FunctionContext

-- Detect a missing bounds check: target_function calls memcpy
-- but the length argument may not be validated by a prior strlen call.

scopes = scope:functions{
  named = "target_function",
  with = function(project, context)
    -- Only proceed if the function calls memcpy
    if not context:has_call("memcpy") then return end

    local memcpy_calls = context:calls("memcpy")
    local strlen_calls = context:calls("strlen")

    -- For each memcpy call site, check whether a strlen call
    -- precedes it. If not, the length may be unchecked.
    for _, memcpy_addr in ipairs(memcpy_calls) do
      local has_prior_check = false

      for _, strlen_addr in ipairs(strlen_calls) do
        if context:precedes(strlen_addr, memcpy_addr) then
          has_prior_check = true
          break
        end
      end

      if not has_prior_check then
        -- Return a finding
        return result:high{...}
      end
    end

    -- Search for a known byte pattern in the function body
    local pattern = PatternMatcher.new("55 .. 89 E5 48")
    if context:matches(pattern) then
      local match_addr = context:find(pattern)
    end

    -- Walk the basic blocks of the function
    for _, block in ipairs(context:blocks()) do
      -- Each block is an IRTerm that can be inspected further
    end
  end
}