smatch_buf_size.c

   1 /*
   2  * Copyright (C) 2010 Dan Carpenter.
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see http://www.gnu.org/copyleft/gpl.txt
  16  */
  17
  18 #include <stdlib.h>
  19 #include <errno.h>
  20 #include "parse.h"
  21 #include "smatch.h"
  22 #include "smatch_slist.h"
  23 #include "smatch_extra.h"
  24 #include "smatch_function_hashtable.h"
  25
  26 #define UNKNOWN_SIZE (-1)
  27
  28 static int my_size_id;
  29
  30 struct limiter {
  31         int buf_arg;
  32         int limit_arg;
  33 };
  34 static struct limiter b0_l2 = {0, 2};
  35
  36 static DEFINE_HASHTABLE_INSERT(insert_func, char, int);
  37 static DEFINE_HASHTABLE_SEARCH(search_func, char, int);
  38 static struct hashtable *allocation_funcs;
  39
  40 static char *get_fn_name(struct expression *expr)
  41 {
  42         if (expr->type != EXPR_CALL)
  43                 return NULL;
  44         if (expr->fn->type != EXPR_SYMBOL)
  45                 return NULL;
  46         return expr_to_var(expr->fn);
  47 }
  48
  49 static int is_allocation_function(struct expression *expr)
  50 {
  51         char *func;
  52         int ret = 0;
  53
  54         func = get_fn_name(expr);
  55         if (!func)
  56                 return 0;
  57         if (search_func(allocation_funcs, func))
  58                 ret = 1;
  59         free_string(func);
  60         return ret;
  61 }
  62
  63 static void add_allocation_function(const char *func, void *call_back, int param)
  64 {
  65         insert_func(allocation_funcs, (char *)func, (int *)1);
  66         add_function_assign_hook(func, call_back, INT_PTR(param));
  67 }
  68
  69 static int estate_to_size(struct smatch_state *state)
  70 {
  71         sval_t sval;
  72
  73         if (!state || !estate_rl(state))
  74                 return 0;
  75         sval = estate_max(state);
  76         return sval.value;
  77 }
  78
  79 static struct smatch_state *size_to_estate(int size)
  80 {
  81         sval_t sval;
  82
  83         sval.type = &int_ctype;
  84         sval.value = size;
  85
  86         return alloc_estate_sval(sval);
  87 }
  88
  89 static struct range_list *size_to_rl(int size)
  90 {
  91         sval_t sval;
  92
  93         sval.type = &int_ctype;
  94         sval.value = size;
  95
  96         return alloc_rl(sval, sval);
  97 }
  98
  99 static struct smatch_state *unmatched_size_state(struct sm_state *sm)
 100 {
 101         return size_to_estate(UNKNOWN_SIZE);
 102 }
 103
 104 static void set_size_undefined(struct sm_state *sm, struct expression *mod_expr)
 105 {
 106         set_state(sm->owner, sm->name, sm->sym, size_to_estate(UNKNOWN_SIZE));
 107 }
 108
 109 static struct smatch_state *merge_size_func(struct smatch_state *s1, struct smatch_state *s2)
 110 {
 111         return merge_estates(s1, s2);
 112 }
 113
 114 void set_param_buf_size(const char *name, struct symbol *sym, char *key, char *value)
 115 {
 116         struct range_list *rl = NULL;
 117         struct smatch_state *state;
 118         char fullname[256];
 119
 120         if (strncmp(key, "$", 1) != 0)
 121                 return;
 122
 123         snprintf(fullname, 256, "%s%s", name, key + 1);
 124
 125         str_to_rl(&int_ctype, value, &rl);
 126         if (!rl || is_whole_rl(rl))
 127                 return;
 128         state = alloc_estate_rl(rl);
 129         set_state(my_size_id, fullname, sym, state);
 130 }
 131
 132 static int bytes_per_element(struct expression *expr)
 133 {
 134         struct symbol *type;
 135
 136         if (expr->type == EXPR_STRING)
 137                 return 1;
 138         type = get_type(expr);
 139         if (!type)
 140                 return 0;
 141
 142         if (type->type != SYM_PTR && type->type != SYM_ARRAY)
 143                 return 0;
 144
 145         type = get_base_type(type);
 146         return type_bytes(type);
 147 }
 148
 149 static int bytes_to_elements(struct expression *expr, int bytes)
 150 {
 151         int bpe;
 152
 153         bpe = bytes_per_element(expr);
 154         if (bpe == 0)
 155                 return 0;
 156         return bytes / bpe;
 157 }
 158
