Java ReturnStmt类代码示例

import soot.jimple.ReturnStmt; //导入依赖的package包/类
@Override
protected void internalTransform(Body body, String phaseName, Map<String, String> options) {
	// Do not instrument methods in framework classes
	if (!canInstrumentMethod(body.getMethod()))
		return;
	
	instrumentInfoAboutNonAPICall(body);
	
	//important to use snapshotIterator here
	Iterator<Unit> iterator = body.getUnits().snapshotIterator();
	while(iterator.hasNext()){
		Unit unit = iterator.next();
		if(unit instanceof ReturnStmt || unit instanceof ReturnVoidStmt)
			instrumentInfoAboutReturnStmt(body, unit);
		else if(unit instanceof DefinitionStmt || unit instanceof InvokeStmt)
			instrumentInfoAboutNonApiCaller(body, unit);
		else if(unit instanceof IfStmt)
			instrumentEachBranchAccess(body, (IfStmt)unit);
	}				
}
 

import soot.jimple.ReturnStmt; //导入依赖的package包/类
@Override
public void caseReturnStmt(ReturnStmt stmt) {
	//in case of return CONSTANT, we do nothing; unfortunately, this is part of FlowDroid's path
	if(stmt.getOp() instanceof Constant)
		return;
	int index = jimpleDataFlowStatements.indexOf(stmt);
	AccessPath ap = accessPathPath.get(index);
	Local local = ap.getPlainValue();
			
	SMTBinding lhs = createNewBindingForValue(local);
	addValueBindingToVariableDeclaration(local, lhs);
	
	if(!hasBindingForValue(stmt.getOp()))
		throw new RuntimeException("There has to be a tainted value");
	SMTBinding rhs = getLatestBindingForValue(stmt.getOp());
	
	SMTSimpleAssignment simpleAss = new SMTSimpleAssignment(lhs, new SMTBindingValue(rhs));
	SMTAssertStatement assertStmt = new SMTAssertStatement(simpleAss);
	addAssertStmtToAllPrograms(assertStmt);	
}
 

import soot.jimple.ReturnStmt; //导入依赖的package包/类
private Map<Unit, Body> getStmtsWithConstants() {
  Map<Unit, Body> retMap = new LinkedHashMap<Unit, Body>();
  for (SootClass sc : Scene.v().getClasses()) {
    for (SootMethod sm : sc.getMethods()) {
      if (!sm.hasActiveBody())
        continue;
      Body methodBody = sm.retrieveActiveBody();
      for (Unit u : methodBody.getUnits()) {
        if (u instanceof ReturnStmt) {
          if (((ReturnStmt) u).getOp() instanceof Constant) {
            retMap.put(u, methodBody);
          }
        } else if (((Stmt) u).containsInvokeExpr()) {
          InvokeExpr ie = ((Stmt) u).getInvokeExpr();
          for (Value arg : ie.getArgs()) {
            if (arg instanceof StringConstant || arg instanceof NumericConstant) {
              retMap.put(u, methodBody);
              break;
            }
          }
        }
      }
    }
  }
  return retMap;
}
 

import soot.jimple.ReturnStmt; //导入依赖的package包/类
@Override
public boolean isSink(Stmt sCallSite, InterproceduralCFG<Unit, SootMethod> cfg,
		AccessPath ap) {
	// Check whether values returned by the current method are to be
	// considered as sinks
	if (this.returnTaintMethods != null
			&& sCallSite instanceof ReturnStmt
			&& this.returnTaintMethods.contains(cfg.getMethodOf(sCallSite).getSignature()))
		return true;
	
	// Check whether the callee is a sink
	if (this.sinks != null
			&& sCallSite.containsInvokeExpr()
			&& this.sinks.contains(sCallSite.getInvokeExpr().getMethod().getSignature()))
		return true;
	
	return false;
}
 

import soot.jimple.ReturnStmt; //导入依赖的package包/类
public void caseReturnStmt(ReturnStmt stmt) {
	if (stmt.getOp() instanceof Local) {
		if (((Local) stmt.getOp()).getType() instanceof IntegerType) {
			if (!ClassHierarchy
					.v()
					.typeNode(((Local) stmt.getOp()).getType())
					.hasAncestor_1(
							ClassHierarchy.v().typeNode(
									stmtBody.getMethod().getReturnType()))) {
				if (fix) {
					stmt.setOp(insertCast((Local) stmt.getOp(), stmtBody
							.getMethod().getReturnType(), stmt));
				} else {
					error("Type Error(19)");
				}
			}
		}
	}
}
 

