check taint on sinks _before_ the call

Author: kroening

src/goto-analyzer/taint_analysis.cpp

@@ -67,7 +67,7 @@ void taint_analysist::instrument(
   {
     const goto_programt::instructiont &instruction=*it;
 
-    goto_programt tmp;
+    goto_programt insert_before, insert_after;
 
     switch(instruction.type)
     {
@@ -164,15 +164,15 @@ void taint_analysist::instrument(
                   code_set_may.op0()=where;
                   code_set_may.op1()=
                     address_of_exprt(string_constantt(rule.taint));
-                  goto_programt::targett t=tmp.add_instruction();
+                  goto_programt::targett t=insert_after.add_instruction();
                   t->make_other(code_set_may);
                   t->source_location=instruction.source_location;
                 }
                 break;
 
               case taint_parse_treet::rulet::SINK:
                 {
-                  goto_programt::targett t=tmp.add_instruction();
+                  goto_programt::targett t=insert_before.add_instruction();
                   binary_predicate_exprt get_may("get_may");
                   get_may.op0()=where;
                   get_may.op1()=address_of_exprt(string_constantt(rule.taint));
@@ -191,7 +191,7 @@ void taint_analysist::instrument(
                   code_clear_may.op0()=where;
                   code_clear_may.op1()=
                     address_of_exprt(string_constantt(rule.taint));
-                  goto_programt::targett t=tmp.add_instruction();
+                  goto_programt::targett t=insert_after.add_instruction();
                   t->make_other(code_clear_may);
                   t->source_location=instruction.source_location;
                 }
@@ -208,11 +208,17 @@ void taint_analysist::instrument(
       }
     }
 
-    if(!tmp.empty())
+    if(!insert_before.empty())
     {
-      goto_programt::targett next=it;
-      next++;
-      goto_function.body.destructive_insert(next, tmp);
+      goto_function.body.insert_before_swap(it, insert_before);
+      // advance until we get back to the call
+      while(!it->is_function_call()) ++it;
+    }
+
+    if(!insert_after.empty())
+    {
+      goto_function.body.destructive_insert(
+        std::next(it), insert_after);
     }
   }
 }