 159 static int elements_to_bytes(struct expression *expr, int elements)
 160 {
 161         int bpe;
 162
 163         bpe = bytes_per_element(expr);
 164         return elements * bpe;
 165 }
 166
 167 static int get_initializer_size(struct expression *expr)
 168 {
 169         switch (expr->type) {
 170         case EXPR_STRING:
 171                 return expr->string->length;
 172         case EXPR_INITIALIZER: {
 173                 struct expression *tmp;
 174                 int i = 0;
 175
 176                 FOR_EACH_PTR(expr->expr_list, tmp) {
 177                         if (tmp->type == EXPR_INDEX) {
 178                                 if (tmp->idx_to >= i)
 179                                         i = tmp->idx_to;
 180                                 else
 181                                         continue;
 182                         }
 183
 184                         i++;
 185                 } END_FOR_EACH_PTR(tmp);
 186                 return i;
 187         }
 188         case EXPR_SYMBOL:
 189                 return get_array_size(expr);
 190         }
 191         return 0;
 192 }
 193
 194 static struct range_list *db_size_rl;
 195 static int db_size_callback(void *unused, int argc, char **argv, char **azColName)
 196 {
 197         struct range_list *tmp = NULL;
 198
 199         if (!db_size_rl) {
 200                 str_to_rl(&int_ctype, argv[0], &db_size_rl);
 201         } else {
 202                 str_to_rl(&int_ctype, argv[0], &tmp);
 203                 db_size_rl = rl_union(db_size_rl, tmp);
 204         }
 205         return 0;
 206 }
 207
 208 static struct range_list *size_from_db(struct expression *expr)
 209 {
 210         int this_file_only = 0;
 211         char *name;
 212
 213         name = get_member_name(expr);
 214         if (!name && is_static(expr)) {
 215                 name = expr_to_var(expr);
 216                 this_file_only = 1;
 217         }
 218         if (!name)
 219                 return 0;
 220
 221         if (this_file_only) {
 222                 db_size_rl = NULL;
 223                 run_sql(db_size_callback, NULL,
 224                         "select size from function_type_size where type = '%s' and file = '%s';",
 225                         name, get_filename());
 226                 if (db_size_rl)
 227                         return db_size_rl;
 228                 return 0;
 229         }
 230
 231         db_size_rl = NULL;
 232         run_sql(db_size_callback, NULL,
 233                 "select size from type_size where type = '%s';",
 234                 name);
 235         return db_size_rl;
 236 }
 237
 238 static void db_returns_buf_size(struct expression *expr, int param, char *unused, char *math)
 239 {
 240         struct expression *call;
 241         sval_t sval;
 242
 243         if (expr->type != EXPR_ASSIGNMENT)
 244                 return;
 245         call = strip_expr(expr->right);
 246
 247         if (!parse_call_math(call, math, &sval))
 248                 return;
 249         set_state_expr(my_size_id, expr->left, size_to_estate(sval.value));
 250 }
 251
 252 int get_real_array_size(struct expression *expr)
 253 {
 254         struct symbol *type;
 255         sval_t sval;
 256
 257         if (expr->type == EXPR_BINOP) /* array elements foo[5] */
 258                 return 0;
 259
 260         type = get_type(expr);
 261         if (!type)
 262                 return 0;
 263         if (!type || type->type != SYM_ARRAY)
 264                 return 0;
 265
 266         if (!get_implied_value(type->array_size, &sval))
 267                 return 0;
 268
 269         /* People put one element arrays on the end of structs */
 270         if (sval.value == 1)
 271                 return 0;
 272
 273         return sval.value;
 274 }
 275
 276 static int get_size_from_initializer(struct expression *expr)
 277 {
 278         if (expr->type != EXPR_SYMBOL || !expr->symbol || !expr->symbol->initializer)
 279                 return 0;
 280         if (expr->symbol->initializer == expr) /* int a = a; */
 281                 return 0;
 282         return get_initializer_size(expr->symbol->initializer);
 283 }