import soot.jimple.ReturnStmt; //导入依赖的package包/类
@Override
public void caseReturnStmt(ReturnStmt stmt) {
	Value returnValue = stmt.getOp();
	constantV.setOrigStmt(stmt);
	Register returnReg = regAlloc.asImmediate(returnValue, constantV);
	Opcode opc;
	Type retType = returnValue.getType();
	if (SootToDexUtils.isObject(retType)) {
		opc = Opcode.RETURN_OBJECT;
	} else if (SootToDexUtils.isWide(retType)) {
		opc = Opcode.RETURN_WIDE;
	} else {
		opc = Opcode.RETURN;
	}
       addInsn(new Insn11x(opc, returnReg), stmt);
}
 

import soot.jimple.ReturnStmt; //导入依赖的package包/类
public boolean tryBodyPattern(List<Object> body,SETNodeLabel label, List<Object> otherBody){
	Stmt lastStmt = getLastStmt(body);
	if(lastStmt == null){
		//dont have a last stmt so cant match pattern
		return false;
	}
		
	if(! (lastStmt instanceof ReturnStmt || lastStmt instanceof ReturnVoidStmt || lastStmt instanceof DAbruptStmt)){
		//lastStmt is not an abrupt stmt
		return false;
	}

	if(bodyTargetsLabel(label,body) || bodyTargetsLabel(label,otherBody)){
		//one of the bodies targets the label on the ifelse cant match pattern
		return false;
	}

	//pattern matched
	return true;
}
 

import soot.jimple.ReturnStmt; //导入依赖的package包/类
public static Local getReturnLocal(SootMethod m){
    try{
        Body body = m.retrieveActiveBody();
        for(Unit unit : body.getUnits()){
            Stmt s = (Stmt) unit;
            if(s instanceof ReturnStmt){
                Immediate retOp = (Immediate) ((ReturnStmt) s).getOp();
                if(retOp instanceof Local)
                    return (Local)retOp;
            }
        }
    }catch(RuntimeException e){
        System.out.println("Method body not found for method: "+m.getSignature());
    };
    return null;
}
 

import soot.jimple.ReturnStmt; //导入依赖的package包/类
public static Stmt getReturnStmt(SootMethod sootMethod)
{
	Stmt rtVal = null;
	
	Body b = sootMethod.retrieveActiveBody();
	PatchingChain<Unit> units = b.getUnits();
	
	for (Iterator<Unit> iter = units.iterator(); iter.hasNext(); )
	{
		Stmt stmt = (Stmt) iter.next();
		
		if (stmt instanceof ReturnStmt || stmt instanceof ReturnVoidStmt)
		{
			rtVal = stmt;
		}
	}
	
	return rtVal;
}
 

import soot.jimple.ReturnStmt; //导入依赖的package包/类
@Override
public KillGenInfo propagateNormalFlow(Trackable trackable, Unit curr, Unit succ) {
	if (curr instanceof ReturnStmt) {
		Value retValue = getBase(((ReturnStmt) curr).getOp());
		if (retValue instanceof Constant) {
			return kill();
		} else {
			ReturnValueTaint retValTaint = (ReturnValueTaint) trackable;
			if (AnalysisUtil.isAssignable(retValTaint.type, retValue.getType()))
				return propagate(new Taint(curr, trackable, retValue, retValTaint.type));
			else
				return kill();
		}
	} else if (curr instanceof ThrowStmt)
		return kill();

	throw new IllegalStateException();
}
 

import soot.jimple.ReturnStmt; //导入依赖的package包/类
@Override
public KillGenInfo propagateCallFlow(Trackable trackable, Unit callStmt, SootMethod destinationMethod) {
	Taint taint = (Taint) trackable;

	if (callStmt instanceof AssignStmt) {
		AssignStmt assignStmt = (AssignStmt) callStmt;
		if (taint.value.equals(assignStmt.getLeftOp())) {
			if (AnalysisUtil.isAssignable(taint.type, destinationMethod.getReturnType())) {
				for (Unit u : context.icfg.getStartPointsOf(destinationMethod)) {
					if (u instanceof ReturnStmt) {
						ReturnStmt returnStmt = (ReturnStmt) u;
						Value retValue = returnStmt.getOp();

						if (retValue instanceof Constant)
							continue;

