[rana1911]

Fixes #871.

IFDSTaintAnalysis::getNormalFlowFunction had no case for llvm::SelectInst or llvm::PHINode, so both fell through to identityFlow() and their results were never tainted. Leaks were missed for ?: even at -O0, and for ordinary if/switch/loop code once mem2reg/SimplifyCFG run.

Changes

• IFDSTaintAnalysis.cpp: two flow functions before the identityFlow() fallback, following the existing BinaryOperator case. The result is tainted if a value operand of the select (true/false value, not the condition) or an incoming value of the phi is tainted. Other instructions are unaffected.
• Tests: 3 programs in dummy_source_sink/ and 4 tests in IFDSTaintAnalysisTest:
  • TaintTest_Select_01: ternary at -O1 (select)
  • TaintTest_Select_01_m2r: same program after mem2reg (phi)
  • TaintTest_Select_02: if assignment that SimplifyCFG turns into a select at -O1
  • TaintTest_Select_03: select of two constants must not be tainted; a direct flow in the same function is still reported
• CMakeLists.txt: a new list compiled with the existing generate_ll_file(... DEBUG O1) option, as in inst_interaction.

TaintTest_Select_02 matches the select by line with column 0 (any column), because LLVM 18 and 21 attach it to different columns of the same line.

Testing

• All IFDSTaintAnalysisTest tests pass (LLVM 21.1.8, GCC 15.2).
• Without the change to IFDSTaintAnalysis.cpp, Select_01, Select_01_m2r and Select_02 fail and Select_03 passes.
• Formatted with clang-format 19.1.7.

Related: #846 (item 11), the same gap in IDEExtendedTaintAnalysis. Intrinsics such as llvm.smax also drop taint at -O1+; I'll handle that in a separate PR.

[fabianbs96]

Hi @rana1911,
thanks for your contribution.

Looks good to me!