 284
 285 static struct range_list *get_stored_size_bytes(struct expression *expr)
 286 {
 287         struct smatch_state *state;
 288
 289         state = get_state_expr(my_size_id, expr);
 290         if (!state)
 291                 return NULL;
 292         return estate_rl(state);
 293 }
 294
 295 static int get_bytes_from_address(struct expression *expr)
 296 {
 297         struct symbol *type;
 298         int ret;
 299
 300         if (!option_spammy)
 301                 return 0;
 302         if (expr->type != EXPR_PREOP || expr->op != '&')
 303                 return 0;
 304         type = get_type(expr);
 305         if (!type)
 306                 return 0;
 307
 308         if (type->type == SYM_PTR)
 309                 type = get_base_type(type);
 310
 311         ret = type_bytes(type);
 312         if (ret == 1)
 313                 return 0;  /* ignore char pointers */
 314
 315         return ret;
 316 }
 317
 318 static struct expression *remove_addr_fluff(struct expression *expr)
 319 {
 320         struct expression *tmp;
 321         sval_t sval;
 322
 323         expr = strip_expr(expr);
 324
 325         /* remove '&' and '*' operations that cancel */
 326         while (expr && expr->type == EXPR_PREOP && expr->op == '&') {
 327                 tmp = strip_expr(expr->unop);
 328                 if (tmp->type != EXPR_PREOP)
 329                         break;
 330                 if (tmp->op != '*')
 331                         break;
 332                 expr = strip_expr(tmp->unop);
 333         }
 334
 335         if (!expr)
 336                 return NULL;
 337
 338         /* "foo + 0" is just "foo" */
 339         if (expr->type == EXPR_BINOP && expr->op == '+' &&
 340             get_value(expr->right, &sval) && sval.value == 0)
 341                 return expr->left;
 342
 343         return expr;
 344 }
 345
 346 static int is_last_member_of_struct(struct symbol *sym, struct ident *member)
 347 {
 348         struct symbol *tmp;
 349         int i;
 350
 351         i = 0;
 352         FOR_EACH_PTR_REVERSE(sym->symbol_list, tmp) {
 353                 if (i++ || !tmp->ident)
 354                         return 0;
 355                 if (tmp->ident == member)
 356                         return 1;
 357                 return 0;
 358         } END_FOR_EACH_PTR_REVERSE(tmp);
 359
 360         return 0;
 361 }
 362
 363 static int get_stored_size_end_struct_bytes(struct expression *expr)
 364 {
 365         struct symbol *type;
 366         char *name;
 367         struct symbol *sym;
 368         struct smatch_state *state;
 369         sval_t sval;
 370
 371         if (expr->type == EXPR_BINOP) /* array elements foo[5] */
 372                 return 0;
 373
 374         type = get_type(expr);
 375         if (!type || type->type != SYM_ARRAY)
 376                 return 0;
 377
 378         if (!get_implied_value(type->array_size, &sval))
 379                 return 0;
 380
 381         if (sval.value != 0 && sval.value != 1)
 382                 return 0;
 383
 384         name = expr_to_var_sym(expr, &sym);
 385         free_string(name);
 386         if (!sym || !sym->ident)
 387                 return 0;
 388         if (!type_bytes(sym))
 389                 return 0;
 390
 391         if (sym->type != SYM_NODE)
 392                 return 0;
 393
 394         state = get_state(my_size_id, sym->ident->name, sym);
 395         if (!estate_to_size(state))
 396                 return 0;
 397
 398         sym = get_real_base_type(sym);
 399         if (!sym || sym->type != SYM_PTR)
 400                 return 0;
 401         sym = get_real_base_type(sym);
 402         if (!sym || sym->type != SYM_STRUCT)
 403                 return 0;
 404         if (!is_last_member_of_struct(sym, expr->member))
 405                 return 0;
 406
 407         return estate_to_size(state) - type_bytes(sym) + type_bytes(type);
 408 }
 409
 410 static struct range_list *alloc_int_rl(int value)
 411 {
 412         sval_t sval = {
 413                 .type = &int_ctype,
 414                 {.value = value},
 415         };
 416
 417         return alloc_rl(sval, sval);
 418 }
 419
