ENABLE_ASSERTIONS=1 -DLLVM_TARGETS_TO_BUILD=X86 -DLLVM_INSTALL_UTILS=1 -DLLVM_ENABLE_PROJECTS=clang -DLLVM_TOOL_CLANG_BUILD=1 -DCMAKE_INSTALL_PREFIX=$PWD/../llvm-install ../llvm-src
cmake --build . --target check-clang
cmake --build . --target install
popd- Install lit. Optional but required to be able to run tests.
pip install --user lit
export PATH=$PATH:$HOME/.local/binUse cmake to build the plugin
mkdir build; cd build
cmake -G Ninja -DLLVM_EXTERNAL_LIT=$(which lit) -DSWAPPED_ARGS_BUILD_CLANG_PLUGIN=ON -DCMAKE_PREFIX_PATH=$PWD/../../llvm-install/lib/cmake ~/path/to/swap-detector
cmake --build . --target check-allNotes
If you don't have Ninja installed, you can use -G "Unix Makefiles" to generate makefiles instead and build using make -j.
There is a linker warning about use of tmpnam. This API is only used by the testing infrastructure to generate a temporary statistics database, and is not used as part of the swapped argument checker API.
Example
../../llvm-install/bin/scan-build -load-plugin lib/SwapDetectorPlugin.so -enable-checker gt.SwapDetector -analyzer-config gt.SwapDetector:ModelPath=sample.db clang++ ~/dummy.cppThe root directory of the repository has a sample database, named sample.db,
which can be used to explore the behavior of the library. This database is not
complete (it only covers ten functions), but does contain statistically useful
information about the functions it covers.
Configuration Options
| Option | Description |
|---|---|
SWAPPED_ARGS_BUILD_CLANG_PLUGIN |
Enables building the Clang plugin. Default: ON |
SWAPPED_ARGS_BUILD_TESTS |
Enables building tests. Default: ON |
SWAPPED_ARGS_BUILD_PYTHON |
Enables building the Python extension. Default: Off |
SWAPPED_ARGS_INSTALL_PYTHON |
Enables installing the Python extension if it's been built. Default: Off |
Automatic Downloads
As part of the CMake configuration, the latest master branch of googletest is downloaded and built if testing functionality is enabled.
Testing
To run the C++ unit tests, ensure that SWAPPED_ARGS_BUILD_TESTS is not
disabled when configuring the cmake project. The TestSwappedArgsCpp executable
will be generated on successful build and can be run to perform unit testing.
To run the Clang plugin tests, you can execute cmake --build . --target check-all from the CMake build directory.
Research Paper
We expand on the concepts and algorithms behind Swap Detector in a research paper, published in the 2020 IEEE Source Code Analysis and Manipulation Conference. Note that not all algorithms, heuristics, and features described in the research paper are present in this implementation.
Acknowledgements
This material is based on research sponsored by the Department of Homeland Security (DHS) Office of Procurement Operations, S&T acquisition Division via contract number 70RSAT19C00000056. The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of the Department of Homeland Security.