Constraint Graph and Constants

If you encounter false positive taint reports involving string literal constants, turn on -model-consts to fix this. When your taint analysis uses Andersen's pointer analysis on programs that pass string literal constants to source and sink functions, you may encounter false positive taint reports. Consider the following program where getchar() returns a string constant "source", and broadcast() receives a completely unrelated string constant "sink". There is no real taint flow between them.

char* getchar() {
    return "source";
} // Source string

extern void broadcast(char*);

int main() {
    char* src = getchar();

    char* dst = "sink"; // Two string constants "source" and "sink" are merged without -model-consts.
    broadcast(dst);     // Falsely reported as tainted.

    return 0;
}

Despite there being no real taint flow, your analysis will falsely report a tainted path from getchar() to broadcast() when running without -model-consts as a single node 3 has address edges to both string globals.

When -model-consts is enabled, SVF gives each string its own distinct object node in the constraint graph. They are no longer merged as @.str ("source") gets GlobalObjVar ID:13 and @.str.1 ("sink") gets GlobalObjVar ID:21. The intersection is now empty so it correctly returns false.