 420 struct range_list *get_array_size_bytes_rl(struct expression *expr)
 421 {
 422         int declared_size = 0;
 423         struct range_list *ret = NULL;
 424         int size;
 425
 426         expr = remove_addr_fluff(expr);
 427         if (!expr)
 428                 return NULL;
 429
 430         /* "BAR" */
 431         if (expr->type == EXPR_STRING)
 432                 return alloc_int_rl(expr->string->length);
 433
 434         if (expr->type == EXPR_BINOP && expr->op == '+') {
 435                 sval_t offset;
 436
 437                 if (!get_implied_value(expr->right, &offset))
 438                         return NULL;
 439                 size = get_array_size_bytes(expr->left);
 440                 if (size <= 0)
 441                         return NULL;
 442                 return alloc_int_rl(size - offset.value);
 443         }
 444
 445         /* buf[4] */
 446         size = get_real_array_size(expr);
 447         if (size)
 448                 declared_size = elements_to_bytes(expr, size);
 449
 450         /* buf = malloc(1024); */
 451         ret = get_stored_size_bytes(expr);
 452         if (ret) {
 453                 if (declared_size)
 454                         return rl_union(ret, alloc_int_rl(size));
 455                 return ret;
 456         }
 457         if (declared_size)
 458                 return alloc_int_rl(declared_size);
 459
 460         size = get_stored_size_end_struct_bytes(expr);
 461         if (size)
 462                 return alloc_int_rl(size);
 463
 464         /* char *foo = "BAR" */
 465         size = get_size_from_initializer(expr);
 466         if (size)
 467                 return alloc_int_rl(elements_to_bytes(expr, size));
 468
 469         size = get_bytes_from_address(expr);
 470         if (size)
 471                 return alloc_int_rl(size);
 472
 473         /* if (strlen(foo) > 4) */
 474         size = get_size_from_strlen(expr);
 475         if (size)
 476                 return alloc_int_rl(size);
 477
 478         ret = size_from_db(expr);
 479         if (ret)
 480                 return ret;
 481
 482         return NULL;
 483 }
 484
 485 int get_array_size_bytes(struct expression *expr)
 486 {
 487         struct range_list *rl;
 488         sval_t sval;
 489
 490         rl = get_array_size_bytes_rl(expr);
 491         if (!rl_to_sval(rl, &sval))
 492                 return 0;
 493         if (sval.uvalue >= INT_MAX)
 494                 return 0;
 495         return sval.value;
 496 }
 497
 498 int get_array_size_bytes_max(struct expression *expr)
 499 {
 500         struct range_list *rl;
 501         sval_t bytes;
 502
 503         rl = get_array_size_bytes_rl(expr);
 504         if (!rl)
 505                 return 0;
 506         bytes = rl_min(rl);
 507         if (bytes.value < 0)
 508                 return 0;
 509         bytes = rl_max(rl);
 510         if (bytes.uvalue >= INT_MAX)
 511                 return 0;
 512         return bytes.value;
 513 }
 514
 515 int get_array_size_bytes_min(struct expression *expr)
 516 {
 517         struct range_list *rl;
 518         struct data_range *range;
 519
 520         rl = get_array_size_bytes_rl(expr);
 521         if (!rl)
 522                 return 0;
 523
 524         FOR_EACH_PTR(rl, range) {
 525                 if (range->min.value <= 0)
 526                         return 0;
 527                 if (range->max.value <= 0)
 528                         return 0;
 529                 if (range->min.uvalue >= INT_MAX)
 530                         return 0;
 531                 return range->min.value;
 532         } END_FOR_EACH_PTR(range);
 533
 534         return 0;
 535 }
 536
 537 int get_array_size(struct expression *expr)
 538 {
 539         return bytes_to_elements(expr, get_array_size_bytes_max(expr));
 540 }
 541
 542 static void match_strlen_condition(struct expression *expr)
 543 {
 544         struct expression *left;
 545         struct expression *right;
 546         struct expression *str = NULL;
 547         int strlen_left = 0;
 548         int strlen_right = 0;
 549         sval_t sval;
 550         struct smatch_state *true_state = NULL;
