-
Notifications
You must be signed in to change notification settings - Fork 313
Description
Hello,
I've noticed potential bugs in the getReturnFlowFunction method within soot-infoflow/src/soot/jimple/infoflow/problems/InfoflowProblem.java. It appears that incorrect indices are being used when mapping caller arguments to callee parameters during taint propagation on method returns.
File Path:
soot-infoflow/src/soot/jimple/infoflow/problems/InfoflowProblem.java
The code uses the callee's parameter index (i) instead of the mapped caller's argument index (m) to retrieve the original call argument.
Relevant Code Snippet (L621):
originalCallArg = iCallStmt.getInvokeExpr().getArg(i);Suggested Fix:
originalCallArg = iCallStmt.getInvokeExpr().getArg(m);Reasoning:
The for loop iterates with i as the index for the callee's parameters. The mapper correctly provides m as the corresponding index for the caller's arguments. The code incorrectly mixes these two indices.
These bugs are particularly likely to be triggered in non-standard call scenarios, such as Java reflection calls, where invoke() often uses varargs (Object... args).
Could the development team please verify these issues? Thank you!