static-analysis

LLVM static analysis detects vulnerabilities by implementing source-to-sink taint propagation and tracking dataflow across functions. You configure propagation rules to flag risky behaviors like buffer overflows and use-after-free without executing the program.

Taint tracking is an information-flow analysis technique that propagates data from specified sources to sensitive sinks. It uses may/must approximations and alias analysis to determine if untrusted inputs reach dangerous operations.

Implement an LLVM pass by integrating analysis managers like dominator trees and loop info, then building data dependence graphs for interprocedural handling. This models program structure to support forward and backward analyses across function boundaries.

LLVM alias analysis supports points-to reasoning for pointer tracking, enabling Andersen or Steensgaard-style approaches. This alias information is crucial for accurately modeling pointer behavior during taint propagation and vulnerability detection.

Control flow analysis uses dominator and post-dominator trees plus loop information to model program dependencies for code quality auditing. Combined with program slicing, it supports debugging and research-grade static reasoning across functions.

Static analysis for use-after-free relies on allocation and deallocation tracking approximations, which may produce false positives. Limitations arise from complex alias relationships and interprocedural control flow that obscure precise deallocation boundaries.