 551         struct smatch_state *false_state = NULL;
 552
 553         if (expr->type != EXPR_COMPARE)
 554                 return;
 555         left = strip_expr(expr->left);
 556         right = strip_expr(expr->right);
 557
 558         if (left->type == EXPR_CALL && sym_name_is("strlen", left->fn)) {
 559                 str = get_argument_from_call_expr(left->args, 0);
 560                 strlen_left = 1;
 561         }
 562         if (right->type == EXPR_CALL && sym_name_is("strlen", right->fn)) {
 563                 str = get_argument_from_call_expr(right->args, 0);
 564                 strlen_right = 1;
 565         }
 566
 567         if (!strlen_left && !strlen_right)
 568                 return;
 569         if (strlen_left && strlen_right)
 570                 return;
 571
 572         if (strlen_left) {
 573                 if (!get_value(right, &sval))
 574                         return;
 575         }
 576         if (strlen_right) {
 577                 if (!get_value(left, &sval))
 578                         return;
 579         }
 580
 581         /* FIXME:  why are we using my_size_id here instead of my_strlen_id */
 582
 583         if (expr->op == SPECIAL_EQUAL) {
 584                 set_true_false_states_expr(my_size_id, str, size_to_estate(sval.value + 1), NULL);
 585                 return;
 586         }
 587         if (expr->op == SPECIAL_NOTEQUAL) {
 588                 set_true_false_states_expr(my_size_id, str, NULL, size_to_estate(sval.value + 1));
 589                 return;
 590         }
 591
 592         switch (expr->op) {
 593         case '<':
 594         case SPECIAL_UNSIGNED_LT:
 595                 if (strlen_left)
 596                         true_state = size_to_estate(sval.value);
 597                 else
 598                         false_state = size_to_estate(sval.value + 1);
 599                 break;
 600         case SPECIAL_LTE:
 601         case SPECIAL_UNSIGNED_LTE:
 602                 if (strlen_left)
 603                         true_state = size_to_estate(sval.value + 1);
 604                 else
 605                         false_state = size_to_estate(sval.value);
 606                 break;
 607         case SPECIAL_GTE:
 608         case SPECIAL_UNSIGNED_GTE:
 609                 if (strlen_left)
 610                         false_state = size_to_estate(sval.value);
 611                 else
 612                         true_state = size_to_estate(sval.value + 1);
 613                 break;
 614         case '>':
 615         case SPECIAL_UNSIGNED_GT:
 616                 if (strlen_left) {
 617                         true_state = size_to_estate(-1);
 618                         false_state = size_to_estate(sval.value + 1);
 619                 } else
 620                         true_state = size_to_estate(sval.value);
 621                 break;
 622         }
 623         set_true_false_states_expr(my_size_id, str, true_state, false_state);
 624 }
 625
 626 static struct expression *strip_ampersands(struct expression *expr)
 627 {
 628         struct symbol *type;
 629
 630         if (expr->type != EXPR_PREOP)
 631                 return expr;
 632         if (expr->op != '&')
 633                 return expr;
 634         type = get_type(expr->unop);
 635         if (!type || type->type != SYM_ARRAY)
 636                 return expr;
 637         return expr->unop;
 638 }
 639
 640 static void info_record_alloction(struct expression *buffer, struct range_list *rl)
 641 {
 642         char *name;
 643
 644         if (!option_info)
 645                 return;
 646
 647         name = get_member_name(buffer);
 648         if (!name && is_static(buffer))
 649                 name = expr_to_var(buffer);
 650         if (!name)
 651                 return;
 652         if (rl && !is_whole_rl(rl))
 653                 sql_insert_function_type_size(name, show_rl(rl));
 654         else
 655                 sql_insert_function_type_size(name, "(-1)");
 656
 657         free_string(name);
 658 }
 659
 660 static void store_alloc(struct expression *expr, struct range_list *rl)
 661 {
 662         rl = clone_rl(rl); // FIXME!!!
