polytracker

polytracker copied to clipboard

Taint argv

1

Have an option to treat `argv` as a taint source

ESultanik

Uninstrumented functions

4

These are currently uninstrumented functions that we should probably support: - [x] `bcmp` - [x] `bindtextdomain` - [x] `dirname` - [x] `fgetc` - [x] `fseeko` - [x] `mbtowc` - [...

ESultanik

As requested by @carsonharmon, trace collection for `libsndfile` is stalling + the DB is getting pretty huge with/without `POLYTRACE=1`.

stevenagy

Its not optimal to check if we've hit main to start tracking, it adds additional branches on all of our logging. There are probably some systems level things we can...

carsonharmon

Call stack mismatch unwinding/handling

1

Peter pointed out that there might be a need for stack unwinding for setjmp/longjmp. We also have cases like in jq where pthread_once calls instrumented code creating a mismatch in...

carsonharmon

Peter had a really good catch, that in places like logFunctionExit I had const references which would push constant values into memory. This prevents further optimizations the compiler could do.

carsonharmon

I think when reasoning about dataflow this is important, its more overhead, but worth it and low hanging fruit.

carsonharmon

Create FunctionCall event for reasoning about uninstrumented code in post processing

carsonharmon

- [ ] Add documentation showing how to write custom wrappers for target functions ~- [ ] Create an interface for creating new custom taint wrappers without modifying polytracker/dfsan code~...

carsonharmon

Uniquely taint EOF

1

Every time a program reads past the end of a file, return a special taint with a new label associated with that `EOF`.

ESultanik