FlowDroid icon indicating copy to clipboard operation
FlowDroid copied to clipboard
verified publisher icon secure-software-engineering

java.lang.ClassCastException when PathEdgeProcessingTask runs

Open canliture opened this issue 4 years ago • 6 comments

I am using FlowDroid to analysis some classes and jars.

And crashed with the exception java.lang.ClassCastException. The exception has no any infomation, as the following screenshot shows, all the fields in the exception is null. So I can't locate the code lines where the crash occurs.

From the screenshot, the Runnable is PathEdgeProcessingTask, So I think some problems occurs in the Runnable PathEdgeProcessingTask

Do you have some experience in locating the problem, thanks a lot!

By the way, my flowdroid version is FlowDroid-2.8

image

canliture avatar Sep 01 '21 10:09 canliture

Please provide a full strace of the exception (should be printed out by default). Screenshots from the debugger are not useful.

StevenArzt avatar Sep 01 '21 11:09 StevenArzt

Thanks for your quick reply! I am sorry for the unclear representation of the crash issue.

The output is here:

// ... ... 
[main] INFO my.package.infoflow.MyInfoflow - Callgraph has 61826 edges
[main] INFO my.package.infoflow.MyInfoflow - Starting Taint Analysis
[main] INFO soot.jimple.infoflow.data.FlowDroidMemoryManager - Initializing FlowDroid memory manager...
[main] INFO my.package.infoflow.MyInfoflow - Using context- and flow-sensitive solver
[main] INFO my.package.infoflow.MyInfoflow - Using context- and flow-sensitive solver
[main] WARN my.package.infoflow.MyInfoflow - Running with limited join point abstractions can break context-sensitive path builders
[main] INFO my.package.infoflow.MyInfoflow - Looking for sources and sinks...
[main] INFO my.package.infoflow.MyInfoflow - Source lookup done, found 269 sources and 5240 sinks.
[FlowDroid] ERROR heros.solver.CountingThreadPoolExecutor - Worker thread execution failed: null
java.lang.ClassCastException
Exception in thread "FlowDroid" java.lang.ClassCastException
[main] INFO soot.jimple.infoflow.memory.MemoryWarningSystem - Shutting down the memory warning system...
[main] ERROR my.package.MyInfoflow - Exception during data flow analysis
java.lang.RuntimeException: There were exceptions during IFDS analysis. Exiting.
	at soot.jimple.infoflow.solver.fastSolver.IFDSSolver.runExecutorAndAwaitCompletion(IFDSSolver.java:247)
	at soot.jimple.infoflow.solver.fastSolver.IFDSSolver.awaitCompletionComputeValuesAndShutdown(IFDSSolver.java:214)
	at soot.jimple.infoflow.solver.fastSolver.IFDSSolver.solve(IFDSSolver.java:186)
	at soot.jimple.infoflow.Infoflow.runAnalysis(Infoflow.java:496)
	at soot.jimple.infoflow.Infoflow.computeInfoflow(Infoflow.java:192)
        // ... 
        // my program stack trace that calls FlowDroid's computeInfoflow.
        // my.package.infoflow.MyInfoflow extends Infoflow

The ouput seems to have no any useful infomation.

canliture avatar Sep 02 '21 01:09 canliture

Please provide the full stack trace. There should be a section that begins with "caused by" below the section you have provided. I need the original cause of the exception, not only the outer wrapper from the IFDS solver.

StevenArzt avatar Sep 02 '21 07:09 StevenArzt

Thanks for reply. And I am sorry again for my unclear representation of the crash issue.

Here the full output is :