 663         info_record_alloction(expr, rl);
 664         set_state_expr(my_size_id, expr, alloc_estate_rl(rl));
 665 }
 666
 667 static void match_array_assignment(struct expression *expr)
 668 {
 669         struct expression *left;
 670         struct expression *right;
 671         char *left_member, *right_member;
 672         struct range_list *rl;
 673         sval_t sval;
 674
 675         if (expr->op != '=')
 676                 return;
 677         left = strip_expr(expr->left);
 678         right = strip_expr(expr->right);
 679         right = strip_ampersands(right);
 680
 681         if (!is_pointer(left))
 682                 return;
 683         if (is_allocation_function(right))
 684                 return;
 685
 686         left_member = get_member_name(left);
 687         right_member = get_member_name(right);
 688         if (left_member && right_member && strcmp(left_member, right_member) == 0) {
 689                 free_string(left_member);
 690                 free_string(right_member);
 691                 return;
 692         }
 693         free_string(left_member);
 694         free_string(right_member);
 695
 696         if (get_implied_value(right, &sval) && sval.value == 0) {
 697                 rl = alloc_int_rl(0);
 698                 goto store;
 699         }
 700
 701         rl = get_array_size_bytes_rl(right);
 702
 703 store:
 704         store_alloc(left, rl);
 705 }
 706
 707 static void match_alloc(const char *fn, struct expression *expr, void *_size_arg)
 708 {
 709         int size_arg = PTR_INT(_size_arg);
 710         struct expression *right;
 711         struct expression *arg;
 712         struct range_list *rl;
 713
 714         right = strip_expr(expr->right);
 715         arg = get_argument_from_call_expr(right->args, size_arg);
 716         get_absolute_rl(arg, &rl);
 717         rl = cast_rl(&int_ctype, rl);
 718         store_alloc(expr->left, rl);
 719 }
 720
 721 static void match_calloc(const char *fn, struct expression *expr, void *unused)
 722 {
 723         struct expression *right;
 724         struct expression *arg;
 725         sval_t elements;
 726         sval_t size;
 727
 728         right = strip_expr(expr->right);
 729         arg = get_argument_from_call_expr(right->args, 0);
 730         if (!get_implied_value(arg, &elements))
 731                 return; // FIXME!!!
 732         arg = get_argument_from_call_expr(right->args, 1);
 733         if (get_implied_value(arg, &size))
 734                 store_alloc(expr->left, size_to_rl(elements.value * size.value));
 735         else
 736                 store_alloc(expr->left, size_to_rl(-1));
 737 }
 738
 739 static void match_limited(const char *fn, struct expression *expr, void *_limiter)
 740 {
 741         struct limiter *limiter = (struct limiter *)_limiter;
 742         struct expression *dest;
 743         struct expression *size_expr;
 744         sval_t size;
 745
 746         dest = get_argument_from_call_expr(expr->args, limiter->buf_arg);
 747         size_expr = get_argument_from_call_expr(expr->args, limiter->limit_arg);
 748         if (!get_implied_max(size_expr, &size))
 749                 return;
 750         set_state_expr(my_size_id, dest, size_to_estate(size.value));
 751 }
 752
 753 static void match_strcpy(const char *fn, struct expression *expr, void *unused)
 754 {
 755         struct expression fake_assign;
 756
 757         fake_assign.op = '=';
 758         fake_assign.left = get_argument_from_call_expr(expr->args, 0);
 759         fake_assign.right = get_argument_from_call_expr(expr->args, 1);
 760         match_array_assignment(&fake_assign);
 761 }
 762
 763 static void match_strndup(const char *fn, struct expression *expr, void *unused)
 764 {
 765         struct expression *fn_expr;
 766         struct expression *size_expr;
 767         sval_t size;
 768
 769         fn_expr = strip_expr(expr->right);
 770         size_expr = get_argument_from_call_expr(fn_expr->args, 1);
 771         if (get_implied_max(size_expr, &size)) {
 772                 size.value++;
 773                 store_alloc(expr->left, size_to_rl(size.value));
 774         } else {
