Method getCustomFunction

instrumentation/UCSanPass.cpp:1942–2115

}

Function *UCSan::getCustomFunction(const Function *F) {
  // Handles auto-custom function wrapping based on YAML configuration
  // Maps arguments from one function signature to another

  auto Name = F->getName().str();

  // Check if already built
  if (CustomFuncs.find(Name) != CustomFuncs.end()) {
    return CustomFuncs[Name];
  }

  // Check if this is a custom function in metadata
  if (Scope.custom.find(Name) == Scope.custom.end()) {
    return nullptr; // Not a custom function
  }

  auto &CustomEntry = Scope.custom[Name];

  // Verify referenced function type exists
  if (CustomFuncTypes.find(CustomEntry.ref_name) == CustomFuncTypes.end()) {
    errs() << "Error: Referenced function " << CustomEntry.ref_name << " not found\n";
    return nullptr;
  }

  // Check if ref function is a taint type (handled by TaintPass).
  // For taint refs, generate a simple forwarding wrapper that calls the ref
  // function directly with remapped args. TaintPass will instrument the
  // wrapper body and convert the inner call to __dfsw_<ref>.
  bool IsTaintRef = ABIList.isIn(CustomEntry.ref_name, "taint");

  // Create wrapper function
  auto Linkage = Function::InternalLinkage;
  auto WrappedName = "__auto_dfsw_" + Name;
  auto RefedName = IsTaintRef ? CustomEntry.ref_name
                              : ("__dfsw_" + CustomEntry.ref_name);

  FunctionType *RefedFuncType = CustomFuncTypes[CustomEntry.ref_name];
  FunctionType *WrapperType = FunctionType::get(F->getReturnType(),
                                                F->getFunctionType()->params(),
                                                F->isVarArg());

  Function *WrapperFunc = Function::Create(WrapperType, Linkage, WrappedName, *Mod);
  // Keep wrapper/runtime call ABI robust even when module stack alignment is 8.
  WrapperFunc->addFnAttr(Attribute::getWithStackAlignment(*Ctx, Align(16)));
  WrapperFunc->addFnAttr("stackrealign");
  // For ucsan custom refs, mark wrapper nosanitize so TaintPass skips its body.
  // For taint refs, leave the wrapper instrumentable so TaintPass wraps the
  // inner ref call with its proper taint-label handling.
  if (!IsTaintRef)
    markFunctionNosanitize(WrapperFunc);
  BasicBlock *BB = BasicBlock::Create(*Ctx, "entry", WrapperFunc);
  IRBuilder<> IRB(BB);

  // Create UCSanFunction context for shadow memory access
  UCSanFunction UF(*this, WrapperFunc);

  // Build argument mapping
  std::map<unsigned int, unsigned int> ArgMap;