						// There is at least one non constant return stmt
						return propagate(new ReturnValueTaint(callStmt, trackable, taint.type));
					}
				}
			}
		}
	}

	return kill();
}
 

import soot.jimple.ReturnStmt; //导入依赖的package包/类
@Override
public KillGenInfo propagateReturnFlow(Trackable trackable, Unit callSite, SootMethod calleeMethod, Unit exitStmt, Unit returnSite) {
	Taint taint = (Taint) trackable;

	if (!(exitStmt instanceof ReturnStmt))
		return kill();

	if (!(callSite instanceof AssignStmt))
		return kill();

	ReturnStmt returnStmt = (ReturnStmt) exitStmt;
	AssignStmt assignStmt = (AssignStmt) callSite;

	if (!returnStmt.getOp().equivTo(taint.value))
		return kill();

	Value left = AnalysisUtil.getForwardsBase(assignStmt.getLeftOp());
	// return propagate(taint.createAlias(left, callSite));
	// return propagate(taint.createAlias(left, exitStmt));
	return propagate(new ReturnEdgeTaint(callSite, exitStmt, taint, left, -1, taint.type));
}
 

import soot.jimple.ReturnStmt; //导入依赖的package包/类
@Override
public KillGenInfo propagateReturnFlow(Trackable trackable, Unit callSite, SootMethod calleeMethod, Unit exitStmt, Unit returnSite) {
	if (!(exitStmt instanceof ReturnStmt))
		return identity();

	Taint taint = (Taint) trackable;

	ReturnStmt returnStmt = (ReturnStmt) exitStmt;
	Value retVal = AnalysisUtil.getForwardsBase(returnStmt.getOp());
	if (AnalysisUtil.maybeSameLocation(taint.value, retVal)) {
		SootMethod m = context.icfg.getMethodOf(returnStmt);
		if (AnalysisUtil.methodMayBeCallableFromApplication(m) && transitiveSinkCaller.isTransitiveCallerOfAnySink(m)) {
			context.reporter.reportTrackable(new Report(context, taint, exitStmt));
		}
	}
	return identity();
}
 

import soot.jimple.ReturnStmt; //导入依赖的package包/类
@Override
public KillGenInfo propagateReturnFlow(Trackable trackable, Unit callSite, SootMethod calleeMethod, Unit exitStmt, Unit returnSite) {
	boolean isSeedMethod = seedMethods.contains(context.icfg.getMethodOf(exitStmt));

	if (!(exitStmt instanceof ReturnStmt))
		return new KillGenInfo(isSeedMethod, Collections.<Trackable> emptyList());

	Taint taint = (Taint) trackable;
	ReturnStmt returnStmt = (ReturnStmt) exitStmt;
	Value retVal = AnalysisUtil.getForwardsBase(returnStmt.getOp());
	if (isSeedMethod && AnalysisUtil.maybeSameLocation(taint.value, retVal)) {
		SootMethod m = context.icfg.getMethodOf(returnStmt);
		if (AnalysisUtil.methodMayBeCallableFromApplication(m)) {
			if (!trackable.getPayload().isEmpty()) {
				context.reporter.reportTrackable(new Report(context, taint, exitStmt));
			}
		}
	}
	return new KillGenInfo(isSeedMethod, Collections.<Trackable> emptyList());
}
 

import soot.jimple.ReturnStmt; //导入依赖的package包/类
@Override
public void caseReturnStmt(ReturnStmt stmt) {
    returnStmt = stmt;
    SecurityConstraintValueReadSwitch readSwitch =
        getReadSwitch(stmt.getOp());
    addInheritedWriteEffects(readSwitch);
    Set<LEQConstraint> constraints =
        new HashSet<LEQConstraint>(readSwitch.getConstraints());
    ComponentReturnRef returnRef =
        new ComponentReturnRef(getAnalyzedSignature());
    for (IComponent read : readSwitch.getReadComponents()) {
        constraints.add(new LEQConstraint(read, returnRef));
    }
    for (int j = 0; j < readSwitch.getEqualComponents().size(); j++) {
        IComponent equalComponent = readSwitch.getEqualComponents().get(j);
        ComponentArrayRef arrayRef =
            new ComponentArrayRef(returnRef, j + 1);
        constraints.add(new LEQConstraint(arrayRef, equalComponent));
        constraints.add(new LEQConstraint(equalComponent, arrayRef));
    }
    addConstraints(constraints);
}