 775                 store_alloc(expr->left, size_to_rl(-1));
 776         }
 777
 778 }
 779
 780 static void match_call(struct expression *expr)
 781 {
 782         struct expression *arg;
 783         struct symbol *type;
 784         struct range_list *rl;
 785         int i;
 786
 787         i = -1;
 788         FOR_EACH_PTR(expr->args, arg) {
 789                 i++;
 790                 type = get_type(arg);
 791                 if (!type || (type->type != SYM_PTR && type->type != SYM_ARRAY))
 792                         continue;
 793                 rl = get_array_size_bytes_rl(arg);
 794                 if (!rl)
 795                         continue;
 796                 if (is_whole_rl(rl))
 797                         continue;
 798                 sql_insert_caller_info(expr, BUF_SIZE, i, "$", show_rl(rl));
 799         } END_FOR_EACH_PTR(arg);
 800 }
 801
 802 static void struct_member_callback(struct expression *call, int param, char *printed_name, struct smatch_state *state)
 803 {
 804         if (state == &merged)
 805                 return;
 806         sql_insert_caller_info(call, BUF_SIZE, param, printed_name, state->name);
 807 }
 808
 809 void register_buf_size(int id)
 810 {
 811         my_size_id = id;
 812
 813         add_unmatched_state_hook(my_size_id, &unmatched_size_state);
 814
 815         select_caller_info_hook(set_param_buf_size, BUF_SIZE);
 816         select_return_states_hook(BUF_SIZE, &db_returns_buf_size);
 817
 818         allocation_funcs = create_function_hashtable(100);
 819         add_allocation_function("malloc", &match_alloc, 0);
 820         add_allocation_function("calloc", &match_calloc, 0);
 821         add_allocation_function("memdup", &match_alloc, 1);
 822         add_allocation_function("realloc", &match_alloc, 1);
 823         if (option_project == PROJ_KERNEL) {
 824                 add_allocation_function("kmalloc", &match_alloc, 0);
 825                 add_allocation_function("kzalloc", &match_alloc, 0);
 826                 add_allocation_function("vmalloc", &match_alloc, 0);
 827                 add_allocation_function("__vmalloc", &match_alloc, 0);
 828                 add_allocation_function("kcalloc", &match_calloc, 0);
 829                 add_allocation_function("kmalloc_array", &match_calloc, 0);
 830                 add_allocation_function("drm_malloc_ab", &match_calloc, 0);
 831                 add_allocation_function("drm_calloc_large", &match_calloc, 0);
 832                 add_allocation_function("sock_kmalloc", &match_alloc, 1);
 833                 add_allocation_function("kmemdup", &match_alloc, 1);
 834                 add_allocation_function("kmemdup_user", &match_alloc, 1);
 835                 add_allocation_function("dma_alloc_attrs", &match_alloc, 1);
 836                 add_allocation_function("pci_alloc_consistent", &match_alloc, 1);
 837                 add_allocation_function("pci_alloc_coherent", &match_alloc, 1);
 838                 add_allocation_function("devm_kmalloc", &match_alloc, 1);
 839                 add_allocation_function("devm_kzalloc", &match_alloc, 1);
 840                 add_allocation_function("krealloc", &match_alloc, 1);
 841         }
 842         add_hook(&match_strlen_condition, CONDITION_HOOK);
 843
 844         add_allocation_function("strndup", match_strndup, 0);
 845         if (option_project == PROJ_KERNEL)
 846                 add_allocation_function("kstrndup", match_strndup, 0);
 847
 848         add_modification_hook(my_size_id, &set_size_undefined);
 849
 850         add_merge_hook(my_size_id, &merge_size_func);
 851 }
 852
 853 void register_buf_size_late(int id)
 854 {
 855         /* has to happen after match_alloc() */
 856         add_hook(&match_array_assignment, ASSIGNMENT_HOOK);
 857
 858         add_function_hook("strlcpy", &match_limited, &b0_l2);
 859         add_function_hook("strlcat", &match_limited, &b0_l2);
 860         add_function_hook("memscan", &match_limited, &b0_l2);
 861
 862         add_function_hook("strcpy", &match_strcpy, NULL);
 863
 864         add_hook(&match_call, FUNCTION_CALL_HOOK);
 865         add_member_info_callback(my_size_id, struct_member_callback);
 866 }