Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extend the functionality of gen_cfg to cover all relevant statements in a program #132

Open
galois-agrushin opened this issue Jul 7, 2022 · 0 comments

Comments

@galois-agrushin
Copy link
Contributor

Is your feature request related to a problem? Please describe.

The control flow graph (CFG) that is returned by the gen_cfg function does not cover certain program statements, such as raise, try, except or class. Also excluded are statements that are part of try/except blocks or class definitions.

As one example, in the Control Flow chapter of The Fuzzing Book, the control flow graph that corresponds to the cgi_decode function (generated via to_graph(gen_cfg(inspect.getsource(cgi_decode)))) does not have a node that corresponds to the raise ValueError("Invalid encoding") statement.

Another example is as follows:

from fuzzingbook import ControlFlow as cf
import inspect

def fn():
    try:
        print( 'a' )
    except:
        print( 'b' )
        
    print( 'c' )

cf.to_graph(cf.gen_cfg(inspect.getsource(fn)))

The resulting CFG, shown in the screenshot below, does not contain nodes that correspond to the statements print( 'a' ) and print( 'b' ), which are part of the try and catch block, respectively.

image

A third example is:

from fuzzingbook import ControlFlow as cf
import inspect
import html.parser

cf.to_graph(cf.gen_cfg(inspect.getsource(html.parser.HTMLParser)))

The resulting CFG is empty, since all statements are part of the HTMLParser class.

Describe the solution you'd like

Ideally, all relevant program statements would be included as nodes in the CFG, with appropriate edges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant