Writing an LLVM pass to detect malloc function calls, number of bytes assigned and the variable name pointing to that memory

Question

I have recently begun working with LLVM. I am trying to write a pass in LLVM that given the following code

string = (char *)malloc(100);
string = NULL;

and the corresponding LLVM IR

%call = call noalias i8* @malloc(i64 100) #3
store i8* %call, i8** %string, align 8
store i8* null, i8** %string, align 8

detects instructions calling malloc, extracts number of bytes assigned (in this case 100), the address returned and the variable name that the address is assigned to.

std::map<std::string, std::tuple<size_t, int> > mem_addrs;  // stores pointer name, address and no. of bytes allocated
Count() : ModulePass(ID) {}

virtual bool runOnModule(Module &M) {
  for (Function &F: M) { 
    for (BasicBlock &B: F) {
        for (Instruction &I: B) {
            if(CallInst* call_inst = dyn_cast<CallInst>(&I)) {
                Function* fn = call_inst->getCalledFunction();
                StringRef fn_name = fn->getName();
                errs() << fn_name << " : " << "\n";
                for(auto args = fn->arg_begin(); args != fn->arg_end(); ++args) {
                    ConstantInt* arg = dyn_cast<ConstantInt>(&(*args));
                    if (arg != NULL)
                            errs() << arg->getValue() << "\n";
                }    
            }
        }
     }  
  }

The output is

-VirtualBox:~/program_analysis$ opt -load $LLVMLIB/CSE231.so -analyze -count < $BENCHMARKS/leaktest/leaktest.bc > $OUTPUTLOGS/welcome.static.log
ok
allocaimw
allocaleak
allocamalloc : 0x2f5d9e0
0  opt             0x0000000001315cf2 llvm::sys::PrintStackTrace(_IO_FILE*) + 34
1  opt             0x0000000001315914
2  libpthread.so.0 0x00007f0b53f12330
3  opt             0x00000000012ec78f llvm::APInt::toString(llvm::SmallVectorImpl<char>&, unsigned int, bool, bool) const + 79
4  opt             0x00000000012ed309 llvm::APInt::print(llvm::raw_ostream&, bool) const + 57
5  CSE231.so       0x00007f0b52f16661
6  opt             0x00000000012ad6cd llvm::legacy::PassManagerImpl::run(llvm::Module&) + 797
7  opt             0x000000000058e190 main + 2752
8  libc.so.6       0x00007f0b5313af45 __libc_start_main + 245
9  opt             0x00000000005ab2ca
Stack dump:
0.  Program arguments: opt -load /home/hifza/program_analysis/llvm/build/Release+Asserts/lib/CSE231.so -analyze -count 
1.  Running pass 'Instruction Counts Pass' on module '<stdin>'.
Segmentation fault (core dumped)

I am able to detect malloc instructions, but I am not able to find out the corresponding memory address and the number of bytes assigned. Can anyone guide me on how can I go about doing this? Thanks.

Answer 1

You don't check the result of dyn_cast<ConstantInt>(&(*args)). If casted type is not a ConstantInt, it returns nullptr. And in the next line (arg->getValue()) you dereference it.