Skip to content

Commit b52fc74

Browse files
committed
Fixed CalldatacopyOperator semantic in TaintAbstractDomain
1 parent 90d821c commit b52fc74

File tree

1 file changed

+13
-1
lines changed

1 file changed

+13
-1
lines changed

src/main/java/it/unipr/analysis/taint/TaintAbstractDomain.java

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -163,12 +163,24 @@ public TaintAbstractDomain smallStepSemantics(ValueExpression expression, Progra
163163
return resultStack;
164164
}
165165

166+
case "CalldatacopyOperator": {
167+
if (hasBottomUntil(3))
168+
return bottom();
169+
170+
TaintAbstractDomain resultStack = clone();
171+
resultStack.popX(3);
172+
173+
if (this.getTaintedOpcode().contains(op))
174+
return mk(resultStack.circularArray, TaintElement.TAINT);
175+
176+
return resultStack;
177+
}
178+
166179
case "BlobHashOperator":
167180
case "BalanceOperator":
168181
case "BlockhashOperator":
169182
case "NotOperator":
170183
case "CalldataloadOperator":
171-
case "CalldatacopyOperator":
172184
case "SloadOperator":
173185
case "IszeroOperator": { // pop 1, push 1
174186
if (hasBottomUntil(1))

0 commit comments

Comments
 (0)