vulncheck: add witness search logic for call stacks

The CL adds API for traversal of call graph in search of call stacks
that can serve as witnesses for uses of vulnerable symbols.

Change-Id: Ib45c5c6aad347e1bcecb39ca4a62f589b4766677
Reviewed-on: https://go-review.googlesource.com/c/exp/+/381777
Reviewed-by: Jonathan Amsterdam <jba@google.com>
Trust: Zvonimir Pavlinovic <zpavlinovic@google.com>
Run-TryBot: Zvonimir Pavlinovic <zpavlinovic@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
2 files changed
tree: 6f9e9d61701258fe9080b6c5cf290d5183421368
  1. apidiff/
  2. cmd/
  3. constraints/
  4. ebnf/
  5. ebnflint/
  6. errors/
  7. event/
  8. fsnotify/
  9. inotify/
  10. internal/
  11. io/
  12. jsonrpc2/
  13. maps/
  14. mmap/
  15. rand/
  16. shiny/
  17. shootout/
  18. slices/
  19. sumdb/
  20. utf8string/
  21. vulncheck/
  22. vulndb/
  23. winfsnotify/
  24. .gitattributes
  25. .gitignore
  26. AUTHORS
  27. codereview.cfg
  28. CONTRIBUTING.md
  29. CONTRIBUTORS
  30. go.mod
  31. go.sum
  32. LICENSE
  33. PATENTS
  34. README.md
README.md

exp

PkgGoDev

This subrepository holds experimental and deprecated (in the old directory) packages.

The idea for this subrepository originated as the pkg/exp directory of the main repository, but its presence there made it unavailable to users of the binary downloads of the Go installation. The subrepository has therefore been created to make it possible to go get these packages.

Warning: Packages here are experimental and unreliable. Some may one day be promoted to the main repository or other subrepository, or they may be modified arbitrarily or even disappear altogether.

In short, code in this subrepository is not subject to the Go 1 compatibility promise. (No subrepo is, but the promise is even more likely to be violated by go.exp than the others.)

Caveat emptor.