[main] INFO my.package.soot.infoflow.MyInfoflow - Resetting Soot...
[main] INFO my.package.soot.infoflow.MyInfoflow - Basic class loading done.
[main] WARN soot.jimple.infoflow.entryPointCreators.DefaultEntryPointCreator - Cannot create valid constructor for javax.servlet.http.HttpServlet, because it is abstract and cannot substitute with subclass
[main] WARN soot.jimple.infoflow.entryPointCreators.DefaultEntryPointCreator - Cannot generate constructor for class: javax.servlet.http.HttpServlet
[main] WARN soot.jimple.infoflow.entryPointCreators.DefaultEntryPointCreator - Cannot call method <javax.servlet.http.HttpServlet: void doPut(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse)>, because there is no local for base object: javax.servlet.http.HttpServlet
[main] WARN soot.jimple.infoflow.entryPointCreators.DefaultEntryPointCreator - Cannot call method <javax.servlet.http.HttpServlet: void doHead(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse)>, because there is no local for base object: javax.servlet.http.HttpServlet
[main] WARN soot.jimple.infoflow.entryPointCreators.DefaultEntryPointCreator - Cannot call method <javax.servlet.http.HttpServlet: void doDelete(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse)>, because there is no local for base object: javax.servlet.http.HttpServlet
[main] WARN soot.jimple.infoflow.entryPointCreators.DefaultEntryPointCreator - Cannot call method <javax.servlet.http.HttpServlet: void service(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse)>, because there is no local for base object: javax.servlet.http.HttpServlet
[main] WARN soot.jimple.infoflow.entryPointCreators.DefaultEntryPointCreator - Cannot call method <javax.servlet.http.HttpServlet: void doGet(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse)>, because there is no local for base object: javax.servlet.http.HttpServlet
[main] WARN soot.jimple.infoflow.entryPointCreators.DefaultEntryPointCreator - Cannot call method <javax.servlet.http.HttpServlet: void doPost(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse)>, because there is no local for base object: javax.servlet.http.HttpServlet
[main] WARN soot.jimple.infoflow.entryPointCreators.DefaultEntryPointCreator - Cannot call method <javax.servlet.http.HttpServlet: void doOptions(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse)>, because there is no local for base object: javax.servlet.http.HttpServlet
[main] WARN soot.jimple.infoflow.entryPointCreators.DefaultEntryPointCreator - Cannot call method <javax.servlet.http.HttpServlet: void doTrace(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse)>, because there is no local for base object: javax.servlet.http.HttpServlet
[main] INFO soot.jimple.infoflow.InfoflowConfiguration - Implicit flow tracking is enabled
[main] INFO soot.jimple.infoflow.InfoflowConfiguration - Exceptional flow tracking is enabled
[main] INFO soot.jimple.infoflow.InfoflowConfiguration - Running with a maximum access path length of 5
[main] INFO soot.jimple.infoflow.InfoflowConfiguration - Using path-agnostic result collection
[main] INFO soot.jimple.infoflow.InfoflowConfiguration - Recursive access path shortening is enabled
[main] INFO soot.jimple.infoflow.InfoflowConfiguration - Taint analysis enabled: true
[main] INFO soot.jimple.infoflow.InfoflowConfiguration - Running with one source at a time
[main] INFO soot.jimple.infoflow.InfoflowConfiguration - Using alias algorithm FlowSensitive
[main] INFO soot.jimple.infoflow.memory.MemoryWarningSystem - Registered a memory warning system for 2,437.2 MiB
[main] INFO my.package.infoflow.MyInfoflow - Callgraph construction took 4 seconds
2021-09-02 17:38:45.839 [main] INFO  Initialize SourceSinkManager, load rule set: 736 sources and 3931 sinks    // Here output, I defined my ISourceSinkManager
2021-09-02 17:38:45.839 [main] INFO  Initialize SourceSinkManager, load default rule: 28 sources and 15 sinks   // Here output, I defined my ISourceSinkManager
[main] INFO soot.jimple.infoflow.codeOptimization.InterproceduralConstantValuePropagator - Removing side-effect free methods is disabled
[main] INFO my.package.infoflow.MyInfoflow - Dead code elimination took 3.3340453 seconds
[main] INFO my.package.infoflow.MyInfoflow - Callgraph has 61850 edges
[main] INFO my.package.infoflow.MyInfoflow - Starting Taint Analysis
[main] INFO soot.jimple.infoflow.data.FlowDroidMemoryManager - Initializing FlowDroid memory manager...
[main] INFO my.package.infoflow.MyInfoflow - Using context- and flow-sensitive solver
[main] INFO my.package.infoflow.MyInfoflow - Using context- and flow-sensitive solver
[main] WARN my.package.infoflow.MyInfoflow - Running with limited join point abstractions can break context-sensitive path builders
[main] INFO my.package.infoflow.MyInfoflow - Looking for sources and sinks...
[main] INFO my.package.infoflow.MyInfoflow - Source lookup done, found 269 sources and 5240 sinks.
[FlowDroid] ERROR heros.solver.CountingThreadPoolExecutor - Worker thread execution failed: null
java.lang.ClassCastException
Exception in thread "FlowDroid" java.lang.ClassCastException
[main] INFO soot.jimple.infoflow.memory.MemoryWarningSystem - Shutting down the memory warning system...
[main] ERROR my.package.infoflow.MyInfoflow - Exception during data flow analysis
java.lang.RuntimeException: There were exceptions during IFDS analysis. Exiting.
	at soot.jimple.infoflow.solver.fastSolver.IFDSSolver.runExecutorAndAwaitCompletion(IFDSSolver.java:247)
	at soot.jimple.infoflow.solver.fastSolver.IFDSSolver.awaitCompletionComputeValuesAndShutdown(IFDSSolver.java:214)
	at soot.jimple.infoflow.solver.fastSolver.IFDSSolver.solve(IFDSSolver.java:186)
	at soot.jimple.infoflow.Infoflow.runAnalysis(Infoflow.java:496)
	at soot.jimple.infoflow.Infoflow.computeInfoflow(Infoflow.java:192)
	at my.package.infoflow.MyInfoflow.analysis(MyInfoflow.java:83)
	at my.package.infoflow.Main.run(Main.java:42)
	at my.package.infoflow.Main.main(Main.java:25)
Caused by: java.lang.ClassCastException     // Caused by ClassCastException and have no other stacktrace output following the line
2021-09-02 17:45:59.247 [main] INFO  Result Size: 0      // my output infomation  1
2021-09-02 17:45:59.248 [main] INFO  Output report: xxx\result.xml // my output infomation  2

