Fine-Grained Control-Flow Integrity Based on Points-to Analysis for CPS

Listing 5

LLVM bitcode after instrumentation.

1 store void (...) bitcast (void () @func2 to void

(...)), void (...) %2, align 8 // Assign the

address of the function bar to %2

2 %4 = load void (...), void (...) %2, align 8 //

Assign %2 to %4

3 %5 = bitcast void (...) %4 to i8, !nosanitize !3

4 %6 = call i1 @llvm.bitset.test(i8 %5, metadata !"

_ZTSFvE_test.c_13"), !nosanitize !3 // Determine

if %5 is in the bitset set corresponding to

_ZTSFvE_test.c_13

5 br i1 %6, label %8, label %7, !nosanitize !3

6

7; <label>:7: ; preds = %0

8 call void @llvm.trap() #2, !nosanitize !3

9 unreachable, !nosanitize !3

10

11; <label>:8: ; preds = %0

12 call void (...) %4()

13

14 !llvm.bitsets = !!0, !1}

15

16 !0 = !!"_ZTSFvE_test.c_16", void () @foo, i64 0}

17 !1 = !!"_ZTSFvE_test.c_16", void () @bar, i64 0}