@@ -37,51 +37,55 @@ public boolean visit(
3737 CheckToolWithAnalysisResults <
3838 SimpleAbstractState <MonolithicHeap , RelationalTaintAbstractDomain ,
3939 TypeEnvironment <InferredTypes >>> tool ,
40- CFG graph , Statement node ) {
40+ CFG graph ,
41+ Statement node ) {
4142
4243 EVMCFG cfg = ((EVMCFG ) graph );
4344
44- if (node instanceof Jumpi )
45+ if (node instanceof Jumpi ) {
4546 for (AnalyzedCFG <SimpleAbstractState <MonolithicHeap , RelationalTaintAbstractDomain ,
4647 TypeEnvironment <InferredTypes >>> result : tool .getResultOf (cfg )) {
48+
4749 AnalysisState <SimpleAbstractState <MonolithicHeap , RelationalTaintAbstractDomain ,
48- TypeEnvironment <InferredTypes >>> analysisResult = null ;
50+ TypeEnvironment <InferredTypes >>> analysisResult ;
51+ RelationalTaintAbstractDomain taintedStack ;
4952
5053 try {
5154 analysisResult = result .getAnalysisStateBefore (node );
55+ taintedStack = analysisResult .getState ().getValueState ();
5256 } catch (SemanticException e1 ) {
5357 log .error ("(ProtectedFunctionFinder): {}" , e1 .getMessage ());
58+ continue ;
5459 }
5560
56- RelationalTaintAbstractDomain taintedStack = analysisResult .getState ().getValueState ();
57-
58- if (taintedStack .isBottom () || taintedStack .isTop ())
61+ if (taintedStack == null || taintedStack .isBottom () || taintedStack .isTop ())
5962 continue ;
6063
6164 RelationalTaintElement elem1 = taintedStack .getElementAtPosition (1 );
6265 RelationalTaintElement elem2 = taintedStack .getElementAtPosition (2 );
6366
6467 if (RelationalTaintElement .isAtLeastOneTainted (elem1 , elem2 )) {
65- // Track program points sanitized by this specific Jumpi
6668 Set <Integer > jumpiPps = new HashSet <>();
67- if (elem1 .isTaint ()) {
69+
70+ if (elem1 .isTaint ())
6871 jumpiPps .addAll (elem1 .getProgramPoints ());
69- }
70- if (elem2 .isTaint ()) {
72+ if (elem2 .isTaint ())
7173 jumpiPps .addAll (elem2 .getProgramPoints ());
72- }
74+
7375 checkForProtection (node , cfg , jumpiPps );
7476 }
7577 }
76-
78+ }
7779 return true ;
7880 }
7981
8082 private void checkForProtection (Statement sink , EVMCFG cfg , Set <Integer > jumpiPps ) {
8183 Set <Signature > functionsSignature = contract .getFunctionsSignature ();
84+ if (functionsSignature == null )
85+ return ;
8286
8387 for (Signature functionSignature : functionsSignature ) {
84- log .debug ("Checking: {} that has {} entrypoints " , functionSignature .getFullSignature (),
88+ log .debug ("Checking: {} that has {} entry points " , functionSignature .getFullSignature (),
8589 functionSignature .getEntryPoints ().size ());
8690
8791 for (Statement functionEntryPoint : functionSignature .getEntryPoints ()) {
@@ -106,6 +110,5 @@ private void checkForProtection(Statement sink, EVMCFG cfg, Set<Integer> jumpiPp
106110 }
107111 }
108112 }
109-
110113 }
111114}
0 commit comments