Process finished with exit code 0     // program exit

From the output, I still have no idea what happened. And When computeInfoflow fails with the exception ouput, I use getResults() to get results. The result InfoflowResults shows:

  • one performanceData toString: Callgraph Construction: 4 seconds
  • one exception toString:
java.lang.RuntimeException: There were exceptions during IFDS analysis. Exiting.
java.lang.RuntimeException: There were exceptions during IFDS analysis. Exiting.
	at soot.jimple.infoflow.solver.fastSolver.IFDSSolver.runExecutorAndAwaitCompletion(IFDSSolver.java:247)
	at soot.jimple.infoflow.solver.fastSolver.IFDSSolver.awaitCompletionComputeValuesAndShutdown(IFDSSolver.java:214)
	at soot.jimple.infoflow.solver.fastSolver.IFDSSolver.solve(IFDSSolver.java:186)
	at soot.jimple.infoflow.Infoflow.runAnalysis(Infoflow.java:496)
	at soot.jimple.infoflow.Infoflow.computeInfoflow(Infoflow.java:192)
	at com.ubisec.soot.infoflow.MyInfoflow.analysis(MyInfoflow.java:84)
	at com.ubisec.soot.infoflow.Main.run(Main.java:42)
	at com.ubisec.soot.infoflow.Main.main(Main.java:25)
Caused by: java.lang.ClassCastException

canliture avatar Sep 02 '21 09:09 canliture

That's indeed strange, because it doesn't show where the ClassCastException happens. You write that you define your own ISourceSinkManager. Does the problem also occur when you use FlowDroid's default source/sink manager.

For debugging the issue, I'd recommend to set a breakpoint on all ClassCastExceptions. In Eclipse, you can do so via the main menu: "Run" / "Add Java Exception Breakpoint". Then run your code in the debugger as normal. The debugger will now stop whenever an exception of that type is thrown and you can investigate.

StevenArzt avatar Sep 02 '21 19:09 StevenArzt

Thanks to @StevenArzt for your answers again. I think I have located the broken line.

The problem occurs in my own ITaintPropagationWrapper when WrapperPropagationRule tries to call ITaintPropagationWrapper#getTaintsForMethod. It's not about FlowDroid.

Next, I will try to look at why there are no stacktraces to be printed. (my own method not does any catching action)

canliture avatar Sep 03 '21 01:09 canliture