Skip to content

[Bug]: Potential Missing Nulll Check in Soot but not in SootUp #994

@Momo-Not-Emo

Description

@Momo-Not-Emo

What happened?

Description:

I have identified an instance where a null check present in the original Soot project are missing in SootUp. These methods have a direct correspondence between Soot and SootUp. Missing checks could cause issues in the future, as they should exhibit similar behavior.

Method removeAllEdgesOutOf

  • Mapped Method in SootUp:
    • Class: qilin.core.builder.callgraph.OnFlyCallGraph
    • Link to Code
      for (QueueReader<Edge> edgeRdr = listener(); edgeRdr.hasNext(); ) {
        Edge e = edgeRdr.next();
        if (e.srcUnit() == u) {
          e.remove();
          removeEdge(e, false);
          edgesToRemove.add(e);
          hasRemoved = true;
        }
      }
  • Corresponding Method in Soot:
    • Class: soot.jimple.toolkits.callgraph.CallGraph
    • Link to Code
      for (QueueReader<Edge> edgeRdr = listener(); edgeRdr.hasNext();) {
        Edge e = edgeRdr.next();
        if (e != null && e.srcUnit() == u) {
          e.remove();
          removeEdge(e, false);
          edgesToRemove.add(e);
          hasRemoved = true;
        }
      }

In the original Soot implementation, there is a null check for e before calling e.srcUnit() == u. However, this null check is omitted in the SootUp implementation. I also verified that srcUnit() doesn't have any annotations indicating that it cannot return null, which means this omission could lead to a potential NullPointerException (NPE).

Version

Latest develop branch

Relevant log output

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions